@impz/client 0.0.0-stage → 2.0.7

package/dist/index.js

@@ -0,0 +1,1860 @@
+import { ORPCError, ORPCError as ORPCError$1, createORPCClient, isDefinedError, safe } from "@orpc/client";
+import { RPCLink } from "@orpc/client/fetch";
+import * as z from "zod";
+//#endregion
+//#region src/check-server.ts
+const CLIENT_VERSION = "2.0.7";
+async function checkServer(rpc) {
+	const info = await rpc.system.info();
+	return {
+		clientVersion: CLIENT_VERSION,
+		serverVersion: info.version,
+		compatible: isCompatibleVersion(CLIENT_VERSION, info.version)
+	};
+}
+function isCompatibleVersion(client, server) {
+	const ours = parseVersion(client);
+	const theirs = parseVersion(server);
+	if (ours === null || theirs === null || ours.major !== theirs.major) return false;
+	return ours.major > 0 || ours.minor === theirs.minor;
+}
+function parseVersion(version) {
+	const groups = /^(?<major>\d+)\.(?<minor>\d+)\.\d+/.exec(version)?.groups;
+	return groups === void 0 ? null : {
+		major: Number(groups["major"]),
+		minor: Number(groups["minor"])
+	};
+}
+//#endregion
+//#region ../api/src/schemas/name-schema.ts
+const NameSchema = z.string().regex(/^[a-z][a-z0-9-]{0,30}$/, "must be a lowercase letter followed by up to 30 lowercase letters, digits or hyphens");
+z.string().regex(/^[\w.:-]{1,64}$/, "must be 1–64 letters, digits, dots, underscores, colons or hyphens");
+z.int().min(10).max(3600);
+const LeaseOwnerSchema = z.object({
+	principal: z.string(),
+	display: z.string(),
+	label: z.string()
+});
+const LeaseSchema = z.object({
+	name: NameSchema,
+	owner: LeaseOwnerSchema,
+	until: z.date().nullable()
+});
+const LeaseSummarySchema = z.object({
+	leases: z.array(LeaseSchema).readonly(),
+	otherCount: z.int().nonnegative()
+});
+//#endregion
+//#region ../api/src/schemas/image-schema.ts
+const ImageSourceSchema = z.enum(["oci", "imp"]);
+const ImageSchema = z.object({
+	id: z.string(),
+	name: NameSchema,
+	ref: z.string(),
+	digest: z.string(),
+	source: ImageSourceSchema,
+	createdAt: z.date(),
+	sizeBytes: z.int().nonnegative()
+});
+//#endregion
+//#region ../api/src/protocols/image-build-protocol.ts
+const IMAGE_BUILD_PATH = "/images/build";
+const IMAGE_BUILD_STREAM_TYPE = "application/x-ndjson";
+const DockerfilePathSchema = z.string().min(1).refine((path) => !path.startsWith("/") && !path.split(/[/\\]/u).includes(".."), { message: "the Dockerfile path must be relative and stay inside the build context" });
+z.object({
+	name: NameSchema,
+	dockerfile: DockerfilePathSchema.optional()
+});
+const ImageBuildResultSchema = ImageSchema.extend({ createdAt: z.coerce.date() });
+const ImageBuildErrorSchema = z.object({
+	code: z.string(),
+	message: z.string()
+});
+const ImageBuildPhaseSchema = z.enum([
+	"upload",
+	"pack",
+	"build",
+	"pull",
+	"unpack",
+	"copy"
+]);
+const IMAGE_BUILD_LOG_MAX_CHARS = 8192;
+const ImageBuildProgressSchema = z.object({
+	type: z.literal("progress"),
+	phase: ImageBuildPhaseSchema,
+	elapsedMs: z.number().nonnegative(),
+	step: z.string().optional()
+});
+const ImageBuildLogSchema = z.object({
+	type: z.literal("log"),
+	text: z.string().max(IMAGE_BUILD_LOG_MAX_CHARS)
+});
+const ImageBuildEventSchema = z.discriminatedUnion("type", [
+	ImageBuildProgressSchema,
+	ImageBuildLogSchema,
+	z.object({
+		type: z.literal("image"),
+		image: ImageBuildResultSchema
+	}),
+	ImageBuildErrorSchema.extend({ type: z.literal("error") })
+]);
+z.discriminatedUnion("type", [
+	ImageBuildProgressSchema,
+	ImageBuildLogSchema,
+	z.object({
+		type: z.literal("image"),
+		image: ImageSchema
+	})
+]);
+//#endregion
+//#region ../api/src/schemas/offset-schema.ts
+const OffsetSchema = z.int().nonnegative();
+//#endregion
+//#region ../api/src/schemas/session-output-schema.ts
+const ExecutionGenerationSchema = z.string().regex(/^[0-9a-f]{32}$/);
+const ColdBootCauseSchema = z.enum([
+	"start",
+	"wake_fallback",
+	"watchdog",
+	"restore",
+	"recovery",
+	"unknown"
+]);
+const ColdBootSchema = z.object({
+	bootId: z.string(),
+	cause: ColdBootCauseSchema,
+	at: z.iso.datetime()
+}).readonly();
+const ColdBootsSchema = z.array(ColdBootSchema).max(4).readonly();
+const PreviousGenerationSchema = z.object({
+	executionGeneration: ExecutionGenerationSchema,
+	end: OffsetSchema,
+	exitCode: z.int().nullable()
+}).readonly();
+const ResumeFromSchema = z.object({
+	executionGeneration: ExecutionGenerationSchema,
+	offset: OffsetSchema
+}).readonly();
+const ResumeResultSchema = z.discriminatedUnion("kind", [
+	z.object({ kind: z.literal("exact") }),
+	z.object({
+		kind: z.literal("gap"),
+		from: OffsetSchema,
+		to: OffsetSchema
+	}),
+	z.object({
+		kind: z.literal("generation_changed"),
+		executionGeneration: ExecutionGenerationSchema,
+		firstOffset: OffsetSchema
+	})
+]).readonly();
+const SessionLogStateSchema = z.object({ enabled: z.boolean() }).readonly();
+const SessionOutputSchema = z.discriminatedUnion("continuity", [z.object({ continuity: z.literal("none") }), z.object({
+	continuity: z.literal("offsets"),
+	bootId: z.string(),
+	executionGeneration: ExecutionGenerationSchema,
+	bufferStart: OffsetSchema,
+	end: OffsetSchema,
+	offset: OffsetSchema,
+	prelude: OffsetSchema,
+	coldBoots: ColdBootsSchema,
+	previous: PreviousGenerationSchema.optional(),
+	resume: ResumeResultSchema.optional(),
+	log: SessionLogStateSchema.optional()
+})]).readonly();
+const NoSessionDataSchema = z.object({
+	bootId: z.string(),
+	coldBoots: ColdBootsSchema,
+	previous: PreviousGenerationSchema.optional()
+}).readonly();
+const InvalidResumeDataSchema = z.object({
+	end: OffsetSchema,
+	bufferStart: OffsetSchema
+}).readonly();
+const SessionNameSchema = z.string().regex(/^[a-z0-9][a-z0-9-]{0,31}$/, "must be a lowercase letter or digit followed by up to 31 lowercase letters, digits or hyphens");
+const SessionExitSchema = z.object({
+	code: z.int().nullable(),
+	signal: z.string().nullable()
+}).readonly();
+z.object({
+	name: SessionNameSchema,
+	pid: z.int().positive(),
+	argv: z.array(z.string()).readonly(),
+	state: z.enum(["running", "exited"]),
+	attached: z.boolean(),
+	cols: z.int().positive(),
+	rows: z.int().positive(),
+	startedAt: z.date(),
+	exit: SessionExitSchema.optional(),
+	continuity: z.enum(["none", "offsets"]).optional(),
+	executionGeneration: ExecutionGenerationSchema.optional(),
+	bootId: z.string().optional(),
+	end: z.int().nonnegative().optional(),
+	endObservedAt: z.date().optional(),
+	log: z.boolean().optional()
+});
+//#endregion
+//#region ../api/src/protocols/exec-protocol.ts
+const EXEC_PATH = "/exec";
+const EXEC_TICKET_PARAM = "ticket";
+const EXEC_CHANNELS = {
+	stdin: 0,
+	stdout: 1,
+	stderr: 2
+};
+const DimensionSchema = z.int().min(1).max(65535);
+const EXEC_TOOLS = ["tar"];
+const EXEC_REQUIREMENTS = ["broker"];
+const EXEC_HIGH_WATER_BYTES = 1048576;
+const ExecStartMessageSchema = z.object({
+	type: z.literal("start"),
+	name: NameSchema,
+	argv: z.array(z.string()).min(1),
+	env: z.record(z.string(), z.string()).optional(),
+	cwd: z.string().optional(),
+	tty: z.boolean(),
+	cols: DimensionSchema.optional(),
+	rows: DimensionSchema.optional(),
+	session: SessionNameSchema.optional(),
+	tool: z.enum(EXEC_TOOLS).optional(),
+	outer: z.boolean().optional(),
