@join-pantheon/cli 0.27.0 → 0.29.0

package/dist/network.js

@@ -0,0 +1,595 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import http from "node:http";
+import https from "node:https";
+import net from "node:net";
+import tls from "node:tls";
+import { platform } from "node:os";
+import { join } from "node:path";
+const LOOPBACK = ["localhost", "127.0.0.1", "::1", "[::1]"];
+const NONE = { https: null, http: null, noProxy: LOOPBACK, source: "none", fallbackOnly: false };
+const pick = (env, ...names) => {
+    for (const n of names) {
+        const v = env[n]?.trim();
+        if (v)
+            return v;
+    }
+    return undefined;
+};
+export function normalizeProxy(raw) {
+    const v = raw.trim();
+    if (!v)
+        return null;
+    try {
+        const u = new URL(/^[a-z][a-z0-9+.-]*:\/\//i.test(v) ? v : `http://${v}`);
+        if (u.protocol !== "http:" && u.protocol !== "https:")
+            return null;
+        if (!u.hostname)
+            return null;
+        return u.toString().replace(/\/$/, "");
+    }
+    catch {
+        return null;
+    }
+}
+export function redactProxy(url) {
+    if (!url)
+        return "direct";
+    try {
+        const u = new URL(url);
+        if (u.username || u.password) {
+            u.username = u.username ? "***" : "";
+            u.password = "";
+        }
+        return u.toString().replace(/\/$/, "");
+    }
+    catch {
+        return redactText(url);
+    }
+}
+export function redactText(raw) {
+    return raw.replace(/^(\s*(?:[a-z][a-z0-9+.-]*:\/\/)?)[^@/\s]*@/i, "$1***@");
+}
+export function splitNoProxy(raw) {
+    return [...new Set([...(raw ?? "").split(/[,\s]+/).map((s) => s.trim().toLowerCase()).filter(Boolean), ...LOOPBACK])];
+}
+export function bypassesProxy(host, port, noProxy) {
+    const h = host.toLowerCase().replace(/^\[|\]$/g, "");
+    for (const raw of noProxy) {
+        if (raw === "*")
+            return true;
+        let entry = raw.replace(/^\[|\]$/g, "");
+        let entryPort;
+        const m = /^(.*):(\d+)$/.exec(entry);
+        if (m && !entry.includes("::")) {
+            entry = m[1];
+            entryPort = m[2];
+        }
+        if (entryPort && entryPort !== port)
+            continue;
+        if (entry.includes("/") && net.isIP(h)) {
+            if (inCidr(h, entry))
+                return true;
+            continue;
+        }
+        const bare = entry.replace(/^\*?\./, "");
+        if (h === bare || h.endsWith(`.${bare}`))
+            return true;
+    }
+    return false;
+}
+function inCidr(ip, cidr) {
+    const [base, bitsRaw] = cidr.split("/");
+    const bits = Number(bitsRaw);
+    if (!base || net.isIPv4(ip) !== net.isIPv4(base) || !net.isIPv4(ip) || !(bits >= 0 && bits <= 32))
+        return false;
+    const n = (s) => s.split(".").reduce((a, o) => (a << 8) + Number(o), 0) >>> 0;
+    const mask = bits === 0 ? 0 : (~0 << (32 - bits)) >>> 0;
+    return (n(ip) & mask) === (n(base) & mask);
+}
+export function parseScutil(out) {
+    const val = (k) => new RegExp(`^\\s*${k}\\s*:\\s*(.+?)\\s*$`, "m").exec(out)?.[1];
+    const on = (k) => val(k) === "1";
+    const hp = (host, port) => (host ? normalizeProxy(`${host}${port ? `:${port}` : ""}`) : null);
+    const exceptions = [];
+    const block = /ExceptionsList\s*:\s*<array>\s*\{([\s\S]*?)\}/.exec(out)?.[1] ?? "";
+    for (const line of block.split("\n")) {
+        const m = /:\s*(\S+)\s*$/.exec(line);
+        if (m)
+            exceptions.push(m[1]);
+    }
+    const pac = on("ProxyAutoConfigEnable") ? val("ProxyAutoConfigURLString") : undefined;
+    return {
+        https: on("HTTPSEnable") ? hp(val("HTTPSProxy"), val("HTTPSPort")) : null,
