@makaio/framework 1.0.0-dev-1779051654000 → 1.0.0-dev-1781023871421

package/dist/node/transports/index.d.mts

@@ -1,4 +1,4 @@
-import { PayloadFilter, TransportReceiveContext } from "@makaio/framework/core";
+import { PayloadFilter, TransportPeerContext, TransportReceiveContext } from "@makaio/framework/core";
 import { BusBroadcastMessage, BusEventMessage, BusMessage, BusReceiveHandler, BusRequestMessage, BusTransport, BusTransportError } from "@makaio/framework/bus";
 
 //#region transports/ws/src/auth/interface.d.ts
@@ -46,6 +46,16 @@ interface TransportAuth {
    * @returns Trusted local receive context, or undefined
    */
   getReceiveContext?(socket?: WebSocketLike): TransportReceiveContext | undefined;
+  /**
+   * Return whether a previously authenticated socket may still send bus frames.
+   *
+   * Auth strategies with expiring or revocable credentials should re-check the
+   * backing authorization state here because a successful WebSocket handshake
+   * can outlive the credential used for that handshake.
+   * @param socket - Server-side socket whose live authorization should be checked.
+   * @returns `true` when the socket remains authorized, `false` when it must be closed.
+   */
+  isSocketAuthenticated?(socket: WebSocketLike): boolean;
   /**
    * Clean up authentication resources for a specific socket.
    *
@@ -80,6 +90,11 @@ interface HmacAuthOptions {
    *
    * IMPORTANT: This should be a strong, randomly-generated secret.
    * Both client and server must use the same secret.
+   *
+   * On the server side this field is used for global-secret clients. When
+   * `resolveSecret` is also provided, identity-bound clients use their
+   * resolved identity secret and clients without an `identityId` continue to
+   * use this global secret.
    */
   secret: string;
   /**
@@ -94,6 +109,39 @@ interface HmacAuthOptions {
    * @defaultValue 5000
    */
   challengeTimeout?: number;
+  /**
+   * Client-side identity claim sent alongside the HMAC signature.
+   *
+   * When set the client includes this value as `identityId` in the
+   * `auth-response` frame. The server stores it in
+   * `serverAuthenticatedPeers` and exposes it via `getReceiveContext()`.
+   *
+   * Leave undefined for global-secret mode (backward-compatible default).
+   */
+  identityId?: string;
+  /**
+   * Server-side per-identity secret resolver for identity-bound mode.
+   *
+   * When provided and the client supplies `identityId`, the server calls
+   * `resolveSecret(identityId)` and uses the returned secret to verify the
+   * HMAC signature. Clients that omit `identityId` continue to authenticate
+   * against the global `secret`.
+   *
+   * Return `null` to reject the connection (unknown identity).
+   * @param claimedId - The `identityId` value from the `auth-response` frame.
+   * @returns The HMAC secret for this identity, or `null` to reject.
+   */
+  resolveSecret?: (claimedId: string) => string | null;
+  /**
+   * Server-side peer context resolver for identity-bound mode.
+   *
+   * When provided, the authenticated identity is exposed to bus handlers as
+   * this peer context instead of the backward-compatible `workflow-execution`
+   * default. Return `null` when no peer context should be exposed.
+   * @param claimedId - The authenticated `identityId`.
+   * @returns Trusted peer context for the authenticated identity, or `null`.
+   */
+  resolvePeer?: (claimedId: string) => TransportPeerContext | null;
 }
 /**
  * HMAC challenge/response authentication implementation.
@@ -115,21 +163,38 @@ declare class HmacAuth implements TransportAuth {
   private readonly secret;
   private readonly algorithm;
   private readonly challengeTimeout;
+  private readonly identityId;
+  private readonly resolveSecret;
+  private readonly resolvePeer;
   private pendingChallenge?;
   private pendingResult?;
   private queuedChallengeNonce;
   private queuedResult;
   private clientAuthComplete;
   private serverPendingResponses;
+  private serverAuthenticatedSockets;
+  /**
+   * Maps each successfully authenticated socket to the identity ID it claimed.
+   * Populated in identity-bound mode; empty in global-secret mode.
+   * Cleaned up in `cleanupSocket()` when the socket disconnects.
+   */
+  private serverAuthenticatedPeers;
   constructor(options: HmacAuthOptions);
   /**
    * Server-side authentication flow.
    *
+   * Global-secret mode (default):
    * 1. Generate random nonce
    * 2. Send auth-challenge to client
    * 3. Wait for auth-response with signature (via handleAuthMessage)
    * 4. Verify signature matches HMAC(secret, nonce)
    * 5. Send auth-result
+   *
+   * Identity-bound mode (`resolveSecret` provided):
+   * Same flow, but the `auth-response` also carries `identityId`. The server
+   * resolves the per-identity secret via `resolveSecret(identityId)` and
+   * verifies HMAC against that secret. On success the socket is registered in
+   * `serverAuthenticatedPeers` so `getReceiveContext()` can expose the peer.
    * @param socket - The client WebSocket connection to authenticate
    * @param send - Function to send auth messages to the client
    * @throws Error if authentication fails
@@ -170,10 +235,10 @@ declare class HmacAuth implements TransportAuth {
    *
    * Message will be delivered via handleAuthMessage().
    * @param socket - The client socket to track
-   * @returns The signature from the response
+   * @returns The signature and optional identity ID from the response
    * @throws Error if timeout
    */
-  private waitForAuthResponse;
+  private waitForAuthResponseWithIdentity;
   /**
    * Wait for auth-result message from server.
    *
@@ -183,11 +248,56 @@ declare class HmacAuth implements TransportAuth {
    */
   private waitForAuthResult;
   /**
-   * Compute HMAC signature for a nonce using Web Crypto API.
+   * Compute HMAC signature for a nonce using the instance secret.
    * @param nonce - The nonce to sign
    * @returns Promise resolving to hex-encoded HMAC signature
    */
   private computeHmac;
+  /**
+   * Compute HMAC signature for a nonce using an explicit secret.
+   * @param nonce - The nonce to sign
+   * @param secret - Secret to use for key derivation
+   * @returns Promise resolving to hex-encoded HMAC signature
+   */
+  private computeHmacWithSecret;
+  /**
+   * Return trusted receive context for a socket that has authenticated
+   * in identity-bound mode.
+   *
+   * For global-secret clients this returns `undefined` — there is no
+   * per-identity peer to expose.
+   *
+   * The `transportName` is intentionally left as `''` here; the transport
+   * registry merges in the registered name when it synthesises the effective
+   * receive context (§1.3 of the bus-origin design).
+   * @param socket - The socket whose peer identity to retrieve.
+   * @returns Trusted receive context with peer identity, or `undefined`.
+   */
+  getReceiveContext(socket?: WebSocketLike): TransportReceiveContext | undefined;
+  /**
+   * Check whether a server-side socket remains authorized for bus traffic.
+   *
+   * Identity-bound HMAC sockets are revalidated against `resolveSecret()` on
+   * every inbound frame so process-local registry revocation, such as dashboard
+   * session expiry, takes effect without waiting for the WebSocket to close.
+   * Global-secret sockets have no identity to revoke and remain authorized by
+   * their completed handshake.
+   * @param socket - The socket whose live authorization should be checked.
+   * @returns `true` when the socket is still authorized.
+   */
+  isSocketAuthenticated(socket: WebSocketLike): boolean;
+  /**
+   * Compare two hex-encoded HMAC signatures in constant time.
+   *
+   * A variable-time `===` comparison leaks information about how many prefix
+   * characters match, enabling timing-based secret recovery. This method decodes
+   * both signatures to byte arrays and uses a constant-time XOR accumulator so
+   * every comparison takes the same wall-clock time regardless of the match point.
+   * @param a - First hex signature
+   * @param b - Second hex signature
+   * @returns True when both signatures are identical
+   */
+  private constantTimeEqual;
   /**
    * Send auth result messages without masking the original auth error.
    *
@@ -213,6 +323,48 @@ declare class HmacAuth implements TransportAuth {
   cleanup(): void;
 }
 //#endregion
+//#region transports/ws/src/auth/identity-secret-registry.d.ts
+/** Options for registering an HMAC identity secret. */
+interface HmacIdentitySecretRegistrationOptions {
+  /**
+   * Trusted peer kind exposed after this identity authenticates.
+   *
+   * Defaults to `workflow-execution` because the original identity-bound HMAC
+   * clients are workflow runners.
+   */
+  readonly peerKind?: string;
+}
+/**
+ * Register an HMAC secret for a transport identity.
+ *
+ * The returned cleanup removes the entry only when it still points at the
+ * exact registration object, so replacing identity metadata cannot be
+ * accidentally undone by an older cleanup handle.
+ * @param identityId - Transport identity that may authenticate with the secret.
+ * @param secret - HMAC secret expected for the identity.
+ * @param options - Optional trusted peer metadata for this identity.
+ * @returns Cleanup function that unregisters this exact secret.
+ */
+declare function registerHmacIdentitySecret(identityId: string, secret: string, options?: HmacIdentitySecretRegistrationOptions): () => void;
+/**
+ * Resolve an HMAC secret for an identity claim.
+ * @param identityId - Claimed transport identity.
+ * @returns Registered secret, or null when the identity is unknown.
+ */
+declare function resolveHmacIdentitySecret(identityId: string): string | null;
+/**
+ * Resolve trusted peer context for an identity claim.
+ * @param identityId - Claimed transport identity.
+ * @returns Registered peer context, or null when the identity is unknown.
+ */
+declare function resolveHmacIdentityPeer(identityId: string): TransportPeerContext | null;
+/**
+ * Clear all registered identity secrets.
+ *
+ * Intended for tests that exercise the process-global registry.