+	killGraceMs: z.int().min(1).max(6e4).optional(),
+	resumeFrom: ResumeFromSchema.optional(),
+	require: z.array(z.enum(EXEC_REQUIREMENTS)).optional(),
+	log: z.boolean().optional()
+}).refine((start) => start.session === void 0 || start.tty, {
+	message: "a session needs a tty",
+	path: ["tty"]
+}).refine((start) => start.resumeFrom === void 0 || start.session !== void 0, {
+	message: "only a session resumes",
+	path: ["resumeFrom"]
+}).refine((start) => start.log !== true || start.session !== void 0, {
+	message: "only a session keeps a log",
+	path: ["log"]
+}).refine((start) => start.killGraceMs === void 0 || !start.tty, {
+	message: "a tty exec takes no kill grace",
+	path: ["killGraceMs"]
+}).refine((start) => start.tool === void 0 || !start.tty && start.session === void 0 && start.env === void 0 && start.cwd === void 0, {
+	message: "a tool takes no tty, session, env or cwd",
+	path: ["tool"]
+}).refine((start) => start.outer !== true || start.tool === void 0 && start.session === void 0, {
+	message: "an outer exec takes no tool or session",
+	path: ["outer"]
+}).refine((start) => start.require === void 0 || start.require.length === 0 || start.tool === void 0 && start.outer !== true, {
+	message: "a tool or an outer exec takes no require",
+	path: ["require"]
+});
+const ExecAttachMessageSchema = z.object({
+	type: z.literal("attach"),
+	name: NameSchema,
+	session: SessionNameSchema,
+	cols: DimensionSchema.optional(),
+	rows: DimensionSchema.optional(),
+	resumeFrom: ResumeFromSchema.optional(),
+	wake: z.boolean().optional()
+});
+z.discriminatedUnion("type", [
+	ExecStartMessageSchema,
+	ExecAttachMessageSchema,
+	z.object({ type: z.literal("stdin_eof") }),
+	z.object({
+		type: z.literal("resize"),
+		cols: DimensionSchema,
+		rows: DimensionSchema
+	}),
+	z.object({
+		type: z.literal("signal"),
+		signal: z.string().regex(/^SIG[A-Z0-9]+$/)
+	}),
+	z.object({
+		type: z.literal("stdout_ack"),
+		bytes: z.int().positive()
+	})
+]);
+const ExecServerMessageSchema = z.discriminatedUnion("type", [
+	z.object({
+		type: z.literal("started"),
+		pid: z.int().positive(),
+		session: SessionNameSchema.optional(),
+		created: z.boolean().optional(),
+		groupKill: z.boolean().optional(),
+		output: SessionOutputSchema.optional()
+	}),
+	z.object({
+		type: z.literal("exit"),
+		code: z.int().nullable(),
+		signal: z.string().nullable(),
+		offset: z.int().nonnegative().optional()
+	}),
+	z.object({
+		type: z.literal("detached"),
+		reason: z.enum([
+			"taken_over",
+			"slow",
+			"lost"
+		]),
+		offset: z.int().nonnegative().optional()
+	}),
+	z.object({
+		type: z.literal("stdin_ack"),
+		bytes: z.int().positive()
+	}),
+	z.object({
+		type: z.literal("error"),
+		message: z.string(),
+		code: z.string().optional(),
+		data: z.unknown().optional()
+	})
+]);
+function encodeExecFrame(channel, data) {
+	const frame = new Uint8Array(data.byteLength + 1);
+	frame[0] = channel;
+	frame.set(data, 1);
+	return frame;
+}
+function decodeExecFrame(frame) {
+	const [channel] = frame;
+	if (!isExecChannel(channel)) throw new Error(`exec frame has an unknown channel byte: ${String(channel)}`);
+	return {
+		channel,
+		data: frame.subarray(1)
+	};
+}
+function isExecChannel(value) {
+	return value === EXEC_CHANNELS.stdin || value === EXEC_CHANNELS.stdout || value === EXEC_CHANNELS.stderr;
+}
+z.enum(["tailnet", "public"]);
+const PublicAuthSchema = z.enum([
+	"none",
+	"token",
+	"basic"
+]);
+const BasicUserSchema = z.string().regex(/^[!-9;-~]{1,64}$/, "must be 1 to 64 printable characters, without a colon");
+z.object({
+	name: NameSchema,
+	auth: PublicAuthSchema.default("token"),
+	user: BasicUserSchema.optional()
+}).refine((input) => input.auth === "basic" || input.user === void 0, {
+	message: "only basic auth takes a user",
+	path: ["user"]
+});
+z.object({
+	url: z.url(),
+	auth: PublicAuthSchema,
+	user: z.string().nullable(),
+	credential: z.string().nullable(),
+	warning: z.string().optional()
+});
+//#endregion
+//#region ../api/src/schemas/move-schema.ts
+const MoveStateSchema = z.enum([
+	"sending",
+	"moved",
+	"receiving"
+]);
+const PeerUrlSchema = z.url({ protocol: /^https?$/ });
+const WarmHostSchema = z.object({
+	firecrackerVersion: z.string(),
+	snapshotVersion: z.string(),
+	hostKernel: z.string(),
+	cpuModel: z.string(),
+	cpuFlags: z.string(),
+	dataDir: z.string(),
+	storage: z.enum(["xfs", "zfs"]),
+	subnet: z.string(),
+	slotCount: z.int().positive(),
+	brokerPort: z.int().positive(),
+	dns: z.array(z.string()).readonly()
+});
+const WarmMoveSchema = z.object({
+	slot: z.int().nonnegative(),
+	egressMode: z.string(),
+	snapshot: z.object({
+		firecrackerVersion: z.string(),
+		snapshotVersion: z.string(),
+		hostKernel: z.string(),
+		cpuModel: z.string().nullable(),
+		cpuFlags: z.string().nullable(),
+		ipv6Prefix: z.string().nullable()
+	}),
+	host: WarmHostSchema.pick({
+		dataDir: true,
+		storage: true,
+		subnet: true,
+		brokerPort: true,
+		dns: true
+	})
+});
+z.object({
+	bytes: z.int().nonnegative(),
+	checkpoints: z.int().nonnegative(),
+	warm: WarmMoveSchema.nullable()
+});
+z.object({
+	ticket: z.string(),
+	expiresAt: z.date(),
+	peerUrl: PeerUrlSchema
+});
+z.object({
+	state: MoveStateSchema.nullable(),
+	peer: z.string().nullable(),
+	sentBytes: z.int().nonnegative(),
+	totalBytes: z.int().nonnegative(),
+	isDone: z.boolean(),
+	error: z.string().nullable()
+});
+//#endregion
+//#region ../api/src/schemas/secret-schema.ts
+const SecretNameSchema = NameSchema;
+const PrintableSchema = z.string().regex(/^[!-~]+$/, "must be printable ASCII without spaces");
+PrintableSchema.min(1).max(8192);
+const BrokerHostSchema = z.string().max(253).regex(/^(?:[a-z0-9][a-z0-9-]{0,62}\.)+[a-z][a-z0-9-]{0,62}$/, "must be a lowercase hostname such as api.example.com");
+const BrokerUpstreamSchema = z.string().max(2048).transform((value, context) => {
+	const url = URL.parse(value);
+	if (url === null || url.protocol !== "http:" && url.protocol !== "https:") {
+		context.addIssue({
+			code: "custom",
+			message: "must be an http or https URL"
+		});
+		return z.NEVER;
+	}
+	if (url.username !== "" || url.password !== "") {
+		context.addIssue({
+			code: "custom",
+			message: "must not hold a user name or password"
+		});
+		return z.NEVER;
+	}
+	if (url.search !== "" || url.hash !== "" || value.includes("?") || value.includes("#")) {
+		context.addIssue({
+			code: "custom",
+			message: "must not have a query or a fragment"
+		});
+		return z.NEVER;
+	}
+	if (url.pathname !== "/") {
+		context.addIssue({
+			code: "custom",
+			message: "must be an origin with no path"
+		});
+		return z.NEVER;
+	}
+	return url.origin;
+});
+const BrokerRuleSchema = z.object({
+	host: BrokerHostSchema,
+	header: z.string().regex(/^[a-z0-9-]{1,64}$/, "must be a lowercase header name such as authorization"),
+	scheme: z.enum([
+		"bearer",
+		"basic",
+		"raw"
+	]),
+	user: BasicUserSchema.optional(),
+	upstream: BrokerUpstreamSchema.optional()
+});
+const SecretKindSchema = z.enum([
+	"github",
+	"anthropic",
+	"npm",
+	"custom",
+	"oauth"
+]);
+const OAuthStateSchema = z.object({
+	tokenUrl: z.url({ protocol: /^https$/ }).max(2048),
+	clientId: PrintableSchema.min(1).max(256),
+	tokenFormat: z.enum(["json", "form"]).default("form")