+        http: on("HTTPEnable") ? hp(val("HTTPProxy"), val("HTTPPort")) : null,
+        noProxy: exceptions,
+        ...(pac ? { pac } : {}),
+    };
+}
+export function parseWindowsReg(out) {
+    const val = (k) => new RegExp(`^\\s*${k}\\s+REG_\\w+\\s+(.*?)\\s*$`, "mi").exec(out)?.[1];
+    const pac = val("AutoConfigURL") || undefined;
+    const enabled = /^0x0*1$/i.test(val("ProxyEnable") ?? "");
+    const server = enabled ? val("ProxyServer") ?? "" : "";
+    let httpsP = null, httpP = null;
+    if (server.includes("=")) {
+        for (const part of server.split(";")) {
+            const [k, v] = part.split("=");
+            if (k?.trim().toLowerCase() === "https" && v)
+                httpsP = normalizeProxy(v);
+            if (k?.trim().toLowerCase() === "http" && v)
+                httpP = normalizeProxy(v);
+        }
+        httpsP ??= httpP;
+    }
+    else if (server) {
+        httpsP = httpP = normalizeProxy(server);
+    }
+    const override = (val("ProxyOverride") ?? "").split(";").map((s) => s.trim()).filter((s) => s && s !== "<local>");
+    return { https: httpsP, http: httpP, noProxy: override, ...(pac ? { pac } : {}) };
+}
+const run = (cmd, args) => {
+    try {
+        return execFileSync(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 3000 });
+    }
+    catch {
+        return null;
+    }
+};
+export const chosenByPerson = (s) => !!s && (s.proxy === "" || /^pantheon network/.test(s.source ?? ""));
+export const windowsRegExe = (env = process.env) => `${env.SystemRoot ?? env.SYSTEMROOT ?? "C:\\Windows"}\\System32\\reg.exe`;
+function savedFromConfig(env) {
+    try {
+        const home = env.PANTHEON_HOME ?? join(env.HOME ?? env.USERPROFILE ?? "", ".pantheon");
+        const f = join(home, "config.json");
+        if (!existsSync(f))
+            return null;
+        return JSON.parse(readFileSync(f, "utf8")).network ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+export const defaultNetworkDeps = () => ({
+    env: process.env,
+    os: platform(),
+    saved: () => savedFromConfig(process.env),
+    scutil: () => run("/usr/sbin/scutil", ["--proxy"]),
+    winReg: () => run(windowsRegExe(), ["query", "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"]),
+});
+export function resolveProxyPlan(d = defaultNetworkDeps()) {
+    const noProxy = splitNoProxy(pick(d.env, "no_proxy", "NO_PROXY"));
+    const forced = d.env.PANTHEON_PROXY?.trim();
+    if (forced) {
+        if (/^(none|direct|off|false|0)$/i.test(forced))
+            return { ...NONE, noProxy, directChosen: true };
+        const p = normalizeProxy(forced);
+        if (p)
+            return { https: p, http: p, noProxy, source: "PANTHEON_PROXY", fallbackOnly: false };
+    }
+    const saved = d.saved();
+    const fromSaved = (retryDirect) => {
+        const sp = saved?.proxy ? normalizeProxy(saved.proxy) : null;
+        return sp ? { https: sp, http: sp, noProxy: splitNoProxy([saved?.no_proxy, ...noProxy].filter(Boolean).join(",")), source: "config", fallbackOnly: false, ...(retryDirect ? { retryDirect: true } : {}) } : null;
+    };
+    if (chosenByPerson(saved)) {
+        if (saved.proxy === "")
+            return { ...NONE, noProxy, directChosen: true };
+        const p = fromSaved(false);
+        if (p)
+            return p;
+    }
+    const envHttps = pick(d.env, "https_proxy", "HTTPS_PROXY", "all_proxy", "ALL_PROXY");
+    const envHttp = pick(d.env, "http_proxy", "HTTP_PROXY", "all_proxy", "ALL_PROXY");
+    if (envHttps || envHttp) {
+        const hs = envHttps ? normalizeProxy(envHttps) : null;
+        const h = envHttp ? normalizeProxy(envHttp) : null;
+        if (hs || h)