+ */
+declare function clearHmacIdentitySecretsForTesting(): void;
+//#endregion
 //#region transports/ws/src/auth/e2e-auth.d.ts
 /**
  * E2E authentication configuration.
@@ -282,6 +434,16 @@ declare class E2EAuth implements TransportAuth {
    * @returns Peer ID if authenticated, null otherwise
    */
   getPeerId(socket?: WebSocketLike): string | null;
+  /**
+   * Return trusted receive context for a socket that has completed E2E authentication.
+   *
+   * The `transportName` is intentionally left as `''` here; the transport
+   * registry merges in the registered name when it synthesises the effective
+   * receive context.
+   * @param socket - Optional socket (server-side only)
+   * @returns Trusted receive context with peer identity, or `undefined`.
+   */
+  getReceiveContext(socket?: WebSocketLike): TransportReceiveContext | undefined;
   /**
    * Clean up authentication resources for a specific socket.
    * @param socket - The socket to clean up
@@ -396,6 +558,14 @@ declare class E2ERelayAuth implements TransportAuth {
    * @returns Peer identity ID or null
    */
   getPeerId(): string | null;
+  /**
+   * Return trusted receive context after a successful relay handshake.
+   *
+   * Relay auth is always client-mode (no socket parameter). The `transportName`
+   * is intentionally left as `''`; the transport registry fills it in.
+   * @returns Trusted receive context with peer identity, or `undefined`.
+   */
+  getReceiveContext(): TransportReceiveContext | undefined;
   private waitForPeerExchange;
   private ensureLocalExchangeMessage;
   private sendLocalExchange;
@@ -893,6 +1063,8 @@ declare class WebSocketClientTransport implements BusTransport {
   private readonly correlations;
   private readonly handlers;
   private readonly localSubscriptions;
+  private readonly pendingSubscriptionAcks;
+  private subscriptionAckSeq;
   private messageListener;
   private closeListener;
   /** AbortController for the active reconnect loop; `null` when not connected. */
@@ -943,10 +1115,10 @@ declare class WebSocketClientTransport implements BusTransport {
   }> : boolean>;
   /**
    * Register a handler for all inbound messages.
-   * @param handler - Invoked for each decoded inbound message
+   * @param handler - Invoked for each decoded inbound message with optional receive context
    * @returns Unsubscribe function
    */
-  onReceive(handler: (message: BusMessage) => Promise<void>): () => void;
+  onReceive(handler: BusReceiveHandler): () => void;
   /**
    * Subscribe to a subject on the server with an optional payload filter.
    *
@@ -999,6 +1171,27 @@ declare class WebSocketClientTransport implements BusTransport {
    * @returns Subscription dependency context bound to this transport instance
    */
   private subscriptionDeps;
+  /**
+   * Track one dynamic subscription update until the remote peer acknowledges it.
+   * @returns Ack identifier, pending promise, and cleanup reject callback.
+   */
+  private beginSubscriptionAck;
+  /**
+   * Resolve a pending dynamic subscription acknowledgement.
+   * @param ackId - Ack identifier received from the peer.
+   */
+  private resolveSubscriptionAck;
+  /**
+   * Reject one pending dynamic subscription acknowledgement.
+   * @param ackId - Ack identifier to reject.
+   * @param error - Rejection reason.
+   */
+  private rejectSubscriptionAck;
+  /**
+   * Reject all pending subscription acknowledgements for a closing socket session.
+   * @param error - Rejection reason.
+   */
+  private rejectPendingSubscriptionAcks;
   /**
    * Build the `ConnectionDeps` context for connection lifecycle helpers.
    * @returns Connection dependency context bound to this transport instance
@@ -1749,4 +1942,4 @@ declare module '@makaio/framework/bus' {
   }
 }
 //#endregion
-export { type ClientTransportCodec, DispatchingAuth, E2EAuth, E2ERelayAuth, type E2ERelayAuthOptions, HmacAuth, type RelayControlBusMessage, type RelayControlEnvelopeMessage, type RelayControlHelpers, type RelayControlRegistry, ServerTransport, type TransportAuth, WebSocketClientTransport, type WebSocketClientTransportOptions, type WebSocketClientTransportReconnectOptions, type WebSocketCloseEvent, type WebSocketLike, type WebSocketServerLike, createE2EClientTransport, createE2ERelayClientTransport, createE2ERelayCodec, createRelayControlHelpers, createRelayControlRegistry, createWebSocketCloseEvent, createWebSocketTransport, index_d_exports as crypto, extractSocketErrorMessage };
+export { type ClientTransportCodec, DispatchingAuth, E2EAuth, E2ERelayAuth, type E2ERelayAuthOptions, HmacAuth, type HmacIdentitySecretRegistrationOptions, type RelayControlBusMessage, type RelayControlEnvelopeMessage, type RelayControlHelpers, type RelayControlRegistry, ServerTransport, type TransportAuth, WebSocketClientTransport, type WebSocketClientTransportOptions, type WebSocketClientTransportReconnectOptions, type WebSocketCloseEvent, type WebSocketLike, type WebSocketServerLike, clearHmacIdentitySecretsForTesting, createE2EClientTransport, createE2ERelayClientTransport, createE2ERelayCodec, createRelayControlHelpers, createRelayControlRegistry, createWebSocketCloseEvent, createWebSocketTransport, index_d_exports as crypto, extractSocketErrorMessage, registerHmacIdentitySecret, resolveHmacIdentityPeer, resolveHmacIdentitySecret };

package/dist/node/transports/index.mjs

@@ -1,2 +1,2 @@
-import{n as e}from"../../chunk-Dc06z0qk.mjs";import{CorrelationTracker as t,DEFAULT_REQUEST_TIMEOUT_MS as n,NoHandlerError as r,TimeoutError as i,buildSubscribeMessage as a,buildUnsubscribeMessage as o,deserializeTransportError as s,getSubjectFromBusMessage as c,handleCorrelationResponse as l,isNoHandlerErrorForSubject as u,shouldReceiveMessage as d,trackMessageCorrelation as f}from"@makaio/framework/bus";import{isRecord as p}from"@makaio/framework/utils";const m={baseMs:1e3,maxMs:1e4};function ee(e,t,n){let r=Math.max(t,100),i=Math.max(n,r);return Math.min(r*2**e,i)}function te(e,t){return new Promise(n=>{if(t.aborted){n();return}let r=()=>{clearTimeout(i),t.removeEventListener(`abort`,r),n()},i=setTimeout(()=>{t.removeEventListener(`abort`,r),n()},e);t.addEventListener(`abort`,r)})}const ne={encode:async e=>JSON.stringify(e),decode:async e=>e};function re(e){return e===!1?!1:{baseMs:e?.baseMs??m.baseMs,maxMs:e?.maxMs??m.maxMs}}function h(e,t=`unknown error`){return`message`in e?String(e.message):t}async function g(e,t,n){let r=await t.encode(e);n.send(r)}function ie(e){return e.readyState===1?Promise.resolve():e.readyState>=2?Promise.reject(Error(`WebSocket closed before opening`)):new Promise((t,n)=>{let r=()=>{e.removeEventListener(`open`,i),e.removeEventListener(`error`,a),e.removeEventListener(`close`,o)},i=()=>{r(),t()},a=e=>{r(),n(Error(`WebSocket connection failed — ${h(e)}`))},o=()=>{r(),n(Error(`WebSocket closed before opening`))};e.addEventListener(`open`,i),e.addEventListener(`error`,a),e.addEventListener(`close`,o)})}async function ae(e,t){let{name:n,debug:r,auth:i,codec:a,messageTransform:o,correlations:s,handlers:c}=t;try{let u=JSON.parse(e.toString());if(typeof u!=`object`||!u||typeof u.type!=`string`){r&&console.error(`[WebSocketClientTransport:${n}] Invalid message structure:`,u);return}let d=u;if(i?.handleAuthMessage(d)||d.type===`heartbeat`)return;let f=await a.decode(d);if(o&&(f=await o(f)),f.type===`heartbeat`)return;if(f.type===`subscribe-sync-complete`){t.onSyncComplete();return}if(l(f,s))return;await Promise.all(Array.from(c).map(async e=>{try{await e(f)}catch(e){r&&console.error(`[WebSocketClientTransport:${n}] Handler error:`,e)}}))}catch(e){r&&console.error(`[WebSocketClientTransport:${n}] Failed to parse message:`,e)}}function oe(e,t){let n=e=>{ae(e.data,{name:t.name,debug:t.debug,auth:t.auth,codec:t.codec,messageTransform:t.messageTransform,correlations:t.correlations,handlers:t.handlers,onSyncComplete:()=>{t.resolveReady()}})};t.setMessageListener(n),e.addEventListener(`message`,n)}function _(e,t){let n=t.getMessageListener();n!==null&&(e.removeEventListener(`message`,n),t.setMessageListener(null));let r=t.getCloseListener();r!==null&&(e.removeEventListener(`close`,r),t.setCloseListener(null))}async function v(e){e.resolveReady(),e.resetReadyPromise();let t=e.getSocket();t!