+}).extend({
+	status: z.enum([
+		"pending",
+		"ready",
+		"needs_login"
+	]),
+	expiresAt: z.date().nullable(),
+	refreshedAt: z.date().nullable(),
+	error: z.string().nullable(),
+	idClaims: z.record(z.string(), z.unknown()).readonly().nullable()
+});
+z.object({
+	name: SecretNameSchema,
+	kind: SecretKindSchema,
+	rules: z.array(BrokerRuleSchema).readonly(),
+	imps: z.array(NameSchema).readonly(),
+	createdAt: z.date(),
+	oauth: OAuthStateSchema.optional()
+}).extend({ droppedGrants: z.int().nonnegative().default(0) });
+const GrantMethodSchema = z.string().regex(/^[A-Z]{1,16}$/, "must be an uppercase method such as GET");
+const GrantPathSchema = z.string().max(512).regex(/^(?:\/(?:\*|[A-Za-z0-9._~!$&'()+,;=:@-]*))*(?:\/\*\*)?$/, "must be a path such as /v1/messages, with * for one segment and a last /** for the rest").refine((path) => path.startsWith("/"), "must start with /");
+const GrantFilterSchema = z.object({
+	methods: z.array(GrantMethodSchema).min(1).max(16).readonly().optional(),
+	paths: z.array(GrantPathSchema).min(1).max(64).readonly().optional()
+}).refine((filter) => filter.methods !== void 0 || filter.paths !== void 0, "must name methods, paths or both");
+z.object({
+	secret: SecretNameSchema,
+	filter: GrantFilterSchema.nullable()
+});
+const AuditRefusalSchema = z.enum([
+	"not-http",
+	"not-connect",
+	"bad-target",
+	"connection-limit",
+	"egress-policy",
+	"address-refused",
+	"wrong-host",
+	"websocket",
+	"no-grant",
+	"outside-filter"
+]);
+z.object({
+	at: z.date(),
+	imp: NameSchema,
+	secret: SecretNameSchema,
+	method: z.string(),
+	host: BrokerHostSchema,
+	path: z.string(),
+	status: z.int(),
+	requestBytes: z.int().nonnegative(),
+	responseBytes: z.int().nonnegative(),
+	durationMs: z.int().nonnegative()
+});
+z.object({
+	at: z.date(),
+	imp: NameSchema,
+	method: z.string().nullable(),
+	host: z.string().max(253).nullable(),
+	path: z.string().nullable(),
+	status: z.int(),
+	durationMs: z.int().nonnegative(),
+	reason: AuditRefusalSchema
+});
+//#endregion
+//#region ../api/src/schemas/imp-schema.ts
+const ImpStateSchema = z.enum([
+	"creating",
+	"running",
+	"sleeping",
+	"stopped",
+	"error"
+]);
+const ImpKindSchema = z.enum(["user", "builder"]);
+const OutdatedPartSchema = z.enum([
+	"firecracker",
+	"kernel",
+	"agent",
+	"impd",
+	"ipv6"
+]);
+const ImpResourcesSchema = z.object({
+	wakeCount: z.int().nonnegative(),
+	awakeMs: z.int().nonnegative(),
+	sample: z.object({
+		measuredAt: z.date(),
+		since: z.date(),
+		cpuPercent: z.number().nonnegative().optional(),
+		cpuThrottledMs: z.int().nonnegative(),
+		netRxBytes: z.int().nonnegative(),
+		netTxBytes: z.int().nonnegative()
+	}).optional()
+});
+const ImpSchema = z.object({
+	id: z.string(),
+	name: NameSchema,
+	image: NameSchema,
+	state: ImpStateSchema,
+	kind: ImpKindSchema.optional(),
+	vcpus: z.int().positive(),
+	memoryMib: z.int().positive(),
+	maxMemoryMib: z.int().positive().optional(),
+	pluggedMib: z.int().nonnegative().optional(),
+	backup: z.boolean().optional(),
+	diskMib: z.int().positive(),
+	diskUsage: z.object({
+		exclusiveBytes: z.int().nonnegative(),
+		sharedBytes: z.int().nonnegative(),
+		measuredAt: z.date(),
+		isPartial: z.boolean(),
+		isUpperBound: z.boolean()
+	}).optional(),
+	ip: z.ipv4(),
+	slot: z.int().nonnegative(),
+	port: z.int().positive(),
+	httpPort: z.int().positive(),
+	url: z.url(),
+	public: z.object({ auth: PublicAuthSchema }).optional(),
+	createdAt: z.date(),
+	lastActiveAt: z.date(),
+	ramMib: z.int().nonnegative().optional(),
+	rssMib: z.int().nonnegative().optional(),
+	sleptAt: z.date().optional(),
+	holdUntil: z.date().optional(),
+	leases: LeaseSummarySchema.optional(),
+	error: z.string().optional(),
+	sessions: z.int().nonnegative().optional(),
+	coldBootReason: z.string().optional(),
+	agentSilentSince: z.date().optional(),
+	inner: z.object({
+		up: z.boolean(),
+		restarts: z.int().nonnegative(),
+		lastError: z.string().optional()
+	}).optional(),
+	outdated: z.array(OutdatedPartSchema).readonly().optional(),
+	cpu: z.object({
+		limit: z.number().positive().nullable(),
+		weight: z.int()
+	}).optional(),
+	resources: ImpResourcesSchema.optional(),
+	move: MoveStateSchema.optional()
+});
+const GrantNotCopiedReasonSchema = z.enum([
+	"not-grantable",
+	"clash",
+	"no-secret"
+]);
+const GrantNotCopiedSchema = z.object({
+	secret: SecretNameSchema,
+	reason: GrantNotCopiedReasonSchema
+});
+ImpSchema.extend({
+	grantsNotCopied: z.array(GrantNotCopiedSchema).readonly().optional(),
+	grantsError: z.string().optional()
+});
+//#endregion
+//#region ../api/src/protocols/tunnel-protocol.ts
+const TUNNEL_PATH = "/tunnel";
+const TUNNEL_CLOSE_NORMAL = 1e3;
+const TUNNEL_CLOSE_PROTOCOL = 1002;
+const TUNNEL_WINDOW_BYTES = 1048576;
+const TUNNEL_MAX_FRAME_BYTES = 65536;
+const AckSchema = z.object({
+	type: z.literal("ack"),
+	bytes: z.int().positive()
+});
+const TunnelListenSchema = z.object({
+	type: z.literal("listen"),
+	name: NameSchema,
+	network: z.enum(["unix", "tcp"]),
+	path: z.string().startsWith("/").nullable().optional(),
+	port: z.int().min(0).max(65535).optional()
+}).refine((listen) => listen.network === "tcp" ? listen.port !== void 0 && listen.path === void 0 : listen.port === void 0, {
+	message: "tcp takes a port, unix a path or null",
+	path: ["network"]
+});
+z.discriminatedUnion("type", [
+	z.object({
+		type: z.literal("open"),
+		name: NameSchema,
+		port: z.int().min(1).max(65535)
+	}),
+	z.object({ type: z.literal("eof") }),
+	AckSchema,
+	TunnelListenSchema,
+	z.object({
+		type: z.literal("accept"),
+		name: NameSchema,
+		listener: z.string().min(1),
+		connection: z.int().positive()
+	})
+]);
+const TunnelServerMessageSchema = z.discriminatedUnion("type", [
+	z.object({ type: z.literal("opened") }),
+	z.object({ type: z.literal("eof") }),
+	AckSchema,
+	z.object({
+		type: z.literal("listening"),
+		listener: z.string(),
+		path: z.string().nullable(),
+		port: z.int().nullable()
+	}),
+	z.object({
+		type: z.literal("connection"),
+		id: z.int().positive()
+	}),
+	z.object({
+		type: z.literal("error"),
+		message: z.string(),
+		code: z.string().optional()
+	})
+]);
+//#endregion
+//#region ../api/src/contract/define-errors.ts
+function defineErrors(errors) {
+	return errors;
+}
+//#endregion
+//#region ../api/src/contract/imp-errors.ts
+const ResourceKindSchema = z.enum([
+	"imp",
+	"image",
+	"checkpoint",
+	"session",
+	"service",
+	"secret",
+	"grant",
+	"backup",
+	"token",
+	"ssh-key",
+	"network",
+	"oauth-client",
+	"oauth-grant",
+	"oauth-approval",
+	"database-copy"
+]);
+const ResourceDataSchema = z.object({
+	kind: ResourceKindSchema,
+	name: z.string(),
+	reason: z.enum(["binding_changed"]).optional()
+});
+const ForbiddenReasonSchema = z.enum([
+	"imp_out_of_scope",
+	"not_grantable",
+	"scope"
+]);
+const ForbiddenDataSchema = z.object({ reason: ForbiddenReasonSchema });
+const PreconditionDataSchema = z.object({
+	reason: z.enum(["broker_not_ready", "impd_outdated"]),
+	detail: z.string()
+});
+const ProtectedImpSchema = z.object({
+	name: NameSchema,
+	ramMib: z.int().nonnegative(),
+	leased: z.boolean(),
+	busy: z.boolean()
+});
+const IMP_ERRORS = defineErrors({
+	NOT_FOUND: {