+            return { https: hs, http: h, noProxy, source: "env", fallbackOnly: false };
+    }
+    const auto = fromSaved(true);
+    if (auto)
+        return auto;
+    const sys = d.os === "darwin" ? (() => { const o = d.scutil(); return o ? parseScutil(o) : null; })()
+        : d.os === "win32" ? (() => { const o = d.winReg(); return o ? parseWindowsReg(o) : null; })()
+            : null;
+    if (sys && (sys.https || sys.http)) {
+        return { https: sys.https ?? sys.http, http: sys.http ?? sys.https, noProxy: splitNoProxy([...sys.noProxy, ...noProxy].join(",")),
+            source: d.os === "darwin" ? "macos" : "windows", fallbackOnly: true, ...(sys.pac ? { pac: sys.pac } : {}) };
+    }
+    return { ...NONE, noProxy, ...(sys?.pac ? { pac: sys.pac } : {}) };
+}
+export function proxyFor(target, plan) {
+    let u;
+    try {
+        u = new URL(target);
+    }
+    catch {
+        return null;
+    }
+    const secure = u.protocol === "https:" || u.protocol === "wss:";
+    const port = u.port || (secure ? "443" : "80");
+    const p = secure ? plan.https : plan.http;
+    if (!p || bypassesProxy(u.hostname, port, plan.noProxy))
+        return null;
+    return p;
+}
+export function tunnelAgent(proxyUrl, secure) {
+    const proxy = new URL(proxyUrl);
+    const auth = proxy.username || proxy.password
+        ? `Basic ${Buffer.from(`${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password)}`).toString("base64")}`
+        : undefined;
+    const Base = secure ? https.Agent : http.Agent;
+    class Tunnel extends Base {
+        createConnection(options, callback) {
+            const cb = (err, s) => callback?.(err, s);
+            const host = String(options.hostname ?? options.host ?? "");
+            const port = Number(options.port ?? (secure ? 443 : 80));
+            const req = (proxy.protocol === "https:" ? https : http).request({
+                host: proxy.hostname, port: Number(proxy.port || (proxy.protocol === "https:" ? 443 : 80)),
+                method: "CONNECT", path: `${host.includes(":") ? `[${host}]` : host}:${port}`,
+                headers: { host: `${host}:${port}`, ...(auth ? { "proxy-authorization": auth } : {}) },
+                timeout: 10_000,
+            });
+            let done = false;
+            const fail = (e) => { if (!done) {
+                done = true;
+                cb(e);
+            } };
+            req.once("connect", (res, socket) => {
+                if (res.statusCode !== 200) {
+                    socket.destroy();
+                    const err = new Error(`the proxy ${redactProxy(proxyUrl)} answered ${res.statusCode} ${res.statusMessage ?? ""} to a tunnel request for ${host}:${port}`.trim());
+                    err.code = res.statusCode === 407 ? "PROXY_AUTH_REQUIRED" : "PROXY_REFUSED";
+                    return fail(err);
+                }
+                if (!secure) {
+                    done = true;
+                    return cb(null, socket);
+                }
+                const t = tls.connect({ ...options, socket, servername: net.isIP(host) ? undefined : host });
+                t.once("secureConnect", () => { if (!done) {
+                    done = true;
+                    cb(null, t);
+                } });
+                t.once("error", fail);
+            });
+            req.once("timeout", () => { req.destroy(Object.assign(new Error(`the proxy ${redactProxy(proxyUrl)} did not answer within 10s`), { code: "ETIMEDOUT" })); });
+            req.once("error", fail);
+            req.end();
+            return undefined;
+        }
+    }
+    return new Tunnel({ keepAlive: false });
+}
+let installed = null;
+const ALTERNATE_TTL = 10 * 60_000;