==null&&_(t,e);let n=await e.wsFactory(e.url);e.setSocket(n),e.setAuthComplete(!1);try{oe(n,e),await ie(n),e.auth&&await e.auth.authenticateClient(e=>{if(n.readyState!==1)throw Error(`WebSocketClientTransport: cannot send auth message — socket not open`);n.send(JSON.stringify(e))}),e.setAuthComplete(!0),e.debug&&console.info(`[WebSocketClientTransport:${e.name}] Connected to ${e.url}`),e.localSubscriptions.size>0&&(await g(a(e.localSubscriptions),e.codec,n),e.debug&&console.info(`[WebSocketClientTransport:${e.name}] Replayed ${e.localSubscriptions.size} subscription(s)`)),e.notifyConnected()}catch(t){let r=e.getSocket()===n;throw r&&e.auth?.cleanup(),_(n,e),r&&e.setSocket(null),e.setAuthComplete(!1),r&&(n.readyState===0||n.readyState===1)&&n.close(),t}}function y(e,t){return new Promise(n=>{if(e.readyState===3||t.aborted){n();return}let r=()=>{t.removeEventListener(`abort`,i),n()},i=()=>{e.removeEventListener(`close`,r),n()};e.addEventListener(`close`,r),t.addEventListener(`abort`,i)})}async function se(e,t,n,r,i){i(!0);try{for(;!e.aborted;){let i=n.getSocket(),a=i!==null;if(i!==null&&i.readyState!==3&&await y(i,e),e.aborted)break;a&&(n.debug&&console.info(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Connection lost, starting reconnect loop (maxMs=${t.maxMs})`),n.notifyDisconnected());let o=0;for(;!e.aborted;){let i=ee(o,t.baseMs,t.maxMs);n.debug&&console.info(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Reconnecting in ${i}ms (attempt ${o+1})`);let a=new AbortController;if(r(a),await te(i,AbortSignal.any([e,a.signal])),r(null),e.aborted)break;try{await v(n),o=0;let t=n.getSocket();if(t!==null){let r=()=>{n.auth?.cleanup(),n.setAuthComplete(!1),n.debug&&console.info(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Connection closed`)};n.setCloseListener(r),t.addEventListener(`close`,r),await y(t,e)}break}catch(e){if(n.debug){let t=e instanceof Error?e.message:String(e);console.warn(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Connect attempt ${o+1} failed: ${t}`)}o++}}}}finally{i(!1)}}function ce(e,t,n){let r=()=>{t.auth?.cleanup(),_(e,t),t.setAuthComplete(!1),t.setSocket(null),n(),t.resolveReady(),t.notifyDisconnected()};t.setCloseListener(r),e.addEventListener(`close`,r)}async function le(e,t,n,r){let i=r.localSubscriptions.get(e)?.filter,o=t??i;r.localSubscriptions.set(e,{filter:o,priorities:n}),r.socket!==null&&r.socket.readyState===1&&await g(a(new Map([[e,{filter:o,priorities:n}]])),r.codec,r.socket),r.debug&&console.info(`[WebSocketClientTransport:${r.name}] Subscribed to ${e}${o?` with filter`:``}`)}async function ue(e,t){let n=t.localSubscriptions.get(e);t.localSubscriptions.delete(e),t.socket!==null&&t.socket.readyState===1&&await g(o({[e]:n?.priorities??[]}),t.codec,t.socket),t.debug&&console.info(`[WebSocketClientTransport:${t.name}] Unsubscribed from ${e}`)}var b=class{name;url;auth;codec;messageTransform;autoReconnectConfig;wsFactory;debug;onConnectedCallback;onDisconnectedCallback;socket=null;authComplete=!1;correlations=new t;handlers=new Set;localSubscriptions=new Map;messageListener=null;closeListener=null;reconnectAbort=null;backoffWakeAbort=null;reconnectLoopRunning=!1;readyResolve=null;ready;onNewReadySession=void 0;onConnected=void 0;onDisconnected=void 0;constructor(e){this.url=e.url,this.name=e.name??`ws-client`,this.auth=e.auth,this.codec=e.codec??ne,this.messageTransform=e.messageTransform,this.debug=e.debug??!1,this.autoReconnectConfig=re(e.autoReconnect),this.wsFactory=e.createWebSocket??this.defaultWsFactory,this.onConnectedCallback=e.onConnected,this.onDisconnectedCallback=e.onDisconnected,this.ready=new Promise(e=>{this.readyResolve=e})}async connect(){if(this.reconnectAbort!==null)throw Error(`WebSocketClientTransport: already connected`);let e=new AbortController;this.reconnectAbort=e;try{await v(this.connectionDeps())}catch(e){throw this.reconnectAbort=null,e}this.autoReconnectConfig===!1?this.socket!==null&&this.wireNoReconnectClose(this.socket):this.startReconnectLoop(e.signal)}async disconnect(){let e=this.reconnectAbort;if(this.reconnectAbort=null,e?.abort(),this.readyResolve?.(),this.readyResolve=null,this.socket!==null){_(this.socket,this.connectionDeps());let e=this.socket;this.socket=null,this.authComplete=!1,(e.readyState===0||e.readyState===1)&&e.close()}this.correlations.cleanup(),this.auth?.cleanup(),this.handlers.clear(),this.debug&&console.info(`[WebSocketClientTransport:${this.name}] Disconnected`)}async send(e,t){if(this.socket===null||this.socket.readyState!==1)throw Error(`WebSocketClientTransport: not connected`);let r=await this.codec.encode(e);return this.socket.send(r),f(e,this.correlations,t??n)}onReceive(e){return this.handlers.add(e),()=>{this.handlers.delete(e)}}async subscribe(e,t,n=[]){await le(e,t,n,this.subscriptionDeps())}async unsubscribe(e){await ue(e,this.subscriptionDeps())}getSubscriptions(){return new Set(this.localSubscriptions.keys())}cancelRequest(e,t){this.correlations.cancel(e,t)}isReady(){return this.socket!==null&&this.socket.readyState===1&&this.authComplete}async reconnect(){if(!this.isReady()){if(this.backoffWakeAbort!==null){this.backoffWakeAbort.abort(),this.backoffWakeAbort=null;return}if(this.autoReconnectConfig!==!1){if(this.reconnectLoopRunning)return;this.reconnectAbort!==null&&this.startReconnectLoop(this.reconnectAbort.signal);return}try{await v(this.connectionDeps()),this.socket!==null&&(this.reconnectAbort=new AbortController,this.wireNoReconnectClose(this.socket))}catch{}}}startReconnectLoop(e){return se(e,this.autoReconnectConfig,this.connectionDeps(),e=>{this.backoffWakeAbort=e},e=>{this.reconnectLoopRunning=e})}subscriptionDeps(){return{name:this.name,debug:this.debug,codec:this.codec,socket:this.socket,localSubscriptions:this.localSubscriptions}}connectionDeps(){return{name:this.name,debug:this.debug,auth:this.auth,codec:this.codec,messageTransform:this.messageTransform,correlations:this.correlations,handlers:this.handlers,localSubscriptions:this.localSubscriptions,wsFactory:this.wsFactory,url:this.url,getSocket:()=>this.socket,setSocket:e=>{this.socket=e},setAuthComplete:e=>{this.authComplete=e},getMessageListener:()=>this.messageListener,setMessageListener:e=>{this.messageListener=e},getCloseListener:()=>this.closeListener,setCloseListener:e=>{this.closeListener=e},resolveReady:()=>{this.readyResolve?.(),this.readyResolve=null},resetReadyPromise:()=>{this.ready=new Promise(e=>{this.readyResolve=e}),this.onNewReadySession?.(this.ready)},notifyConnected:()=>{this.onConnectedCallback?.(),this.onConnected?.()},notifyDisconnected:()=>{this.onDisconnectedCallback?.(),this.onDisconnected?.()}}}defaultWsFactory=async e=>new(await(import(`ws`))).WebSocket(e);wireNoReconnectClose(e){ce(e,this.connectionDeps(),()=>{this.reconnectAbort=null})}};function x(e){e.timer!==void 0&&clearTimeout(e.timer)}var de=class{pendingBroadcasts=new Map;timeout;debug;constructor(e={}){this.timeout=e.timeout??5e3,this.debug=e.debug??!1}startClientBroadcast(e,t,n,r,i){let a=t.correlationId,o=i??this.timeout,s={kind:`client`,sender:e,results:[],pendingClients:new Set(n),nodeResultsReceived:!1,timer:o===0?void 0:setTimeout(()=>{this.debug&&console.warn(`[BroadcastAggregator] Broadcast ${a} timed out`),this.finalizeBroadcast(a)},o)};this.pendingBroadcasts.set(a,s);let c=JSON.stringify(t);for(let e of n)r(e,c);this.debug&&console.info(`[BroadcastAggregator] Broadcast ${a} forwarded to ${n.length} clients`)}startServerBroadcast(e,t,n,r){let i=e.correlationId,a=r??this.timeout;return t.length===0?(this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${i} - no target clients`),Promise.resolve([])):new Promise(r=>{let o={kind:`server`,results:[],pendingClients:new Set(t),timer:a===0?void 0:setTimeout(()=>{this.debug&&console.warn(`[BroadcastAggregator] Server broadcast ${i} timed out`),this.finalizeServerBroadcast(i)},a),resolve:r};this.pendingBroadcasts.set(i,o);let s=JSON.stringify(e);for(let e of t)n(e,s);this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${i} sent to ${t.length} clients`)})}handleResponse(e,t){let n=this.pendingBroadcasts.get(t.correlationId);return n?