+		message: "Not found",
+		data: ResourceDataSchema
+	},
+	CONFLICT: {
+		message: "Already exists",
+		data: ResourceDataSchema
+	},
+	FORBIDDEN: {
+		message: "Not allowed",
+		data: ForbiddenDataSchema.optional()
+	},
+	PRECONDITION_FAILED: {
+		message: "Not possible on this host",
+		data: PreconditionDataSchema.optional()
+	},
+	RAM_BUDGET_EXCEEDED: {
+		message: "Not enough RAM budget, even after sleeping idle imps",
+		status: 503,
+		data: z.object({
+			budgetMib: z.int().nonnegative(),
+			usedMib: z.int().nonnegative(),
+			requestedMib: z.int().nonnegative(),
+			neededMib: z.int().nonnegative().optional(),
+			protected: z.array(ProtectedImpSchema).readonly().optional(),
+			protectedHidden: z.int().nonnegative().optional()
+		})
+	},
+	SERVICE_UNAVAILABLE: { message: "impd is stopping" },
+	INVALID_STATE: {
+		message: "The imp is not in a state that allows this",
+		status: 409,
+		data: z.object({
+			state: ImpStateSchema,
+			allowed: z.array(ImpStateSchema),
+			coldBoots: ColdBootsSchema.optional()
+		})
+	},
+	INVALID_RESUME: {
+		message: "The resume offset is past the end of the output",
+		status: 409,
+		data: InvalidResumeDataSchema
+	},
+	DISK_FULL: {
+		message: "Not enough free disk on the host",
+		status: 507,
+		data: z.object({
+			availableBytes: z.int().nonnegative(),
+			reserveBytes: z.int().nonnegative(),
+			requestedBytes: z.int().nonnegative()
+		})
+	},
+	LEASED: {
+		message: "The imp is leased",
+		status: 409,
+		data: LeaseSummarySchema
+	},
+	LEASE_NOT_HELD: {
+		message: "The caller holds no such lease",
+		status: 409
+	},
+	AGENT_OUTDATED: {
+		message: "The imp's agent is too old for this",
+		status: 409
+	},
+	MOVING: {
+		message: "The imp is moving between hosts",
+		status: 409,
+		data: z.object({ retryAfterS: z.int().positive() })
+	}
+});
+//#endregion
+//#region ../api/src/protocols/login-shell.ts
+const CONSOLE_SHELL = buildConsoleShell("/etc/passwd", ["/bin/bash", "/bin/sh"]);
+function buildConsoleShell(passwdPath, fallbacks) {
+	return [
+		"uid=$(id -u 2>/dev/null) || uid=0",
+		"shell=",
+		"while IFS=: read -r _ _ id _ _ _ login; do",
+		"  if [ \"$id\" = \"$uid\" ]; then shell=$login; break; fi",
+		`done < ${passwdPath}`,
+		...fallbacks.map((fallback) => `[ -x "$shell" ] || shell=${fallback}`),
+		"exec \"$shell\" -l"
+	].join("\n");
+}
+//#endregion
+//#region ../shared/src/split-lines.ts
+function splitLines() {
+	const state = { pending: "" };
+	return new TransformStream({
+		transform: (chunk, controller) => {
+			const lines = `${state.pending}${chunk}`.split("\n");
+			state.pending = lines.pop() ?? "";
+			for (const line of lines) controller.enqueue(line);
+		},
+		flush: (controller) => {
+			if (state.pending !== "") controller.enqueue(state.pending);
+		}
+	});
+}
+//#endregion
+//#region src/read-build-answer.ts
+async function readBuildAnswer(response, onProgress, onLog) {
+	if (response.ok && isStream(response)) return readBuildEvents(response, onProgress, onLog);
+	const body = await response.json().catch(() => null);
+	if (response.ok) return ImageBuildResultSchema.parse(body);
+	const failure = ImageBuildErrorSchema.safeParse(body);
+	if (failure.success) throw new ORPCError$1(failure.data.code, {
+		status: response.status,
+		message: failure.data.message
+	});
+	const code = response.status === 401 ? "UNAUTHORIZED" : "INTERNAL_SERVER_ERROR";
+	throw new ORPCError$1(code, {
+		status: response.status,
+		message: `impd answered ${String(response.status)} to the image build`
+	});
+}
+function isStream(response) {
+	return response.headers.get("content-type")?.startsWith(IMAGE_BUILD_STREAM_TYPE) === true;
+}
+async function readBuildEvents(response, onProgress, onLog) {
+	for await (const line of readLines(response)) {
+		const parsed = ImageBuildEventSchema.safeParse(parseJson(line));
+		if (!parsed.success) continue;
+		const event = parsed.data;
+		if (event.type === "image") return event.image;
+		if (event.type === "error") throw new ORPCError$1(event.code, { message: event.message });
+		if (event.type === "log") onLog?.(event.text);
+		else onProgress?.(event);
+	}
+	throw new ORPCError$1("INTERNAL_SERVER_ERROR", { message: "the image build stream ended before impd answered the image" });
+}
+async function* readLines(response) {
+	if (response.body === null) return;
+	yield* response.body.pipeThrough(new TextDecoderStream()).pipeThrough(splitLines());
+}
+function parseJson(line) {
+	try {
+		return JSON.parse(line);
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/resolve-impd-url.ts
+function resolveImpdUrl(base, path) {
+	const url = new URL(base);
+	url.pathname = `${url.pathname.replace(/\/+$/, "")}${path}`;
+	return url;
+}
+//#endregion
+//#region src/build-image.ts
+async function buildImage(deps, name, context, options = {}) {
+	const url = resolveImpdUrl(deps.baseUrl, IMAGE_BUILD_PATH);
+	url.searchParams.set("name", name);
+	if (options.dockerfile !== void 0) url.searchParams.set("dockerfile", options.dockerfile);
+	const headers = {
+		"content-type": "application/x-tar",
+		accept: `${IMAGE_BUILD_STREAM_TYPE}, application/json`
+	};
+	if (deps.token !== null) headers["authorization"] = `Bearer ${deps.token}`;
+	if (options.size !== void 0) headers["content-length"] = String(options.size);
+	const init = {
+		method: "POST",
+		headers,
+		body: context,
+		duplex: "half",
+		...options.signal !== void 0 && { signal: options.signal }
+	};
+	const request = new Request(url.href, init);
+	return readBuildAnswer(await (deps.fetch ?? fetch)(request), options.onProgress, options.onLog);
+}
+//#endregion
+//#region src/exec/exec-error.ts
+var ExecError = class extends Error {
+	code;
+	data;
+	constructor(code, message, options = {}) {
+		const errorOptions = options.cause === void 0 ? {} : { cause: options.cause };
+		super(message, errorOptions);
+		this.name = "ExecError";
+		this.code = code;
+		this.data = options.data;
+	}
+};
+//#endregion
+//#region src/exec/check-exec-require.ts
+const CHECK_TIMEOUT_MS$1 = 5e3;
+const FeaturesSchema = z.object({ execRequire: z.boolean().optional() });
+const InfoAnswerSchema = z.object({ json: z.object({ features: FeaturesSchema.optional() }) });
+async function checkExecRequire(baseUrl, token, customFetch = fetch) {
+	let response;
+	try {
+		response = await customFetch(new Request(resolveImpdUrl(baseUrl, "/rpc/system/info").href, {
+			method: "POST",
+			headers: token === null ? {} : { authorization: `Bearer ${token}` },
+			signal: AbortSignal.timeout(CHECK_TIMEOUT_MS$1)
+		}));
+	} catch (error) {
+		return {
+			kind: "unreachable",
+			detail: `system.info: ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+	if (response.status === 401) {
+		await response.body?.cancel();
+		return { kind: "unauthorized" };
+	}
+	const body = await response.json().catch(() => null);
+	const parsed = InfoAnswerSchema.safeParse(body);
+	if (!response.ok || !parsed.success) return {
+		kind: "failed",
+		code: null,
+		message: `impd answered system.info with ${String(response.status)}; nothing was started`
+	};
+	if (parsed.data.json.features?.execRequire === true) return null;
+	const detail = "this impd is older than 0.30.0 and does not check exec requirements";
+	return {