+const TRIAL_TTL = 60_000;
+const RETRY_TIMEOUT = 15_000;
+const CONNECT_TIMEOUT = 5_000;
+let clock = () => Date.now();
+const hosts = new Map();
+let lastRelayRoute = null;
+const hostKey = (target) => {
+    try {
+        const u = new URL(target);
+        const secure = u.protocol === "https:" || u.protocol === "wss:";
+        return `${u.hostname.toLowerCase()}:${u.port || (secure ? "443" : "80")}`;
+    }
+    catch {
+        return target;
+    }
+};
+const stateOf = (target) => {
+    const k = hostKey(target);
+    let s = hosts.get(k);
+    if (!s) {
+        s = { alternateUntil: 0, trialUntil: 0 };
+        hosts.set(k, s);
+    }
+    return s;
+};
+const alternateActive = (target) => clock() < (hosts.get(hostKey(target))?.alternateUntil ?? 0);
+const trialArmed = (target) => clock() < (hosts.get(hostKey(target))?.trialUntil ?? 0);
+const anyAlternate = () => [...hosts.values()].some((s) => clock() < s.alternateUntil || clock() < s.trialUntil);
+const hasAlternate = (plan) => !!(plan.https || plan.http) && (plan.fallbackOnly || !!plan.retryDirect);
+const onAlternate = (target) => alternateActive(target) || trialArmed(target);
+export function routeFor(target, plan = currentPlan()) {
+    const p = proxyFor(target, plan);
+    if (!p || !hasAlternate(plan))
+        return p;
+    return plan.fallbackOnly ? (onAlternate(target) ? p : null) : (onAlternate(target) ? null : p);
+}
+function planRoute(plan) {
+    const p = plan.https ?? plan.http;
+    if (!p || !hasAlternate(plan))
+        return p;
+    return plan.fallbackOnly ? (anyAlternate() ? p : null) : (anyAlternate() ? null : p);
+}
+export function wsOptions(address) {
+    const p = routeFor(address, currentPlan());
+    if (!p)
+        return {};
+    return { agent: tunnelAgent(p, /^wss:/.test(address)) };
+}
+export function currentPlan() {
+    if (!installed)
+        installed = { plan: resolveProxyPlan(), active: null };
+    return installed.plan;
+}
+export async function installNetwork() {
+    const plan = currentPlan();
+    if (plan.https || plan.http) {
+        if (!plan.fallbackOnly)
+            await useRouterForFetch(plan);
+        if (hasAlternate(plan))
+            wrapFetch(plan);
+    }
+    return plan;
+}
+function makeRouter(u, plan) {
+    const bound = hasAlternate(plan) ? { connect: { timeout: CONNECT_TIMEOUT } } : {};
+    const direct = new u.Agent(bound);
+    const proxies = new Map();
+    const pick = (origin) => {
+        const p = proxyFor(origin, plan);
+        if (!p)
+            return direct;
+        let a = proxies.get(p);
+        if (!a) {
+            a = new u.ProxyAgent({ uri: p, ...(hasAlternate(plan) ? { proxyTls: { timeout: CONNECT_TIMEOUT } } : {}) });
+            proxies.set(p, a);
+        }
+        return a;
+    };
+    const all = () => [direct, ...proxies.values()];
+    class Router extends u.Dispatcher {
+        dispatch(opts, handler) {
+            return pick(String(opts.origin ?? "")).dispatch(opts, handler);
+        }
+    }
+    const r = new Router();
+    Object.assign(r, {
+        close: () => Promise.all(all().map((a) => a.close())).then(() => undefined),
+        destroy: () => Promise.all(all().map((a) => a.destroy())).then(() => undefined),
+    });
+    return r;
+}
+const DISPATCHER = Symbol.for("undici.globalDispatcher.1");
+const DISPATCHER2 = Symbol.for("undici.globalDispatcher.2");
+let previousDispatcher = null;
+let originalFetch = null;
+async function useRouterForFetch(plan) {
+    if (installed?.active)
+        return;
+    const u = await import("undici");
+    const g = globalThis;
+    previousDispatcher ??= { v1: g[DISPATCHER], v2: g[DISPATCHER2] };