(t.results&&n.results.push(...t.results),n.pendingClients.delete(e),this.debug&&console.info(`[BroadcastAggregator] Broadcast ${t.correlationId} got response, ${n.pendingClients.size} pending`),this.checkBroadcastComplete(t.correlationId,n),!0):!1}handleNodeResults(e,t,n){let r=this.pendingBroadcasts.get(e);return!r||r.kind!==`client`?!1:(r.results.push(...t),r.nodeResultsReceived=!0,r.nodeError=n,this.debug&&console.info(`[BroadcastAggregator] Broadcast ${e} node results aggregated${n?` (with error)`:``}`),this.checkBroadcastComplete(e,r),!0)}handleClientDisconnect(e){for(let[t,n]of this.pendingBroadcasts)n.kind===`client`&&n.sender===e?(x(n),this.pendingBroadcasts.delete(t)):n.pendingClients.has(e)&&(n.pendingClients.delete(e),this.checkBroadcastComplete(t,n))}cleanup(){for(let e of this.pendingBroadcasts.values())x(e),e.kind===`server`&&e.resolve(e.results);this.pendingBroadcasts.clear()}checkBroadcastComplete(e,t){if(!(t.pendingClients.size>0))if(t.kind===`client`){if(!t.nodeResultsReceived)return;this.finalizeBroadcast(e)}else this.finalizeServerBroadcast(e)}finalizeBroadcast(e){let t=this.pendingBroadcasts.get(e);if(!t||t.kind!==`client`)return;x(t),this.pendingBroadcasts.delete(e);let n=t.nodeError?{type:`broadcast-response`,correlationId:e,error:t.nodeError}:{type:`broadcast-response`,correlationId:e,results:t.results};t.sender.readyState===1&&t.sender.send(JSON.stringify(n)),this.debug&&console.info(`[BroadcastAggregator] Broadcast ${e} finalized with ${t.results.length} results`)}finalizeServerBroadcast(e){let t=this.pendingBroadcasts.get(e);!t||t.kind!==`server`||(x(t),this.pendingBroadcasts.delete(e),t.resolve(t.results),this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${e} finalized with ${t.results.length} results`))}},fe=class{clients=new Set;authenticatingClients=new Set;clientSubscriptions=new Map;clientFilters=new Map;debug;constructor(e={}){this.debug=e.debug??!1}addAuthenticating(e){this.authenticatingClients.add(e)}removeAuthenticating(e){this.authenticatingClients.delete(e)}isAuthenticating(e){return this.authenticatingClients.has(e)}addClient(e){this.clients.add(e)}removeClient(e){this.clients.delete(e),this.authenticatingClients.delete(e),this.clientSubscriptions.delete(e),this.clientFilters.delete(e),this.debug&&console.info(`[ClientRegistry] Client removed (${this.clients.size} remaining)`)}get size(){return this.clients.size}getAllSockets(){return new Set([...this.clients,...this.authenticatingClients])}handleSubscribeMessage(e,t){let n=this.clientSubscriptions.get(e);n||(n=new Set,this.clientSubscriptions.set(e,n));let r=this.clientFilters.get(e);for(let[i]of Object.entries(t.subjects)){n.add(i);let a=t.filters?.[i];a===void 0?r?.delete(i):(r||(r=new Map,this.clientFilters.set(e,r)),r.set(i,a))}if(this.debug){let e=Object.keys(t.subjects).length,n=t.filters?Object.keys(t.filters).length:0;console.info(`[ClientRegistry] Client subscribed to ${e} subjects, ${n} filters`)}}handleUnsubscribeMessage(e,t){let n=this.clientSubscriptions.get(e),r=this.clientFilters.get(e);for(let e of Object.keys(t))n?.delete(e),r?.delete(e);this.debug&&console.info(`[ClientRegistry] Client unsubscribed from ${Object.keys(t).length} subjects`)}getReadyClients(){let e=[];for(let t of this.clients)t.readyState===1&&e.push(t);return e}getRequestRoutingPriority(e,t,n){let r=this.clientSubscriptions.get(e);return!r||r.size===0?1:this.clientWantsMessage(e,t,n)?2:0}getInterestedClients(e,t,n){let r=[];for(let i of this.clients)i!==n&&i.readyState===1&&this.clientWantsMessage(i,e,t)&&r.push(i);return r}forwardEventToClients(e,t,n){let r=c(t)??void 0,i=`payload`in t?t.payload:void 0,a=JSON.stringify(t),o=this.getInterestedClients(r,i,e);for(let e of o)n(e,a)}clientWantsMessage(e,t,n){return d(t,n,this.clientSubscriptions.get(e)??new Set,this.clientFilters.get(e)??new Map)}};async function S(e,t,n){await Promise.all(Array.from(t).map(async t=>{try{await t(e,n.receiveContext)}catch(e){if(n.debug){let t=n.logContext?` ${n.logContext}`:``;console.error(`[ServerTransport] Handler error${t}:`,e)}}}))}function pe(e,t,n){let{correlations:r,broadcastAggregator:i,debug:a}=t;if(e.type===`heartbeat`)return!0;if(e.type===`response`){let t=e;return typeof t.correlationId==`string`?(t.error?r.reject(t.correlationId,s(t.error)):r.resolve(t.correlationId,t.result),!0):(a&&console.warn(`[ServerTransport] Malformed response message: missing correlationId`),!0)}if(e.type===`broadcast-response`){let t=e;return typeof t.correlationId==`string`?(i.handleResponse(n,t),!0):(a&&console.warn(`[ServerTransport] Malformed broadcast-response: missing correlationId`),!0)}return!1}async function me(e,t,n){let{registry:r,broadcastAggregator:i,handlers:a,normalizeBroadcastTimeout:o,sendSafely:s,debug:c}=n;if(pe(e,n,t))return;let l=n.auth?.getReceiveContext?.(t);if(e.type===`subscribe`){if(!p(e.subjects)){c&&console.warn(`[ServerTransport] Malformed subscribe message: missing subjects record`);return}r.handleSubscribeMessage(t,e),await S(e,a,{debug:c,receiveContext:l,logContext:`dispatching subscribe`});return}if(e.type===`unsubscribe`){if(!p(e.subjects)){c&&console.warn(`[ServerTransport] Malformed unsubscribe message: missing subjects record`);return}r.handleUnsubscribeMessage(t,e.subjects),await S(e,a,{debug:c,receiveContext:l,logContext:`dispatching unsubscribe`});return}if(e.type===`broadcast`){let n=e;if(typeof n.correlationId!=`string`||typeof n.subject!=`string`){c&&console.warn(`[ServerTransport] Malformed broadcast message: missing correlationId or subject`);return}let u=r.getInterestedClients(n.subject,n.payload,t),d=o(n.timeout);i.startClientBroadcast(t,n,u,s,d),await S(e,a,{debug:c,receiveContext:l});return}e.type===`event`&&r.forwardEventToClients(t,e,s),await S(e,a,{debug:c,receiveContext:l})}function he(e,t){let{auth:n,registry:r,debug:i}=t;return async a=>{let o;try{o=JSON.parse(a.toString())}catch(e){i&&console.error(`[ServerTransport] Failed to parse message:`,e);return}let s=o&&typeof o==`object`?o:void 0;if(!s||typeof s.type!=`string`){i&&console.error(`[ServerTransport] Invalid message structure:`,o);return}let c=o;try{if(n?.handleAuthMessage(c,e))return;if(n&&r.isAuthenticating(e)){i&&console.warn(`[ServerTransport] Ignoring message from unauthenticated client`);return}await me(c,e,t)}catch(e){i&&console.error(`[ServerTransport] Failed to process message:`,e)}}}function ge(e){return typeof e!=`number`||!Number.isFinite(e)||e<=0?5e3:Math.min(e,6e4)}async function _e(e,t){let{registry:n,correlations:r,broadcastAggregator:i,handlers:o,auth:s,serverSubscriptions:c,sendSafely:l,debug:u}=t;s&&n.addAuthenticating(e);let d=he(e,{registry:n,correlations:r,broadcastAggregator:i,handlers:o,auth:s,normalizeBroadcastTimeout:ge,sendSafely:l,debug:u}),f=e=>{d(e.data)},p=()=>{s?.cleanupSocket(e),n.removeClient(e),e.removeEventListener(`message`,f),e.removeEventListener(`close`,p),e.removeEventListener(`error`,m),i.handleClientDisconnect(e),u&&console.info(`[ServerTransport] Client disconnected (${n.size} remaining)`)},m=e=>{u&&console.error(`[ServerTransport] Client socket error:`,e)};e.addEventListener(`message`,f),e.addEventListener(`close`,p),e.addEventListener(`error`,m);try{if(s&&(await s.authenticateServer(e,t=>{if(e.readyState!==1)throw Error(`Cannot send auth message: socket not ready (state: ${e.readyState})`);e.send(JSON.stringify(t))}),n.removeAuthenticating(e)),e.readyState!==1)return;if(n.addClient(e),c.size>0){let t=a(c);l(e,JSON.stringify(t))}l(e,JSON.stringify({type:`subscribe-sync-complete`})),u&&console.info(`[ServerTransport] Client connected (${n.size} total)`)}catch(t){u&&console.error(`[ServerTransport] Client authentication failed:`,t),e.close(1008,`Authentication failed`)}}async function ve(e,t,n){let{registry:a,correlations:o}=n,s=`${e.namespace}.${e.subject}`,c=a.getReadyClients().map(t=>({client:t,priority:a.getRequestRoutingPriority(t,s,e.payload)})).sort((e,t)=>t.priority-e.priority).map(({client:e})=>e);if(c.length===0)throw new r(s);for(let[n,r]of c.entries()){let a=`${e.correlationId}:attempt-${n+1}`,c={...e,correlationId:a};try{r.send(JSON.stringify(c))}catch{continue}try{return await o.track(a,t)}catch(e){if(u(e,s)||e instanceof i)continue;throw e}}throw new r(s)}var C=class{name;wss;auth;debug;handlers=new Set;registry;serverSubscriptions=new Map;broadcastAggregator;correlations=new t;connectionListener=null;constructor(e){let{websocket:t,name:n=`websocket`,auth:r,debug:i=!1}=e;this.wss=t,this.name=n,this.auth=r,this.debug=i,this.registry=new fe({debug:i}),this.broadcastAggregator=new de({debug:i})}sendToClientSafely(e,t){try{e.send(t)}catch(e){this.debug&&console.warn(`[ServerTransport] Failed to send message to client:`,e)}}async connect(){if(this.connectionListener!