+		kind: "failed",
+		code: "PRECONDITION_FAILED",
+		message: `nothing was started: ${detail}`,
+		data: {
+			reason: "impd_outdated",
+			detail
+		}
+	};
+}
+//#endregion
+//#region src/exec/check-impd-access.ts
+const CHECK_TIMEOUT_MS = 5e3;
+async function checkImpdAccess(baseUrl, token, customFetch = fetch) {
+	try {
+		const response = await customFetch(new Request(resolveImpdUrl(baseUrl, "/rpc/system/info").href, {
+			method: "POST",
+			headers: token === null ? {} : { authorization: `Bearer ${token}` },
+			signal: AbortSignal.timeout(CHECK_TIMEOUT_MS)
+		}));
+		await response.body?.cancel();
+		return response.status === 401 ? "unauthorized" : "reachable";
+	} catch {
+		return "unreachable";
+	}
+}
+//#endregion
+//#region src/exec/open-exec-session.ts
+const OPEN_TIMEOUT_MS = 1e4;
+const DRAIN_POLL_MS = 50;
+var BadMessageError = class extends Error {
+	name = "BadMessageError";
+};
+function openExecSession(options) {
+	const url = resolveImpdUrl(options.baseUrl, EXEC_PATH);
+	url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+	if (options.ticket !== void 0) url.searchParams.set(EXEC_TICKET_PARAM, options.ticket);
+	const headers = options.token === null ? {} : { authorization: `Bearer ${options.token}` };
+	const ws = options.connect(url.href, headers);
+	const outcome = Promise.withResolvers();
+	const state = {
+		opened: false,
+		sentOpen: false,
+		started: false,
+		finished: false,
+		refused: false
+	};
+	const held = [];
+	let heldBytes = 0;
+	const countQueuedBytes = () => ws.bufferedAmount + heldBytes;
+	ws.binaryType = "arraybuffer";
+	const stopSocket = () => {
+		state.finished = true;
+		clearTimeout(openTimer);
+		ws.close();
+	};
+	const resolveOutcome = (result) => {
+		if (state.finished) return;
+		stopSocket();
+		outcome.resolve(result);
+	};
+	const openTimer = setTimeout(() => {
+		resolveOutcome({
+			kind: "unreachable",
+			detail: `no answer in ${String(OPEN_TIMEOUT_MS / 1e3)} s`
+		});
+	}, OPEN_TIMEOUT_MS);
+	const sendControl = (data) => {
+		if (state.finished || ws.readyState !== WebSocket.OPEN) return;
+		if (state.sentOpen) ws.send(data);
+		else {
+			held.push(data);
+			heldBytes += typeof data === "string" ? data.length : data.byteLength;
+		}
+	};
+	const handleFrame = (data) => {
+		let frame;
+		try {
+			frame = decodeExecFrame(data);
+		} catch (error) {
+			throw new BadMessageError(error instanceof Error ? error.message : String(error));
+		}
+		if (frame.channel === EXEC_CHANNELS.stdin) throw new BadMessageError("impd sent data on the stdin channel");
+		const channel = frame.channel === EXEC_CHANNELS.stderr ? "stderr" : "stdout";
+		options.onOutput(channel, frame.data);
+	};
+	const handleControl = (text) => {
+		let json;
+		try {
+			json = JSON.parse(text);
+		} catch {
+			throw new BadMessageError(`not JSON: ${text.slice(0, 80)}`);
+		}
+		const parsed = ExecServerMessageSchema.safeParse(json);
+		if (!parsed.success) throw new BadMessageError(`unknown message: ${text.slice(0, 80)}`);
+		const message = parsed.data;
+		if (message.type === "started") {
+			if (state.started) return;
+			state.started = true;
+			options.onStarted({
+				pid: message.pid,
+				session: message.session ?? null,
+				created: message.created ?? false,
+				groupKill: message.groupKill ?? false,
+				output: message.output ?? { continuity: "none" }
+			});
+		} else if (message.type === "exit") resolveOutcome({
+			kind: "exit",
+			code: message.code,
+			signal: message.signal,
+			...message.offset !== void 0 && { offset: message.offset }
+		});
+		else if (message.type === "detached") resolveOutcome({
+			kind: "detached",
+			reason: message.reason,
+			...message.offset !== void 0 && { offset: message.offset }
+		});
+		else if (message.type === "stdin_ack") {} else resolveOutcome({
+			kind: "failed",
+			code: message.code ?? null,
+			message: message.message,
+			...message.data !== void 0 && { data: message.data }
+		});
+	};
+	const sendOpen = async () => {
+		const start = options.start;
+		if ("argv" in start && start.require !== void 0 && start.require.length > 0) {
+			const refusal = await checkExecRequire(options.baseUrl, options.token, options.fetch);
+			if (refusal !== null) {
+				resolveOutcome(refusal);
+				return;
+			}
+		}
+		if (state.finished || ws.readyState !== WebSocket.OPEN) return;
+		ws.send(JSON.stringify(buildOpenMessage(start)));
+		state.sentOpen = true;
+		heldBytes = 0;
+		for (const data of held.splice(0)) ws.send(data);
+	};
+	ws.addEventListener("open", () => {
+		state.opened = true;
+		clearTimeout(openTimer);
+		sendOpen();
+	});
+	ws.addEventListener("message", (event) => {
+		if (state.finished) return;
+		try {
+			if (event.data instanceof ArrayBuffer) handleFrame(new Uint8Array(event.data));
+			else handleControl(String(event.data));
+		} catch (error) {
+			const failure = error instanceof BadMessageError ? {
+				kind: "bad_message",
+				detail: error.message
+			} : {
+				kind: "local_error",
+				error
+			};
+			resolveOutcome(failure);
+		}
+	});
+	const resolveRefusal = async (reason) => {
+		if (state.refused) return;
+		state.refused = true;
+		const access = await checkImpdAccess(options.baseUrl, options.token, options.fetch);
+		if (access === "unauthorized") resolveOutcome({ kind: "unauthorized" });
+		else if (access === "reachable" && options.ticket !== void 0) resolveOutcome({
+			kind: "unauthorized",
+			ticketRefused: true
+		});
+		else if (access === "unreachable") resolveOutcome({
+			kind: "unreachable",
+			detail: reason
+		});
+		else resolveOutcome({
+			kind: "closed",
+			reason
+		});
+	};
+	ws.addEventListener("error", () => {
+		if (!state.opened && !state.finished) resolveRefusal("the connection failed");
+	});
+	ws.addEventListener("close", (event) => {
+		if (state.finished) return;
+		const reason = event.reason === "" ? `code ${String(event.code)}` : event.reason;
+		if (state.opened) {
+			resolveOutcome({
+				kind: "closed",
+				reason,
+				closeCode: event.code
+			});
+			return;
+		}
+		resolveRefusal(reason);
+	});
+	const waitForDrain = async () => {
+		while (!state.finished && countQueuedBytes() > 1048576) await new Promise((resolve) => {
+			setTimeout(resolve, DRAIN_POLL_MS);
+		});
+	};
+	return {
+		outcome: outcome.promise,
+		isStarted: () => state.started,
+		sendStdin: (data) => {
+			sendControl(encodeExecFrame(EXEC_CHANNELS.stdin, data));
+			return countQueuedBytes() <= EXEC_HIGH_WATER_BYTES;
+		},
+		waitForDrain,
+		closeStdin: () => {
+			sendControl(JSON.stringify({ type: "stdin_eof" }));
+		},
+		resize: (cols, rows) => {
+			sendControl(JSON.stringify({
+				type: "resize",
+				cols,
+				rows
+			}));
+		},
+		sendSignal: (signal) => {
+			sendControl(JSON.stringify({
+				type: "signal",
+				signal
+			}));
+		},
+		stop: () => {
+			stopSocket();
+		}
+	};
+}
+function buildOpenMessage(start) {
+	if ("argv" in start) {
+		const { require: requirements, ...rest } = start;
+		return {
+			type: "start",
+			...rest,
+			argv: [...start.argv],
+			...requirements !== void 0 && { require: [...requirements] }
+		};
+	}
+	return {
+		type: "attach",
+		...start
+	};
+}
+//#endregion
+//#region src/exec/invalid-resume-error.ts