+    u.setGlobalDispatcher(makeRouter(u, plan));
+    if (installed)
+        installed.active = plan.https ?? plan.http;
+}
+const BLOCKED = /ENOTFOUND|EAI_AGAIN|ECONNREFUSED|ETIMEDOUT|EHOSTUNREACH|ENETUNREACH|EPROTO|wrong version number|UND_ERR_CONNECT_TIMEOUT|UND_ERR_SOCKET|handshake has timed out|socket hang up/i;
+const NOTHING_SENT = /ENOTFOUND|EAI_AGAIN|ECONNREFUSED|EHOSTUNREACH|ENETUNREACH|UND_ERR_CONNECT_TIMEOUT|EPROTO|wrong version number|packet length too long|unknown protocol|ERR_SSL_|before secure TLS connection was established/i;
+function errText(e, depth = 0) {
+    if (!e || depth > 4)
+        return "";
+    const x = e;
+    return [typeof x.code === "string" ? x.code : "", typeof x.message === "string" ? x.message : typeof e === "string" ? e : "",
+        errText(x.cause, depth + 1), ...(Array.isArray(x.errors) ? x.errors.map((y) => errText(y, depth + 1)) : [])].filter(Boolean).join(" ");
+}
+export const isBlockedPath = (e) => BLOCKED.test(errText(e));
+const isCallerTimeout = (e) => e?.name === "TimeoutError";
+export function safeToRetry(e, method) {
+    const m = method.toUpperCase();
+    return m === "GET" || m === "HEAD" ? isBlockedPath(e) || isCallerTimeout(e) : NOTHING_SENT.test(errText(e));
+}
+export const relayAnsweredFetch = (res) => /application\/json/i.test(res.headers.get("content-type") ?? "") && ![407, 502, 503, 504, 511].includes(res.status);
+function retrySignal(caller) {
+    const own = AbortSignal.timeout(RETRY_TIMEOUT);
+    if (!caller)
+        return own;
+    const ctl = new AbortController();
+    const follow = () => { if (!isCallerTimeout(caller.reason))
+        ctl.abort(caller.reason); };
+    if (caller.aborted)
+        follow();
+    else
+        caller.addEventListener("abort", follow, { once: true });
+    return AbortSignal.any([own, ctl.signal]);
+}
+function wrapFetch(plan) {
+    const g = globalThis;
+    if (originalFetch)
+        return;
+    const original = g.fetch;
+    originalFetch = original;
+    let routes = null;
+    const dispatchers = () => (routes ??= import("undici").then((u) => {
+        const proxied = makeRouter(u, plan), direct = new u.Agent({ connect: { timeout: CONNECT_TIMEOUT } });
+        return plan.fallbackOnly ? { primary: direct, alternate: proxied } : { primary: proxied, alternate: direct };
+    }));
+    const send = async (input, init, which, signal) => original(input, { ...init, ...(signal ? { signal } : {}), dispatcher: (await dispatchers())[which] });
+    g.fetch = (async (input, init) => {
+        const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+        const method = init?.method ?? (typeof input === "object" && !(input instanceof URL) ? input.method : "GET");
+        if (!proxyFor(url, plan))
+            return original(input, init);
+        if (alternateActive(url)) {
+            try {
+                const res = await send(input, init, "alternate");
+                if (relayAnsweredFetch(res))
+                    noteRelayAnswered(url);
+                return res;
+            }
+            catch (e) {
+                if (isBlockedPath(e))
+                    stateOf(url).alternateUntil = 0;
+                throw e;
+            }
+        }
+        let res;
+        try {
+            res = await send(input, init, "primary");
+        }
+        catch (e) {
+            if (!safeToRetry(e, method))
+                throw e;
+            if (init?.signal?.aborted && !isCallerTimeout(init.signal.reason))
+                throw e;
+            let alt;
+            try {
+                alt = await send(input, init, "alternate", retrySignal(init?.signal));
+            }
+            catch {
+                throw e;