==null)throw Error(`ServerTransport.connect() called while already connected`);this.connectionListener=e=>{_e(e,{registry:this.registry,correlations:this.correlations,broadcastAggregator:this.broadcastAggregator,handlers:this.handlers,auth:this.auth,serverSubscriptions:this.serverSubscriptions,sendSafely:(e,t)=>this.sendToClientSafely(e,t),debug:this.debug})},this.wss.on(`connection`,this.connectionListener),this.debug&&console.info(`[ServerTransport] Listening for connections`)}async disconnect(){this.connectionListener&&=(this.wss.off(`connection`,this.connectionListener),null);let e=this.registry.getAllSockets();for(let t of e)t.close();await new Promise((e,t)=>{this.wss.close(n=>n?t(n):e())}),this.correlations.cleanup(),this.broadcastAggregator.cleanup(),this.auth?.cleanup(),this.handlers.clear(),this.serverSubscriptions.clear(),this.debug&&console.info(`[ServerTransport] Disconnected`)}async send(e,t){if(e.type===`broadcast`){let n=c(e)??void 0,r=`payload`in e?e.payload:void 0,i=this.registry.getInterestedClients(n,r);return this.broadcastAggregator.startServerBroadcast(e,i,(e,t)=>{this.sendToClientSafely(e,t)},t)}if(e.type===`request`)return ve(e,t??n,{registry:this.registry,correlations:this.correlations});if(this.registry.size===0){if(this.debug){let t=c(e);console.debug(`[ServerTransport] No clients to receive ${e.type}${t?`: ${t}`:``}`)}return!1}let r=c(e)??void 0,i=`payload`in e?e.payload:void 0,a=JSON.stringify(e),o=this.registry.getInterestedClients(r,i);for(let e of o)this.sendToClientSafely(e,a);let s=o.length>0;if(!s){if(r&&this.debug&&console.warn(`[ServerTransport] No interested clients for subject: ${r}`),e.type===`response`)return!1;if(!r)throw Error(`No connected clients available to receive message`)}return s}onReceive(e){return this.handlers.add(e),()=>{this.handlers.delete(e)}}cancelRequest(e,t){this.correlations.cancel(e,t)}onBroadcastResults(e,t,n){this.broadcastAggregator.handleNodeResults(e,t,n)}async subscribe(e,t,n=[]){let r=this.serverSubscriptions.get(e)?.filter,i=t??r;if(this.serverSubscriptions.set(e,{filter:i,priorities:n}),this.registry.size>0){let t=a(new Map([[e,{filter:i,priorities:n}]])),r=JSON.stringify(t);for(let e of this.registry.getReadyClients())this.sendToClientSafely(e,r)}}getConnectionCount(){return this.registry.getReadyClients().length}async unsubscribe(e){if(this.serverSubscriptions.delete(e),this.registry.size>0){let t=o({[e]:[]}),n=JSON.stringify(t);for(let e of this.registry.getReadyClients())this.sendToClientSafely(e,n)}}};function ye(e,t){let n=new Event(`close`);return Object.defineProperties(n,{code:{value:e??1e3,enumerable:!0},reason:{value:t??``,enumerable:!0}}),n}function be(e){if(typeof e!=`object`||!e)throw TypeError(`WebSocket transport options must be an object`);let t=e;if(t.mode!==`client`&&t.mode!==`server`)throw TypeError(`WebSocket transport mode must be "client" or "server"`);if(t.mode===`client`){if(!xe(t.websocket))throw TypeError(`WebSocket transport client mode requires a websocket with addEventListener/removeEventListener`);return}if(!Se(t.websocket))throw TypeError(`WebSocket transport server mode requires a websocket with on/off listener methods`)}function xe(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.send==`function`&&typeof t.close==`function`&&typeof t.addEventListener==`function`&&typeof t.removeEventListener==`function`}function Se(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.on==`function`&&typeof t.off==`function`&&typeof t.close==`function`}var Ce=class{secret;algorithm;challengeTimeout;pendingChallenge;pendingResult;queuedChallengeNonce;queuedResult;clientAuthComplete=!1;serverPendingResponses=new Map;constructor(e){this.secret=e.secret,this.algorithm=e.algorithm??`sha256`,this.challengeTimeout=e.challengeTimeout??5e3}async authenticateServer(e,t){let n=crypto.getRandomValues(new Uint8Array(32)),r=Array.from(n).map(e=>e.toString(16).padStart(2,`0`)).join(``),i=await this.computeHmac(r);t({type:`auth-challenge`,nonce:r});let a=!1;try{if(await this.waitForAuthResponse(e)!==i)throw this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!1,error:`Invalid signature`}),a=!0,Error(`HMAC authentication failed: Invalid signature`);this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!0}),a=!0}catch(n){let r=this.serverPendingResponses.has(e);throw this.serverPendingResponses.delete(e),!a&&r&&this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!1,error:n instanceof Error?n.message:`Authentication failed`}),n}finally{this.serverPendingResponses.delete(e)}}async authenticateClient(e){this.clientAuthComplete=!1;let t=await this.waitForAuthChallenge();e({type:`auth-response`,signature:await this.computeHmac(t)});let n=await this.waitForAuthResult();if(!n.success)throw Error(`HMAC authentication failed: ${n.error??`Unknown error`}`);this.clientAuthComplete=!0}handleAuthMessage(e,t){if(typeof e!=`object`||!e||!(`type`in e)||typeof e.type!=`string`)return!1;let n=e;if(n.type===`auth-challenge`)return typeof n.nonce!=`string`||this.clientAuthComplete||(this.pendingChallenge?(clearTimeout(this.pendingChallenge.timeoutHandle),this.pendingChallenge.resolve(n.nonce),this.pendingChallenge=void 0):this.queuedChallengeNonce=n.nonce),!0;if(n.type===`auth-result`){if(typeof n.success!=`boolean`||this.clientAuthComplete)return!0;let e={success:n.success,error:n.error};return this.pendingResult?(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.resolve(e),this.pendingResult=void 0):this.queuedResult=e,!0}if(n.type===`auth-response`){if(t){let e=this.serverPendingResponses.get(t);e&&(clearTimeout(e.timeoutHandle),e.resolve(n.signature))}return!0}return!1}async waitForAuthChallenge(){if(this.queuedChallengeNonce!==void 0){let e=this.queuedChallengeNonce;return this.queuedChallengeNonce=void 0,e}return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingChallenge=void 0,t(Error(`Authentication challenge timeout`))},this.challengeTimeout);this.pendingChallenge={resolve:e,reject:t,timeoutHandle:n}})}async waitForAuthResponse(e){return new Promise((t,n)=>{let r={resolve:t,reject:n,timeoutHandle:setTimeout(()=>{n(Error(`Authentication response timeout`))},this.challengeTimeout)};this.serverPendingResponses.set(e,r)})}async waitForAuthResult(){if(this.queuedResult!==void 0){let e=this.queuedResult;return this.queuedResult=void 0,e}return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingResult=void 0,t(Error(`Authentication result timeout`))},this.challengeTimeout);this.pendingResult={resolve:e,reject:t,timeoutHandle:n}})}async computeHmac(e){let t=new TextEncoder,n=t.encode(this.secret),r=this.algorithm.replace(/^sha/,`SHA-`),i=await crypto.subtle.importKey(`raw`,n,{name:`HMAC`,hash:r},!1,[`sign`]),a=await crypto.subtle.sign(`HMAC`,i,t.encode(e));return Array.from(new Uint8Array(a)).map(e=>e.toString(16).padStart(2,`0`)).join(``)}sendAuthResultBestEffort(e,t){try{e(t)}catch{}}cleanupSocket(e){let t=this.serverPendingResponses.get(e);t&&(clearTimeout(t.timeoutHandle),this.serverPendingResponses.delete(e),t.reject(Error(`Socket disconnected during HMAC authentication`)))}cleanup(){this.pendingChallenge&&=(clearTimeout(this.pendingChallenge.timeoutHandle),void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),void 0),this.queuedChallengeNonce=void 0,this.queuedResult=void 0,this.clientAuthComplete=!1;for(let e of this.serverPendingResponses.values())clearTimeout(e.timeoutHandle);this.serverPendingResponses.clear()}};function w(e){let t=Array.from(e,e=>String.fromCharCode(e)).join(``);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``)}function T(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=(4-t.length%4)%4;t+=`=`.repeat(n);let r=atob(t),i=new Uint8Array(r.length);for(let e=0;e<r.length;e++)i[e]=r.charCodeAt(e);return i}function E(e){return new TextEncoder().encode(e)}function D(e){return new TextDecoder().decode(e)}async function O(e){let t=await crypto.subtle.exportKey(`spki`,e);return w(new Uint8Array(t))}async function k(e){let t=await crypto.subtle.exportKey(`raw`,e);return w(new Uint8Array(t))}async function A(e,t,n=[]){let r=T(e);return crypto.subtle.importKey(`spki`,r,t,!0,n)}async function j(e,t,n=[]){let r=T(e);return crypto.subtle.importKey(`raw`,r,t,!0,n)}async function M(e){let t=await crypto.subtle.exportKey(`pkcs8`,e),n=w(new Uint8Array(t)).replace(/-/g,`+`).replace(/_/g,`/`),r=(4-n.length%4)%4;return n+=`=`.repeat(r),`-----BEGIN PRIVATE KEY-----\n${n.match(/.{1,64}/g)?.join(`