+var InvalidResumeError = class extends ExecError {
+	constructor(message, data) {
+		super("INVALID_RESUME", message, { data });
+		this.name = "InvalidResumeError";
+	}
+};
+//#endregion
+//#region src/exec/invalid-state-error.ts
+var InvalidStateError = class extends ExecError {
+	constructor(message, data) {
+		super("INVALID_STATE", message, { data });
+		this.name = "InvalidStateError";
+	}
+};
+//#endregion
+//#region src/exec/no-session-error.ts
+var NoSessionError = class extends ExecError {
+	constructor(message, data) {
+		super("NO_SESSION", message, { data });
+		this.name = "NoSessionError";
+	}
+};
+//#endregion
+//#region src/exec/to-exec-error.ts
+function toExecError(outcome) {
+	if (outcome.kind === "failed") return toFailedError(outcome.code, outcome.message, outcome.data);
+	if (outcome.kind === "unauthorized") return new ExecError("UNAUTHORIZED", outcome.ticketRefused === true ? "impd refused the exec ticket: it expired (30 s) or was used already" : "impd rejected the token");
+	if (outcome.kind === "unreachable") return new ExecError("UNREACHABLE", `cannot reach impd (${outcome.detail})`);
+	if (outcome.kind === "detached") return new ExecError("DETACHED", `detached from the session (${outcome.reason})`, { data: {
+		reason: outcome.reason,
+		...outcome.offset !== void 0 && { offset: outcome.offset }
+	} });
+	if (outcome.kind === "closed") return outcome.closeCode === 1012 ? new ExecError("RESTARTING", "impd is restarting") : new ExecError("CONNECTION_CLOSED", `exec connection closed (${outcome.reason})`);
+	if (outcome.kind === "bad_message") return new ExecError("BAD_MESSAGE", `bad message from impd: ${outcome.detail}`);
+	return new ExecError("LOCAL_ERROR", "an output handler threw", { cause: outcome.error });
+}
+function toFailedError(code, message, data) {
+	if (code === "NO_SESSION") {
+		const parsed = NoSessionDataSchema.safeParse(data);
+		return new NoSessionError(message, parsed.success ? parsed.data : void 0);
+	}
+	if (code === "INVALID_STATE") {
+		const parsed = IMP_ERRORS.INVALID_STATE.data.safeParse(data);
+		if (parsed.success) return new InvalidStateError(message, parsed.data);
+	}
+	if (code === "INVALID_RESUME") {
+		const parsed = InvalidResumeDataSchema.safeParse(data);
+		if (parsed.success) return new InvalidResumeError(message, parsed.data);
+	}
+	return new ExecError(code ?? "EXEC_ERROR", message, { data });
+}
+//#endregion
+//#region src/exec/open-exec.ts
+const DEFAULT_MAX_UNREAD_BYTES = 8388608;
+const TTY_SIGNAL_KEYS = {
+	SIGINT: "",
+	SIGQUIT: ""
+};
+function openExec(deps, name, argv, options = {}) {
+	const tty = options.tty ?? false;
+	return openHandle(deps, options, tty, {
+		name,
+		argv,
+		tty,
+		...options.env !== void 0 && { env: options.env },
+		...options.cwd !== void 0 && { cwd: options.cwd },
+		...options.cols !== void 0 && { cols: options.cols },
+		...options.rows !== void 0 && { rows: options.rows },
+		...options.session !== void 0 && { session: options.session },
+		...options.killGraceMs !== void 0 && { killGraceMs: options.killGraceMs },
+		...options.resumeFrom !== void 0 && { resumeFrom: options.resumeFrom },
+		...options.require !== void 0 && { require: options.require },
+		...options.log === true && { log: true }
+	});
+}
+function openAttach(deps, name, session, options = {}) {
+	return openHandle(deps, options, true, {
+		name,
+		session,
+		...options.cols !== void 0 && { cols: options.cols },
+		...options.rows !== void 0 && { rows: options.rows },
+		...options.resumeFrom !== void 0 && { resumeFrom: options.resumeFrom },
+		...options.wake !== void 0 && { wake: options.wake }
+	});
+}
+async function openHandle(deps, options, tty, start) {
+	const name = start.name;
+	const abort = options.signal;
+	const callOptions = abort === void 0 ? {} : { signal: abort };
+	abort?.throwIfAborted();
+	const issued = await deps.rpc.exec.ticket({ name }, callOptions);
+	abort?.throwIfAborted();
+	const maxUnreadBytes = options.maxUnreadBytes ?? DEFAULT_MAX_UNREAD_BYTES;
+	const started = Promise.withResolvers();
+	const ended = Promise.withResolvers();
+	const state = {
+		ended: false,
+		cancelled: 0
+	};
+	const stopWith = (code, message) => {
+		session.stop();
+		resolveHandle({ error: new ExecError(code, message) });
+	};
+	const outputHooks = {
+		maxUnreadBytes,
+		onOverflow: (channel) => {
+			stopWith("OUTPUT_OVERFLOW", `${channel} holds more than ${String(maxUnreadBytes)} unread bytes; read or cancel it`);
+		},
+		onCancel: () => {
+			state.cancelled += 1;
+			if (state.cancelled === 2) stopWith("CLOSED", "both output streams were cancelled");
+		}
+	};
+	const stdout = buildOutputStream("stdout", outputHooks);
+	const stderr = buildOutputStream("stderr", outputHooks);
+	const session = openExecSession({
+		baseUrl: deps.baseUrl,
+		token: deps.token,
+		ticket: issued.ticket,
+		start,
+		onStarted: (info) => {
+			started.resolve({ value: info });
+		},
+		onOutput: (channel, data) => {
+			(channel === "stderr" ? stderr : stdout).push(data);
+		},
+		connect: deps.connect ?? ((url) => new WebSocket(url)),
+		...deps.fetch !== void 0 && { fetch: deps.fetch }
+	});
+	const resolveHandle = (result) => {
+		if (state.ended) return;
+		state.ended = true;
+		stdout.end();
+		stderr.end();
+		abort?.removeEventListener("abort", stopForAbort);
+		if ("error" in result) started.resolve({ error: result.error });
+		ended.resolve(result);
+	};
+	const stopSession = () => {
+		stopWith("CLOSED", "the exec session was closed");
+	};
+	const stopForAbort = () => {
+		if (session.isStarted()) {
+			stopSession();
+			return;
+		}
+		session.stop();
+		resolveHandle({ error: readAbortReason(abort) });
+	};
+	const waitForOutcome = async () => {
+		const outcome = await session.outcome;
+		const result = outcome.kind === "exit" ? { value: {
+			code: outcome.code,
+			signal: outcome.signal,
+			...outcome.offset !== void 0 && { offset: outcome.offset }
+		} } : { error: toExecError(outcome) };
+		resolveHandle(result);
+	};
+	if (abort?.aborted === true) stopForAbort();
+	else abort?.addEventListener("abort", stopForAbort, { once: true });
+	waitForOutcome();
+	return buildHandle(session, {
+		started: started.promise,
+		ended: ended.promise,
+		isEnded: () => state.ended,
+		tty,
+		stopSession,
+		streams: [stdout.stream, stderr.stream]
+	});
+}
+function readAbortReason(abort) {
+	const reason = abort?.reason;
+	return reason instanceof Error ? reason : new DOMException("the exec was aborted", "AbortError");
+}
+function openConsole(deps, name, options = {}) {
+	return openExec(deps, name, [
+		"/bin/sh",
+		"-c",
+		CONSOLE_SHELL
+	], {
+		...options,
+		tty: true,
+		env: options.env ?? { TERM: "xterm-256color" }
+	});
+}
+async function runCommand(deps, name, argv, options = {}) {
+	const handle = await openExec(deps, name, argv, options);
+	const output = Promise.all([readAll(handle.stdout), readAll(handle.stderr)]);
+	if (options.stdin !== void 0) await handle.write(options.stdin).catch(checkWriteFailure);
+	await handle.closeStdin();
+	const [exit, [stdout, stderr]] = await Promise.all([handle.exit, output]);
+	return {
+		...exit,
+		stdout,
+		stderr
+	};
+}
+const STDIN_FRAME_BYTES = 1024 ** 2;
+function checkWriteFailure(error) {