+            }
+            if (!relayAnsweredFetch(alt)) {
+                void alt.body?.cancel().catch(() => { });
+                throw e;
+            }
+            stateOf(url).alternateUntil = clock() + ALTERNATE_TTL;
+            noteRelayAnswered(url);
+            return alt;
+        }
+        if (relayAnsweredFetch(res))
+            noteRelayAnswered(url);
+        return res;
+    });
+}
+export function trySystemFallback(address, e) {
+    const plan = currentPlan();
+    if (!hasAlternate(plan) || !proxyFor(address, plan) || !isBlockedPath(e) || trialArmed(address))
+        return false;
+    const s = stateOf(address);
+    if (alternateActive(address)) {
+        s.alternateUntil = 0;
+        return false;
+    }
+    s.trialUntil = clock() + TRIAL_TTL;
+    return true;
+}
+export const systemFallbackPending = (address) => trialArmed(address);
+export function noteRelayAnswered(address) {
+    if (proxyFor(address, currentPlan()))
+        lastRelayRoute = { proxy: routeFor(address) };
+    const s = hosts.get(hostKey(address));
+    if (s && clock() < s.trialUntil) {
+        s.trialUntil = 0;
+        s.alternateUntil = clock() + ALTERNATE_TTL;
+    }
+}
+export function settleSystemFallback(address, relayAnswered) {
+    if (relayAnswered)
+        return noteRelayAnswered(address);
+    const s = hosts.get(hostKey(address));
+    if (s)
+        s.trialUntil = 0;
+}
+export const usedSystemFallback = (address) => currentPlan().fallbackOnly && (address ? alternateActive(address) : [...hosts.values()].some((s) => clock() < s.alternateUntil));
+export function proxyToRemember(relay, plan, saved) {
+    if (chosenByPerson(saved))
+        return null;
+    if (plan.source !== "env" && !(plan.fallbackOnly && usedSystemFallback(relay)))
+        return null;
+    const via = routeFor(relay, plan);
+    if (!via || saved?.proxy === via)
+        return null;
+    const custom = plan.noProxy.filter((h) => !LOOPBACK.includes(h));
+    return { proxy: via, ...(custom.length ? { no_proxy: custom.join(",") } : {}), source: plan.source };
+}
+const DIRECT_ENV = {
+    HTTPS_PROXY: "", https_proxy: "", HTTP_PROXY: "", http_proxy: "", ALL_PROXY: "", all_proxy: "", NO_PROXY: "*", no_proxy: "*",
+};
+export function proxyEnvFor(plan = currentPlan()) {
+    if (plan.directChosen)
+        return { ...DIRECT_ENV };
+    if (!(plan.https || plan.http) || plan.source === "env")
+        return {};
+    const viaProxy = hasAlternate(plan) ? (lastRelayRoute ? lastRelayRoute.proxy !== null : !plan.fallbackOnly) : true;
+    if (!viaProxy)
+        return {};
+    return {
+        ...(plan.https ? { HTTPS_PROXY: plan.https, https_proxy: plan.https } : {}),
+        ...(plan.http ? { HTTP_PROXY: plan.http, http_proxy: plan.http } : {}),
+        NO_PROXY: plan.noProxy.join(","), no_proxy: plan.noProxy.join(","),
+    };
+}
+export function resetNetworkForTests(plan, opts = {}) {
+    installed = plan ? { plan, active: null } : null;
+    hosts.clear();
+    lastRelayRoute = null;
+    clock = opts.now ?? (() => Date.now());
+    if (originalFetch) {
+        globalThis.fetch = originalFetch;
+        originalFetch = null;
+    }
+    if (previousDispatcher) {
+        const g = globalThis;
+        if (previousDispatcher.v1 !== undefined)
+            g[DISPATCHER] = previousDispatcher.v1;
+        if (previousDispatcher.v2 !== undefined)
+            g[DISPATCHER2] = previousDispatcher.v2;
+        previousDispatcher = null;
+    }
+}
+export function explainNetError(e, target, planArg) {
+    const plan = (typeof target === "object" ? target : planArg) ?? currentPlan();
+    const url = typeof target === "string" ? target : undefined;