-`)??n}\n-----END PRIVATE KEY-----`}async function N(e,t,n){let r=T(e.replace(/-----BEGIN PRIVATE KEY-----/,``).replace(/-----END PRIVATE KEY-----/,``).replace(/\s/g,``).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``));return crypto.subtle.importKey(`pkcs8`,r,t,!0,n)}const P={name:`ECDH`,namedCurve:`P-256`};async function F(e=!0){return crypto.subtle.generateKey(P,e,[`deriveKey`,`deriveBits`])}async function I(e){return O(e)}async function we(e){return k(e)}async function Te(e){return j(e,P)}async function L(e,t=[]){return A(e,P,t)}async function Ee(e){return M(e)}async function De(e){return N(e,P,[`deriveKey`,`deriveBits`])}async function R(e,t){return crypto.subtle.deriveBits({name:`ECDH`,public:t},e,256)}async function z(e,t){let n=crypto.getRandomValues(new Uint8Array(12)),r=await crypto.subtle.encrypt({name:`AES-GCM`,iv:n},e,t);return{ciphertext:new Uint8Array(r),nonce:n}}async function B(e,t,n){let r=await crypto.subtle.decrypt({name:`AES-GCM`,iv:n},e,t);return new Uint8Array(r)}async function Oe(e){return crypto.subtle.importKey(`raw`,e,{name:`AES-GCM`},!1,[`encrypt`,`decrypt`])}async function V(e,t,n){let r=await crypto.subtle.importKey(`raw`,e,{name:`HKDF`},!1,[`deriveKey`]);return crypto.subtle.deriveKey({name:`HKDF`,hash:`SHA-256`,salt:t,info:E(n)},r,{name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`])}const H={name:`ECDSA`,namedCurve:`P-256`};async function ke(e=!0){return crypto.subtle.generateKey(H,e,[`sign`,`verify`])}async function U(e,t){let n=await crypto.subtle.sign({name:`ECDSA`,hash:{name:`SHA-256`}},e,t);return new Uint8Array(n)}async function W(e,t,n){return crypto.subtle.verify({name:`ECDSA`,hash:{name:`SHA-256`}},e,t,n)}async function Ae(e){return O(e)}async function je(e){return A(e,H,[`verify`])}async function Me(e){return k(e)}async function Ne(e){return j(e,H,[`verify`])}async function Pe(e){return M(e)}async function Fe(e){return N(e,H,[`sign`])}var Ie=e({decodeText:()=>D,decrypt:()=>B,deriveSessionKey:()=>V,deriveSharedSecret:()=>R,encodeText:()=>E,encrypt:()=>z,exportPrivateKeyPEM:()=>Ee,exportPublicKey:()=>I,exportPublicKeyRaw:()=>we,exportSigningPrivateKeyPEM:()=>Pe,exportSigningPublicKey:()=>Ae,exportSigningPublicKeyRaw:()=>Me,fromBase64Url:()=>T,generateECDHKeyPair:()=>F,generateSigningKeyPair:()=>ke,importAESKey:()=>Oe,importPrivateKeyPEM:()=>De,importPublicKey:()=>L,importPublicKeyRaw:()=>Te,importSigningPrivateKeyPEM:()=>Fe,importSigningPublicKey:()=>je,importSigningPublicKeyRaw:()=>Ne,sign:()=>U,toBase64Url:()=>w,verify:()=>W});function G(e){let t=e.match(/.{1,2}/g);return new Uint8Array(t?.map(e=>parseInt(e,16))??[])}function K(e){return Array.from(e).map(e=>e.toString(16).padStart(2,`0`)).join(``)}async function q(e,t){let n=await F(!0),r=await I(n.publicKey);return{ephemeralKeyPair:n,ephemeralPublicKey:r,signature:K(await U(e,E(r+t)))}}function Le(){return K(crypto.getRandomValues(new Uint8Array(16)))}async function J(e,t,n,r){let i=E(t+r);return W(e,G(n),i)}async function Y(e,t,n,r){return V(await R(e,await L(t)),G(n),r)}async function Re(e,t,n,r){if(e===t)throw Error(`deriveRelaySaltHex: identityId must differ from peerId`);let[i,a]=e<t?[e,t]:[t,e],[o,s]=e<t?[n,r]:[r,n],c=E(`${i}${a}${o}${s}`),l=new Uint8Array(c).buffer,u=await crypto.subtle.digest(`SHA-256`,l);return K(new Uint8Array(u))}var ze=class{signingKeyPair;identityId;peerId;getPeerSigningKey;timeout;pendingKeyExchange;pendingResult;clientSession;clientEphemeralKeyPair;serverPendingKeyExchange=new Map;serverSessions=new Map;serverEphemeralKeyPairs=new Map;constructor(e){this.signingKeyPair=e.signingKeyPair,this.identityId=e.identityId,this.peerId=e.peerId,this.getPeerSigningKey=e.getPeerSigningKey,this.timeout=e.timeout??1e4}async authenticateClient(e){if(!this.peerId)throw Error(`E2E authentication failed: peerId is required for client authentication`);let{ephemeralKeyPair:t,ephemeralPublicKey:n,signature:r}=await q(this.signingKeyPair.privateKey,this.identityId);this.clientEphemeralKeyPair=t;try{let i=this.waitForKeyExchangeResponse(),a=this.waitForAuthResult();e({type:`e2e-key-exchange`,deviceId:this.identityId,ephemeralPublicKey:n,signature:r});let o=await i,s=await this.getPeerSigningKey(this.peerId);if(!s)throw Error(`E2E authentication failed: Unknown server`);if(!await J(s,o.ephemeralPublicKey,o.signature,this.peerId))throw Error(`E2E authentication failed: Invalid server signature`);let c=await Y(t.privateKey,o.ephemeralPublicKey,o.salt,`makaio-e2e-session-v1`);this.clientSession={sessionKey:c,peerId:this.peerId};let l=await a;if(!l.success)throw Error(`E2E authentication failed: ${l.error??`Unknown error`}`)}catch(e){throw this.pendingKeyExchange&&=(clearTimeout(this.pendingKeyExchange.timeoutHandle),void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),void 0),this.clientSession=void 0,this.clientEphemeralKeyPair=void 0,e}}async authenticateServer(e,t){try{let n=await this.waitForClientKeyExchange(e),r=await this.getPeerSigningKey(n.deviceId);if(!r)throw t({type:`e2e-auth-result`,success:!1,error:`Unknown device`}),Error(`E2E authentication failed: Unknown device ${n.deviceId}`);if(!await J(r,n.ephemeralPublicKey,n.signature,n.deviceId))throw t({type:`e2e-auth-result`,success:!1,error:`Invalid signature`}),Error(`E2E authentication failed: Invalid client signature`);let{ephemeralKeyPair:i,ephemeralPublicKey:a,signature:o}=await q(this.signingKeyPair.privateKey,this.identityId),s=Le();this.serverEphemeralKeyPairs.set(e,i),t({type:`e2e-key-exchange-response`,ephemeralPublicKey:a,signature:o,salt:s});let c=await Y(i.privateKey,n.ephemeralPublicKey,s,`makaio-e2e-session-v1`);this.serverSessions.set(e,{sessionKey:c,peerId:n.deviceId}),t({type:`e2e-auth-result`,success:!0})}catch(n){throw this.serverPendingKeyExchange.delete(e),this.serverEphemeralKeyPairs.delete(e),t({type:`e2e-auth-result`,success:!1,error:n instanceof Error?n.message:`Authentication failed`}),n}finally{this.serverPendingKeyExchange.delete(e)}}handleAuthMessage(e,t){if(typeof e!=`object`||!e||!(`type`in e)||typeof e.type!=`string`)return!1;let n=e;if(n.type===`e2e-key-exchange-response`)return this.pendingKeyExchange&&=(clearTimeout(this.pendingKeyExchange.timeoutHandle),this.pendingKeyExchange.resolve({ephemeralPublicKey:n.ephemeralPublicKey,signature:n.signature,salt:n.salt}),void 0),!0;if(n.type===`e2e-auth-result`)return this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.resolve({success:n.success,error:n.error}),void 0),!0;if(n.type===`e2e-key-exchange`&&t){let e=this.serverPendingKeyExchange.get(t);return e&&(clearTimeout(e.timeoutHandle),e.resolve({deviceId:n.deviceId,ephemeralPublicKey:n.ephemeralPublicKey,signature:n.signature})),!0}return!1}async waitForKeyExchangeResponse(){return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingKeyExchange=void 0,t(Error(`E2E key exchange timeout`))},this.timeout);this.pendingKeyExchange={resolve:e,reject:t,timeoutHandle:n}})}async waitForAuthResult(){return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingResult=void 0,t(Error(`E2E authentication result timeout`))},this.timeout);this.pendingResult={resolve:e,reject:t,timeoutHandle:n}})}async waitForClientKeyExchange(e){return new Promise((t,n)=>{let r={resolve:t,reject:n,timeoutHandle:setTimeout(()=>{this.serverPendingKeyExchange.delete(e),n(Error(`E2E key exchange timeout`))},this.timeout)};this.serverPendingKeyExchange.set(e,r)})}getSessionKey(e){return e?this.serverSessions.get(e)?.sessionKey??null:this.clientSession?.sessionKey??null}getPeerId(e){return e?this.serverSessions.get(e)?.peerId??null:this.clientSession?.peerId??null}cleanupSocket(e){let t=this.serverPendingKeyExchange.get(e);t&&(clearTimeout(t.timeoutHandle),this.serverPendingKeyExchange.delete(e)),this.serverSessions.delete(e),this.serverEphemeralKeyPairs.delete(e)}cleanup(){this.pendingKeyExchange&&=(clearTimeout(this.pendingKeyExchange.timeoutHandle),void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),void 0),this.clientSession=void 0,this.clientEphemeralKeyPair=void 0;for(let e of this.serverPendingKeyExchange.values())clearTimeout(e.timeoutHandle);this.serverPendingKeyExchange.clear(),this.serverSessions.clear(),this.serverEphemeralKeyPairs.clear()}};const X=`E2E relay auth session aborted by reconnect`;var Be=class{signingKeyPair;identityId;getPeerSigningKey;timeout;mode;blocking;pendingPeer;sessionKey;peerId;localEphemeral;localExchangeMessage;sentLocalExchange=!1;earlyPeer;sendAuthMessage;authGeneration=0;processingExchange=!1;constructor(e){this.signingKeyPair=e.signingKeyPair,this.identityId=e.identityId,this.getPeerSigningKey=e.getPeerSigningKey,this.timeout=e.timeout??1e4,this.mode=e.mode??