+	if (!(error instanceof ExecError && error.code === "CLOSED")) throw error;
+}
+function buildHandle(session, parts) {
+	const encoder = new TextEncoder();
+	const waitForStart = async () => {
+		const result = await parts.started;
+		if ("error" in result) throw result.error;
+		return result.value;
+	};
+	const waitForExit = async () => {
+		const result = await parts.ended;
+		if ("error" in result) throw result.error;
+		return result.value;
+	};
+	const startedPromise = waitForStart();
+	const exitPromise = waitForExit();
+	waitIgnoringRejection(startedPromise);
+	waitIgnoringRejection(exitPromise);
+	const end = { error: null };
+	(async () => {
+		const result = await parts.ended;
+		if ("error" in result) end.error = result.error;
+	})();
+	const requireOpen = () => {
+		if (!parts.isEnded()) return;
+		throw end.error ?? new ExecError("CLOSED", "the exec session has ended");
+	};
+	const write = async (data) => {
+		requireOpen();
+		await startedPromise;
+		requireOpen();
+		const bytes = typeof data === "string" ? encoder.encode(data) : data;
+		for (let sent = 0; sent < bytes.byteLength; sent += STDIN_FRAME_BYTES) {
+			requireOpen();
+			if (!session.sendStdin(bytes.subarray(sent, sent + STDIN_FRAME_BYTES))) await session.waitForDrain();
+		}
+	};
+	const sendKey = async (key) => {
+		try {
+			await write(key);
+		} catch {}
+	};
+	return {
+		started: startedPromise,
+		stdout: parts.streams[0],
+		stderr: parts.streams[1],
+		exit: exitPromise,
+		write,
+		closeStdin: async () => {
+			await startedPromise;
+			if (!parts.isEnded()) session.closeStdin();
+		},
+		resize: (cols, rows) => {
+			session.resize(cols, rows);
+		},
+		sendSignal: (signal) => {
+			const key = parts.tty ? TTY_SIGNAL_KEYS[signal] : void 0;
+			if (key === void 0) session.sendSignal(signal);
+			else sendKey(key);
+		},
+		close: parts.stopSession
+	};
+}
+async function waitIgnoringRejection(promise) {
+	try {
+		await promise;
+	} catch {}
+}
+function buildOutputStream(channel, hooks) {
+	const state = {
+		controller: null,
+		open: true
+	};
+	return {
+		stream: new ReadableStream({
+			start: (controller) => {
+				state.controller = controller;
+			},
+			cancel: () => {
+				state.open = false;
+				hooks.onCancel();
+			}
+		}, {
+			highWaterMark: hooks.maxUnreadBytes,
+			size: (chunk) => chunk?.byteLength ?? 0
+		}),
+		push: (data) => {
+			if (!state.open || state.controller === null) return;
+			state.controller.enqueue(data);
+			if ((state.controller.desiredSize ?? 0) < 0) hooks.onOverflow(channel);
+		},
+		end: () => {
+			if (state.open) {
+				state.open = false;
+				state.controller?.close();
+			}
+		}
+	};
+}
+async function readAll(stream) {
+	const buffer = await new Response(stream).arrayBuffer();
+	return new Uint8Array(buffer);
+}
+//#endregion
+//#region src/require-awake.ts
+async function requireAwake(rpc, name, options = {}) {
+	const signal = options.signal;
+	const callOptions = signal === void 0 ? {} : { signal };
+	const retry = options.retryUnavailable ?? {
+		attempts: 0,
+		delayMs: 0
+	};
+	const input = {
+		name,
+		restartError: options.restartError === true
+	};
+	for (let attempt = 0;; attempt++) try {
+		return await rpc.imps.wake(input, callOptions);
+	} catch (error) {
+		if (!isUnavailable(error) || attempt >= retry.attempts) throw error;
+		await waitFor(retry.delayMs, signal);
+	}
+}
+function isUnavailable(error) {
+	if (error instanceof ORPCError$1) return error.code === "SERVICE_UNAVAILABLE";
+	return error instanceof TypeError;
+}
+function waitFor(ms, signal) {
+	signal?.throwIfAborted();
+	const done = Promise.withResolvers();
+	const onAbort = () => {
+		clearTimeout(timer);
+		done.reject(signal?.reason);
+	};
+	const timer = setTimeout(() => {
+		signal?.removeEventListener("abort", onAbort);
+		done.resolve();
+	}, ms);
+	signal?.addEventListener("abort", onAbort, { once: true });
+	return done.promise;
+}
+//#endregion
+//#region src/send-long-call.ts
+const HOUR_MS = 36e5;
+const LONG_CALL_DEADLINES_MS = /* @__PURE__ */ new Map([
+	["backups.run", 24 * HOUR_MS],
+	["backups.restore", 24 * HOUR_MS],
+	["backups.check", 24 * HOUR_MS],
+	["images.add", 6 * HOUR_MS],
+	["images.build", 6 * HOUR_MS],
+	["system.gc", HOUR_MS],
+	["moves.abort", HOUR_MS],
+	["moves.resume", HOUR_MS]
+]);
+async function sendLongCall(request, init, call) {
+	const limit = new AbortController();
+	const expired = Promise.withResolvers();
+	const onCallerAbort = () => {
+		limit.abort(request.signal.reason);
+	};
+	request.signal.addEventListener("abort", onCallerAbort, { once: true });
+	if (request.signal.aborted) onCallerAbort();
+	const cancel = call.startTimer(() => {
+		const error = new DOMException(`impd sent no answer to ${call.procedure} in ${formatHours(call.deadlineMs)}`, "TimeoutError");
+		limit.abort(error);
+		expired.reject(error);
+	}, call.deadlineMs);
+	const signal = limit.signal;
+	try {
+		const limited = new Request(request, { signal });
+		const sent = call.send === null ? fetch(limited, {
+			...init,
+			signal,
+			timeout: false
+		}) : call.send(limited);
+		return await Promise.race([sent, expired.promise]);
+	} finally {
+		cancel();
+		request.signal.removeEventListener("abort", onCallerAbort);
+	}
+}
+function formatHours(ms) {
+	const hours = ms / HOUR_MS;
+	return hours === 1 ? "an hour" : `${String(hours)} hours`;
+}
+//#endregion
+//#region src/unknown-procedure-error.ts
+var UnknownProcedureError = class extends Error {
+	procedure;
+	constructor(procedure) {
+		super(`impd has no procedure ${procedure}`);
+		this.name = "UnknownProcedureError";
+		this.procedure = procedure;
+	}
+};
+//#endregion
+//#region src/create-imp-client.ts
+function createImpClient(options) {
+	const token = options.token;
+	const customFetch = options.fetch;
+	const startTimer = options.startTimer ?? startRealTimer;
+	const sendCall = (request, init) => customFetch === void 0 ? fetch(request, init) : customFetch(request);
+	const link = new RPCLink({
+		url: resolveImpdUrl(options.url, "/rpc").href,
+		headers: token === void 0 ? {} : { authorization: `Bearer ${token}` },
+		fetch: async (request, init, _options, path) => {
+			const procedure = path.join(".");
+			const deadlineMs = LONG_CALL_DEADLINES_MS.get(procedure);
+			const response = await (deadlineMs === void 0 ? sendCall(request, init) : sendLongCall(request, init, {
+				procedure,
+				deadlineMs,
+				startTimer,
+				send: customFetch ?? null
+			}));
+			if (isUnknownProcedure(response.status, response.headers.get("content-type"))) {
+				await response.body?.cancel();
+				throw new UnknownProcedureError(procedure);
+			}
+			return response;
+		}
+	});
+	const rpc = createORPCClient(link);
+	const namespaces = {
+		imps: rpc.imps,
+		leases: rpc.leases,
+		checkpoints: rpc.checkpoints,
+		backups: rpc.backups,
+		images: rpc.images,
+		exec: rpc.exec,
+		sessions: rpc.sessions,
+		services: rpc.services,
+		files: rpc.files,
+		moves: rpc.moves,
+		secrets: rpc.secrets,
+		networks: rpc.networks,
+		grants: rpc.grants,
+		audit: rpc.audit,
+		events: rpc.events,
+		system: rpc.system,
+		tokens: rpc.tokens,
+		oauth: rpc.oauth
+	};
+	const execDeps = {
+		rpc,
+		baseUrl: options.url,