+    const text = errText(e);
+    const proxy = url ? routeFor(url, plan) : planRoute(plan);
+    const shown = proxy ? redactProxy(proxy) : "";
+    const host = (() => { try {
+        return url ? new URL(url).hostname || null : null;
+    }
+    catch {
+        return null;
+    } })() ?? "the relay's address";
+    const orProxy = "Behind a company proxy? pantheon network --proxy http://host:port";
+    if (/PROXY_AUTH_REQUIRED|\b407\b/.test(text)) {
+        return { why: `the proxy ${shown} asked for a login`, fix: "put it in the proxy address: http://user:password@host:port", share: "proxy requires authentication" };
+    }
+    if (/PROXY_REFUSED/.test(text)) {
+        return { why: `the proxy ${shown} would not open a connection to the relay`, fix: `ask whoever runs it to allow HTTPS to ${host}`, share: "proxy refused the tunnel" };
+    }
+    if (/wrong version number|EPROTO|packet length too long|unknown protocol/i.test(text)) {
+        return proxy
+            ? { why: `the proxy ${shown} answered in plain text where a secure connection was expected`, fix: "check its address: company proxies are usually http://host:port, even for secure traffic", share: "TLS answered in plain text (via proxy)" }
+            : { why: "this network answered the relay's secure connection in plain text, which is what a network that requires a proxy does", fix: "set the proxy and run it again: export HTTPS_PROXY=http://host:port (or save it: pantheon network --proxy http://host:port)", share: "TLS answered in plain text (direct) — likely a required proxy" };
+    }
+    if (/SELF_SIGNED_CERT_IN_CHAIN|UNABLE_TO_GET_ISSUER_CERT_LOCALLY|UNABLE_TO_VERIFY_LEAF_SIGNATURE|self[- ]signed certificate|unable to get local issuer/i.test(text)) {
+        return { why: "the relay's certificate was swapped for one this machine does not trust, which happens on networks that inspect secure traffic", fix: "point Node at your company's root certificate: export NODE_EXTRA_CA_CERTS=/path/to/root.pem (or on Node 22.15+: NODE_USE_SYSTEM_CA=1)", share: "certificate not trusted — TLS inspection" };
+    }
+    if (/CERT_HAS_EXPIRED|certificate has expired|ERR_TLS_CERT_ALTNAME_INVALID|Hostname\/IP does not match/i.test(text)) {
+        return { why: "the relay's certificate looks expired or belongs to another name", fix: "check this machine's date and time, then try another network", share: "certificate expired or for another name" };
+    }
+    if (/ENOTFOUND|EAI_AGAIN|getaddrinfo/i.test(text)) {
+        return proxy
+            ? { why: `the proxy ${shown} could not find the relay's address`, fix: "check the relay address with pantheon doctor", share: "name did not resolve" }
+            : { why: "the relay's address did not resolve — this machine may be offline", fix: `check the connection and try again. ${orProxy}`, share: "name did not resolve" };
+    }
+    if (/ECONNREFUSED/i.test(text)) {
+        return proxy
+            ? { why: `nothing is accepting connections at the proxy ${shown}`, fix: "check the proxy address and port, or clear it: pantheon network --clear", share: "proxy refused the connection" }
+            : { why: "nothing is accepting connections at the relay's address — it may be down or restarting", fix: "try again in a minute; pantheon doctor shows more", share: "connection refused" };
+    }
+    if (/ETIMEDOUT|UND_ERR_CONNECT_TIMEOUT|handshake has timed out|timed out|EHOSTUNREACH|ENETUNREACH/i.test(text)) {
+        return proxy
+            ? { why: `the proxy ${shown} did not answer in time`, fix: "check it is reachable from this machine, or clear it: pantheon network --clear", share: "connection timed out" }