`initiator`,this.blocking=e.blocking??!0}async authenticateClient(e){let t=this.sendAuthMessage===void 0?this.earlyPeer:void 0;this.cleanup();let n=this.authGeneration;if(this.earlyPeer=t,this.sendAuthMessage=e,this.mode===`initiator`){if(await this.ensureLocalExchangeMessage(),n!==this.authGeneration)throw Error(X);this.sendLocalExchange()}if(!this.blocking){if(this.earlyPeer){let e=this.earlyPeer;this.earlyPeer=void 0,this.dispatchPeerExchange(e,n)}return}let r=await this.waitForPeerExchange();if(await this.processPeerExchange(r,n),n!==this.authGeneration||!this.sessionKey)throw Error(X)}async authenticateServer(e,t){throw Error(`E2ERelayAuth does not support server authentication`)}handleAuthMessage(e){let t=e;return!t||t.type!==`e2e-relay-key-exchange`?!1:t.identityId===this.identityId?!0:this.pendingPeer?(this.pendingPeer.resolve(t),this.pendingPeer=void 0,!0):(this.earlyPeer=t,!this.blocking&&this.sendAuthMessage&&!this.sessionKey&&!this.processingExchange&&this.dispatchPeerExchange(t,this.authGeneration),!0)}cleanupSocket(e){}cleanup(){this.authGeneration++,this.pendingPeer&&=(this.pendingPeer.reject(Error(X)),void 0),this.earlyPeer&&=void 0,this.sessionKey=void 0,this.peerId=void 0,this.localEphemeral=void 0,this.localExchangeMessage=void 0,this.sentLocalExchange=!1,this.processingExchange=!1,this.sendAuthMessage=void 0}dispatchPeerExchange(e,t){this.processingExchange=!0,this.processPeerExchange(e,t).catch(e=>{e instanceof Error&&e.message===X||console.error(`[E2ERelayAuth] Peer exchange failed:`,e)}).finally(()=>{t===this.authGeneration&&(this.processingExchange=!1,this.retryQueuedPeerExchange(t))})}getSessionKey(){return this.sessionKey??null}getPeerId(){return this.peerId??null}async waitForPeerExchange(){if(this.earlyPeer){let e=this.earlyPeer;return this.earlyPeer=void 0,e}return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingPeer=void 0,t(Error(`E2E relay key exchange timeout`))},this.timeout),r=()=>{clearTimeout(n),this.pendingPeer=void 0};this.pendingPeer={resolve:t=>{r(),e(t)},reject:e=>{r(),t(e)},timeoutHandle:n}})}async ensureLocalExchangeMessage(){if(this.localExchangeMessage&&this.localEphemeral)return this.localExchangeMessage;let{ephemeralKeyPair:e,ephemeralPublicKey:t,signature:n}=await q(this.signingKeyPair.privateKey,this.identityId);return this.localEphemeral=e,this.localExchangeMessage={type:`e2e-relay-key-exchange`,identityId:this.identityId,ephemeralPublicKey:t,signature:n},this.localExchangeMessage}sendLocalExchange(e=!1){!this.sendAuthMessage||!this.localExchangeMessage||!e&&this.sentLocalExchange||(this.sendAuthMessage(this.localExchangeMessage),this.sentLocalExchange=!0)}retryQueuedPeerExchange(e){if(this.blocking||!this.sendAuthMessage||this.sessionKey||this.processingExchange||e!==this.authGeneration)return;let t=this.earlyPeer;t&&(this.earlyPeer=void 0,this.dispatchPeerExchange(t,e))}async processPeerExchange(e,t){if(!this.sendAuthMessage){this.earlyPeer=e;return}let n=await this.ensureLocalExchangeMessage();if(t!==this.authGeneration)return;let r=await this.getPeerSigningKey(e.identityId);if(!r)throw Error(`E2E relay authentication failed: Unknown peer ${e.identityId}`);if(!await J(r,e.ephemeralPublicKey,e.signature,e.identityId))throw Error(`E2E relay authentication failed: Invalid peer signature`);let i=await Re(this.identityId,e.identityId,n.ephemeralPublicKey,e.ephemeralPublicKey);if(!this.localEphemeral)throw Error(`E2E relay authentication failed: Local ephemeral key missing`);let a=await Y(this.localEphemeral.privateKey,e.ephemeralPublicKey,i,`makaio-e2e-relay-v1`);t===this.authGeneration&&(this.sessionKey=a,this.peerId=e.identityId,this.mode===`initiator`?this.sendLocalExchange(!0):this.sendLocalExchange())}},Ve=class{hmac;e2e;socketStrategy=new Map;pendingServerAuth=new Map;hmacCancelled=new Map;constructor(e){this.hmac=e.hmac,this.e2e=e.e2e}setE2EAuth(e){this.e2e=e}async authenticateClient(e){let t=this.hmac??this.e2e;if(!t)throw Error(`DispatchingAuth: no auth strategy configured`);return t.authenticateClient(e)}async authenticateServer(e,t){let n=this.resolveSingleStrategy();if(n)return n.authenticateServer(e,t);if(!this.hmac||!this.e2e)throw Error(`DispatchingAuth: no auth strategy configured`);let r={cancelled:!1};this.hmacCancelled.set(e,r);let i=this.hmac.authenticateServer(e,e=>{r.cancelled||t(e)});return new Promise((n,a)=>{this.pendingServerAuth.set(e,{resolve:n,reject:a,send:t}),i.then(n).catch(e=>{r.cancelled||a(e instanceof Error?e:Error(String(e)))})})}handleAuthMessage(e,t){if(!t)return(this.hmac??this.e2e)?.handleAuthMessage(e)??!1;let n=this.socketStrategy.get(t);if(n)return n.handleAuthMessage(e,t);let r=this.resolveStrategy(e),i=this.pendingServerAuth.get(t);return r?(this.socketStrategy.set(t,r),this.pendingServerAuth.delete(t),r===this.hmac?this.hmacCancelled.delete(t):(this.cancelHmac(t),i&&r.authenticateServer(t,i.send).then(i.resolve).catch(e=>{i.reject(e instanceof Error?e:Error(String(e)))})),r.handleAuthMessage(e,t)):(this.cancelHmac(t),i&&(this.pendingServerAuth.delete(t),i.reject(Error(`DispatchingAuth: unrecognised auth message type "${this.peekType(e)}" — no matching strategy`))),!1)}cleanupSocket(e){let t=this.socketStrategy.get(e);t&&(t.cleanupSocket(e),this.socketStrategy.delete(e)),this.cancelHmac(e);let n=this.pendingServerAuth.get(e);n&&(this.pendingServerAuth.delete(e),n.reject(Error(`DispatchingAuth: socket disconnected before auth type was determined`)))}cleanup(){this.hmac?.cleanup(),this.e2e?.cleanup(),this.socketStrategy.clear();for(let e of this.pendingServerAuth.values())e.reject(Error(`DispatchingAuth: cleanup called before authentication completed`));this.pendingServerAuth.clear(),this.hmacCancelled.clear()}peekType(e){if(typeof e!=`object`||!e||!(`type`in e))return;let{type:t}=e;return typeof t==`string`?t:void 0}resolveSingleStrategy(){if(this.hmac&&!this.e2e)return this.hmac;if(this.e2e&&!this.hmac)return this.e2e}resolveStrategy(e){let t=this.peekType(e);if(t){if(t===`e2e-key-exchange`&&this.e2e)return this.e2e;if(t===`auth-response`&&this.hmac)return this.hmac}}cancelHmac(e){let t=this.hmacCancelled.get(e);t&&(t.cancelled=!0,this.hmacCancelled.delete(e),this.hmac?.cleanupSocket(e))}};function Z(e){return`payload`in e}async function He(e,t,n){if(e.type!==`response`||e.result===void 0||e.error!==void 0)return;let{ciphertext:r,nonce:i}=await z(n,E(JSON.stringify(e.result)));t.result=w(r),t.e2e={nonce:w(i),v:1}}async function Ue(e,t,n){if(e.type!==`broadcast-response`||e.results===void 0||e.error!==void 0)return;let{ciphertext:r,nonce:i}=await z(n,E(JSON.stringify(e.results)));t.results=w(r),t.e2e={nonce:w(i),v:1}}async function We(e,t,n){if(!Z(e)||e.payload===void 0)return;let{ciphertext:r,nonce:i}=await z(n,E(JSON.stringify(e.payload)));t.payload=w(r),t.e2e={nonce:w(i),v:1}}async function Ge(e,t,n){if(e.type!==`response`&&e.type!==`broadcast-response`||e.error===void 0)return;let{ciphertext:r,nonce:i}=await z(n,E(JSON.stringify(e.error)));t.error=w(r),t.e2e={nonce:w(i),v:1}}async function Ke(e,t,n,r){if(!Z(e)||typeof e.payload!=`string`)return;let i=D(await B(n,T(e.payload),r));t.payload=JSON.parse(i)}async function qe(e,t,n,r){if(e.type!==`response`||typeof e.result!