+		token: token ?? null,
+		...customFetch !== void 0 && { fetch: customFetch },
+		...options.connect !== void 0 && { connect: options.connect }
+	};
+	return {
+		...namespaces,
+		openExec: (name, argv, execOptions) => openExec(execDeps, name, argv, execOptions),
+		run: (name, argv, runOptions) => runCommand(execDeps, name, argv, runOptions),
+		openConsole: (name, consoleOptions) => openConsole(execDeps, name, consoleOptions),
+		openAttach: (name, session, attachOptions) => openAttach(execDeps, name, session, attachOptions),
+		requireAwake: (name, awakeOptions) => requireAwake(rpc, name, awakeOptions),
+		checkServer: () => checkServer(rpc),
+		buildImage: (name, context, buildOptions) => buildImage(execDeps, name, context, buildOptions)
+	};
+}
+function startRealTimer(fire, ms) {
+	const timer = setTimeout(fire, ms);
+	return () => {
+		clearTimeout(timer);
+	};
+}
+function isUnknownProcedure(status, contentType) {
+	return status === 404 && !(contentType ?? "").startsWith("application/json");
+}
+//#endregion
+//#region src/reverse/open-reverse-forward.ts
+function parseMessage(text) {
+	try {
+		const parsed = TunnelServerMessageSchema.safeParse(JSON.parse(text));
+		return parsed.success ? parsed.data : null;
+	} catch {
+		return null;
+	}
+}
+function buildListenMessage(name, guest) {
+	return guest.network === "tcp" ? {
+		type: "listen",
+		name,
+		network: "tcp",
+		port: guest.port
+	} : {
+		type: "listen",
+		name,
+		network: "unix",
+		path: guest.path
+	};
+}
+function openRelay(target, accept, handlers) {
+	const ws = target.connect(target.url, target.headers);
+	const state = {
+		opened: false,
+		unacked: 0,
+		done: false,
+		peerEof: false,
+		guestEof: false
+	};
+	const waiters = [];
+	const pending = [];
+	ws.binaryType = "arraybuffer";
+	const wakeWaiters = () => {
+		for (const wake of waiters.splice(0)) wake();
+	};
+	const sendText = (message) => {
+		if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(message));
+	};
+	const sendFrames = (data) => {
+		for (let offset = 0; offset < data.byteLength; offset += TUNNEL_MAX_FRAME_BYTES) ws.send(Uint8Array.from(data.subarray(offset, offset + TUNNEL_MAX_FRAME_BYTES)));
+	};
+	const stopRelay = (lost) => {
+		if (state.done) return;
+		state.done = true;
+		wakeWaiters();
+		handlers.onClose(lost);
+	};
+	const sendAck = async (data) => {
+		await handlers.onData(data);
+		sendText({
+			type: "ack",
+			bytes: data.byteLength
+		});
+	};
+	const handleControl = (message) => {
+		if (message.type === "opened") {
+			state.opened = true;
+			for (const data of pending.splice(0)) sendFrames(data);
+			if (state.peerEof) sendText({ type: "eof" });
+		} else if (message.type === "eof") {
+			state.guestEof = true;
+			handlers.onEof();
+		} else if (message.type === "ack") {
+			state.unacked -= message.bytes;
+			if (state.unacked <= 1048576) wakeWaiters();
+		} else {
+			ws.close(TUNNEL_CLOSE_NORMAL, "relay failed");
+			stopRelay(true);
+		}
+	};
+	ws.addEventListener("open", () => {
+		sendText(accept);
+	});
+	ws.addEventListener("message", (event) => {
+		if (event.data instanceof ArrayBuffer) {
+			sendAck(new Uint8Array(event.data));
+			return;
+		}
+		const message = parseMessage(String(event.data));
+		if (message === null) {
+			ws.close(TUNNEL_CLOSE_PROTOCOL, "bad message");
+			stopRelay(true);
+		} else handleControl(message);
+	});
+	ws.addEventListener("close", (event) => {
+		stopRelay(event.code !== TUNNEL_CLOSE_NORMAL);
+	});
+	ws.addEventListener("error", () => {});
+	return {
+		send: (data) => {
+			if (state.done) return true;
+			if (state.opened) sendFrames(data);
+			else pending.push(Uint8Array.from(data));
+			state.unacked += data.byteLength;
+			return state.unacked <= TUNNEL_WINDOW_BYTES;
+		},
+		waitForRoom: async () => {
+			while (!state.done && state.unacked > 1048576) await new Promise((resolve) => {
+				waiters.push(resolve);
+			});
+		},
+		sendEof: () => {
+			state.peerEof = true;
+			if (state.opened) sendText({ type: "eof" });
+		},
+		close: () => {
+			if (ws.readyState === WebSocket.CONNECTING || ws.readyState === WebSocket.OPEN) ws.close(TUNNEL_CLOSE_NORMAL, "local side closed");
+			stopRelay(false);
+		}
+	};
+}
+function openReverseForward(options) {
+	const url = resolveImpdUrl(options.baseUrl, TUNNEL_PATH);
+	url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+	const headers = options.token === null ? {} : { authorization: `Bearer ${options.token}` };
+	const target = {
+		url: url.href,
+		headers,
+		connect: options.connect
+	};
+	const ws = options.connect(url.href, headers);
+	const listening = Promise.withResolvers();
+	const ended = Promise.withResolvers();
+	const relays = /* @__PURE__ */ new Set();
+	const state = {
+		listener: "",
+		done: false
+	};
+	const waitForListening = async () => {
+		try {
+			await listening.promise;
+		} catch {}
+	};
+	waitForListening();
+	const stopForward = (end) => {
+		if (state.done) return;
+		state.done = true;
+		for (const relay of relays) relay.close();
+		const why = end.kind === "failed" ? end.message : `the forward ${end.kind}`;
+		listening.reject(new Error(why));
+		ended.resolve(end);
+	};
+	const openClientRelay = (id) => {
+		const message = {
+			type: "accept",
+			name: options.name,
+			listener: state.listener,
+			connection: id
+		};
+		options.onConnection((handlers) => {
+			const relay = openRelay(target, message, {
+				...handlers,
+				onClose: (lost) => {
+					relays.delete(relay);
+					handlers.onClose(lost);
+				}
+			});
+			relays.add(relay);
+			return relay;
+		});
+	};
+	const handleControl = (message) => {
+		if (message.type === "listening") {
+			state.listener = message.listener;
+			listening.resolve({
+				path: message.path,
+				port: message.port
+			});
+		} else if (message.type === "connection") openClientRelay(message.id);
+		else if (message.type === "error") stopForward({
+			kind: "failed",
+			code: message.code ?? null,
+			message: message.message
+		});
+		else ws.close(TUNNEL_CLOSE_PROTOCOL, "bad message");
+	};
+	ws.binaryType = "arraybuffer";
+	ws.addEventListener("open", () => {
+		ws.send(JSON.stringify(buildListenMessage(options.name, options.guest)));
+	});
+	ws.addEventListener("message", (event) => {
+		const message = event.data instanceof ArrayBuffer ? null : parseMessage(String(event.data));
+		if (message === null) ws.close(TUNNEL_CLOSE_PROTOCOL, "bad message");
+		else handleControl(message);
+	});
+	ws.addEventListener("close", (event) => {
+		if (event.code === 4e3) stopForward({ kind: "lost" });
+		else stopForward({
+			kind: "closed",
+			code: event.code,
+			reason: event.reason
+		});
+	});
+	ws.addEventListener("error", () => {});
+	return {
+		listening: listening.promise,
+		ended: ended.promise,
+		stop: () => {
+			if (ws.readyState === WebSocket.CONNECTING || ws.readyState === WebSocket.OPEN) ws.close(TUNNEL_CLOSE_NORMAL, "stopped");
+			stopForward({ kind: "stopped" });
+		}
+	};
+}
+//#endregion
+export { CLIENT_VERSION, CONSOLE_SHELL, EXEC_REQUIREMENTS, ExecError, InvalidResumeError, InvalidStateError, NoSessionError, ORPCError, UnknownProcedureError, createImpClient, isDefinedError, openExecSession, openReverseForward, safe };