+            : { why: "the relay did not answer in time", fix: `check this machine is online and try again. ${orProxy}`, share: "connection timed out" };
+    }
+    if (/ECONNRESET|socket hang up/i.test(text)) {
+        return proxy
+            ? { why: `the connection through the proxy ${shown} was cut`, fix: `the proxy may not allow WebSockets; ask for ${host} to be allowed`, share: "connection reset" }
+            : { why: "the connection dropped before the relay answered", fix: "try again", share: "connection reset" };
+    }
+    return null;
+}
+export function describeNetError(e, target, plan) {
+    const raw = e?.message ?? String(e);
+    const x = explainNetError(e, target, plan);
+    const first = (raw.split("\n")[0] ?? "").slice(0, 120);
+    const fix = x ? x.fix.charAt(0).toUpperCase() + x.fix.slice(1) : "";
+    return x ? `${x.why}. ${fix}.  (${first})`.replace(/\.\.  \(/, ".  (").replace(/\?\.  \(/, "?  (") : raw;
+}
+//# sourceMappingURL=network.js.map

package/dist/pending.js

@@ -44,24 +44,30 @@ export function cursorSeq(session, cfg, home) {
     const entry = readCursors(cursorPath(home))[keyFor(c, session)];
     return entry?.seq;
 }
+let clockSkewMs = 0;
 export async function reportActivity(opts) {
     const cfg = opts.cfg ?? load();
     if (!cfg)
         return false;
     const base = cfg.relay.replace(/^ws/, "http").replace(/\/+$/, "");
     const seen = opts.seen !== undefined ? String(opts.seen) : "";
-    const ts = Date.now();
-    const sig = signActivity(cfg.privateKey, cfg.space, cfg.member, opts.session, opts.state, seen, ts);
-    const q = new URLSearchParams({
+    const query = (ts) => new URLSearchParams({
         space: cfg.space, token: cfg.token, member: cfg.member,
         session: opts.session, state: opts.state,
         ...(opts.seen !== undefined ? { seen } : {}),
-        ts: String(ts), sig,
+        ts: String(ts), sig: signActivity(cfg.privateKey, cfg.space, cfg.member, opts.session, opts.state, seen, ts),
     });
     const ac = new AbortController();
     const timer = setTimeout(() => ac.abort(), LIMITS.pendingTimeoutMs);
     try {
-        const res = await fetch(`${base}/activity?${q}`, { method: "POST", signal: ac.signal });
+        let res = await fetch(`${base}/activity?${query(Date.now() + clockSkewMs)}`, { method: "POST", signal: ac.signal });
+        if (res.status === 403) {
+            const there = Date.parse(res.headers.get("date") ?? "");
+            if (Number.isFinite(there) && Math.abs(there - Date.now() - clockSkewMs) > 60_000) {
+                clockSkewMs = there - Date.now();
+                res = await fetch(`${base}/activity?${query(Date.now() + clockSkewMs)}`, { method: "POST", signal: ac.signal });
+            }
+        }
         return res.ok;
     }
     catch {
@@ -108,7 +114,8 @@ export async function pending(opts) {
         .filter((r) => r.act !== "JOIN" && r.act !== "LEAVE")
         .filter((r) => !r.to || r.to.length === 0 || r.to.includes(cfg.member))
         .filter((r) => !mine.some((m) => m.seq > r.seq && (m.ref === r.id || (!!r.goal && m.goal === r.goal))));
-    const seq = first
+    const rolledBack = !first && typeof head === "number" && head < known.seq;
+    const seq = first || rolledBack
         ? head
         : historyBody === null
             ? known.seq
@@ -118,7 +125,7 @@ export async function pending(opts) {
     if (!opts.peek && seq !== undefined) {
         const now = Date.now();
         const next = {};
-        for (const [k, v] of Object.entries(cursors)) {
+        for (const [k, v] of Object.entries(readCursors(file))) {
             if (now - v.at < LIMITS.cursorTtlMs)
                 next[k] = v;
         }