=`string`)return;let i=D(await B(n,T(e.result),r));t.result=JSON.parse(i)}async function Je(e,t,n,r){if(e.type!==`broadcast-response`||typeof e.results!=`string`)return;let i=D(await B(n,T(e.results),r));t.results=JSON.parse(i)}async function Ye(e,t,n,r){if(e.type!==`response`&&e.type!==`broadcast-response`||typeof e.error!=`string`)return;let i=D(await B(n,T(e.error),r));t.error=JSON.parse(i)}async function Xe(e,t){let n={...e};return await We(e,n,t),await He(e,n,t),await Ue(e,n,t),await Ge(e,n,t),n}async function Ze(e,t){if(!e.e2e)return e;let n={...e};delete n.e2e;let r=T(e.e2e.nonce);return await Ke(e,n,t,r),await qe(e,n,t,r),await Je(e,n,t,r),await Ye(e,n,t,r),n}function Qe(e){let{e2eAuth:t,websocket:n,...r}=e,i=new b({...r,url:`<pre-connected>`,createWebSocket:()=>n,auth:t,autoReconnect:!1,messageTransform:async e=>{let n=t.getSessionKey();if(!n)return e;let r=e;if(!r.e2e)throw Error(`Received plaintext message on E2E-encrypted channel — possible injection`);return Ze(r,n)}});async function a(e,n){let r=t.getSessionKey();if(!r)throw Error(`E2E session key not available - authentication may have failed`);let a=await Xe(e,r);return i.send(a,n)}return{name:i.name,connect:i.connect.bind(i),disconnect:i.disconnect.bind(i),send:a,cancelRequest:i.cancelRequest.bind(i),onReceive:i.onReceive.bind(i),subscribe:i.subscribe.bind(i),unsubscribe:i.unsubscribe.bind(i),getSubscriptions:i.getSubscriptions.bind(i)}}function $e(e){return Qe(e)}function et(e){if(!e||typeof e!=`object`)return!1;let t=e;if(t.type!==`e2e-relay-envelope`||typeof t.payload!=`string`)return!1;let n=t.e2e;return!!n&&typeof n.nonce==`string`&&typeof n.v==`number`}async function tt(e,t){let{ciphertext:n,nonce:r}=await z(t,E(JSON.stringify(e)));return{type:`e2e-relay-envelope`,payload:w(n),e2e:{nonce:w(r),v:1}}}async function nt(e,t){let n=T(e.e2e.nonce),r=D(await B(t,T(e.payload),n));return JSON.parse(r)}function rt(e){let t=()=>{if(!e.isFrozen())throw Error(`RelayControlRegistry must be frozen before processing relay control messages`)};function n(t){return typeof t.namespace!=`string`||typeof t.subject!=`string`||!e.isControlEvent(t.namespace,t.subject)||typeof t.messageId!=`string`?!1:t.payload!==void 0}function r(t){return typeof t.namespace!=`string`||typeof t.subject!=`string`||!e.isControlRequest(t.namespace,t.subject)||typeof t.messageId!=`string`||typeof t.correlationId!=`string`?!1:t.payload!==void 0}function i(e){if(t(),!e||typeof e!=`object`)return!1;let i=e;return i.type===`event`?n(i):i.type===`request`?r(i):!1}function a(e){if(t(),!e||typeof e!=`object`)return!1;let n=e;return n.type!==`relay-control`||n.v!==1||!n.payload||typeof n.payload!=`object`?!1:i(n.payload)}function o(e){if(t(),!i(e))throw Error(`Invalid relay control message`);return{type:`relay-control`,v:1,payload:e}}return{createRelayControlEnvelope:o,isRelayControlEnvelopeMessage:a,isRelayControlBusMessage:i}}function Q(e){let t=Date.now()-3e5;for(let[n,r]of e)r>=t||e.delete(n);for(;e.size>2048;){let t=e.keys().next().value;if(!t)break;e.delete(t)}}const it=e=>{if(!e||typeof e!=`object`)return!1;let t=e;return t.type===`response`&&typeof t.correlationId==`string`},at=e=>e.type===`subscribe`||e.type===`unsubscribe`;function $(e,t,n,r){if(!r.isFrozen())throw Error(`E2ERelay transport requires a frozen relay control registry`);let{createRelayControlEnvelope:i,isRelayControlEnvelopeMessage:a,isRelayControlBusMessage:o}=rt(r),s=e=>{n.delete(e),n.set(e,Date.now()),Q(n)};return{encode:async t=>{if(o(t))return t.type===`request`&&s(t.correlationId),JSON.stringify(i(t));if(Q(n),t.type===`response`&&n.has(t.correlationId))return n.delete(t.correlationId),JSON.stringify(t);let r=e.getSessionKey();if(!r&&at(t))return JSON.stringify(t);if(!r)throw Error(`E2E relay session not established`);let a=await tt(t,r);return JSON.stringify(a)},decode:async r=>{let i=e.getSessionKey();if(a(r)){let e=r.payload;return t&&console.info(`[E2ERelayTransport] Decoded relay control envelope:`,e.type,e.namespace,e.subject),e.type===`request`&&s(e.correlationId),e}if(Q(n),it(r)&&n.has(r.correlationId))return n.delete(r.correlationId),r;if(!i)throw Error(`E2E relay session not established`);if(!et(r))throw Error(`Received plaintext message on relay E2E channel — possible injection`);return nt(r,i)}}}function ot(e,t,n=!1){let r=new Map;return{codec:$(e,n,r,t),reset:()=>r.clear()}}function st(e){let{e2eAuth:t,registry:n,websocket:r,...i}=e,a=e.debug??!1,o=new Map,s=$(t,a,o,n);a&&console.info(`[E2ERelayTransport] Creating inner transport...`);let c=new b({...i,url:`<pre-connected>`,createWebSocket:()=>r,auth:t,codec:s,autoReconnect:!1});return a&&console.info(`[E2ERelayTransport] Inner transport created`),{name:c.name,connect:async()=>{if(!n.isFrozen())throw Error(`E2ERelayClientTransport: registry must be frozen before connect()`);o.clear();try{await c.connect()}catch(e){throw o.clear(),e}},disconnect:async()=>{o.clear();try{await c.disconnect()}finally{o.clear()}},send:c.send.bind(c),cancelRequest:c.cancelRequest.bind(c),onReceive:(...e)=>(a&&console.info(`[E2ERelayTransport] onReceive called, delegating to inner transport`),c.onReceive(...e)),subscribe:c.subscribe.bind(c),unsubscribe:c.unsubscribe.bind(c),getSubscriptions:c.getSubscriptions.bind(c),isReady:()=>!!t.getSessionKey()&&c.isReady()}}function ct(){let e=!1,t=new Map,n=new Map,r=()=>{if(e)throw Error(`RelayControlRegistry is frozen and cannot be modified`)};return{registerEventSubjects(e,n){r();let i=t.get(e)??new Set;for(let e of n)i.add(e);t.set(e,i)},registerRequestNamespace(e,t){if(r(),t.length===0)throw Error(`RelayControlRegistry request namespace "${e}" requires at least one subject`);let i=n.get(e)??new Set;for(let e of t)i.add(e);n.set(e,i)},freeze(){e=!0},isFrozen(){return e},isControlEvent(e,n){return t.get(e)?.has(n)??!1},isControlRequest(e,t){return n.get(e)?.has(t)??!1}}}function lt(e){if(be(e),e.mode===`client`){if(e.connectionOptions!==void 0)throw Error(`createWebSocketTransport(client) does not support connectionOptions when wrapping a pre-created WebSocket. Use WebSocketClientTransport for reconnect or dial-time socket options.`);let t=e.websocket;return new b({url:`<pre-connected>`,createWebSocket:()=>t,auth:e.auth,debug:e.debug,autoReconnect:!1})}else return new C({websocket:e.websocket,auth:e.auth,debug:e.debug})}export{Ve as DispatchingAuth,ze as E2EAuth,Be as E2ERelayAuth,Ce as HmacAuth,C as ServerTransport,b as WebSocketClientTransport,$e as createE2EClientTransport,st as createE2ERelayClientTransport,ot as createE2ERelayCodec,rt as createRelayControlHelpers,ct as createRelayControlRegistry,ye as createWebSocketCloseEvent,lt as createWebSocketTransport,Ie as crypto,h as extractSocketErrorMessage};
+import{r as e}from"../../chunk-DTipWd-i.mjs";import{CorrelationTracker as t,DEFAULT_REQUEST_TIMEOUT_MS as n,NoHandlerError as r,TimeoutError as i,buildSubscribeMessage as a,buildUnsubscribeMessage as o,deserializeTransportError as s,getSubjectFromBusMessage as c,handleCorrelationResponse as l,isNoHandlerErrorForSubject as u,shouldReceiveMessage as d,trackMessageCorrelation as f}from"@makaio/framework/bus";import{isRecord as p}from"@makaio/framework/utils";const m={baseMs:1e3,maxMs:1e4};function ee(e,t,n){let r=Math.max(t,100),i=Math.max(n,r);return Math.min(r*2**e,i)}function te(e,t){return new Promise(n=>{if(t.aborted){n();return}let r=()=>{clearTimeout(i),t.removeEventListener(`abort`,r),n()},i=setTimeout(()=>{t.removeEventListener(`abort`,r),n()},e);t.addEventListener(`abort`,r)})}const ne={encode:async e=>JSON.stringify(e),decode:async e=>e};function re(e){return e===!1?!1:{baseMs:e?.baseMs??m.baseMs,maxMs:e?.maxMs??m.maxMs}}function h(e,t=`unknown error`){return`message`in e?String(e.message):t}async function g(e,t,n){let r=await t.encode(e);n.send(r)}function ie(e){return e.readyState===1?Promise.resolve():e.readyState>=2?Promise.reject(Error(`WebSocket closed before opening`)):new Promise((t,n)=>{let r=()=>{e.removeEventListener(`open`,i),e.removeEventListener(`error`,a),e.removeEventListener(`close`,o)},i=()=>{r(),t()},a=e=>{r(),n(Error(`WebSocket connection failed — ${h(e)}`))},o=()=>{r(),n(Error(`WebSocket closed before opening`))};e.addEventListener(`open`,i),e.addEventListener(`error`,a),e.addEventListener(`close`,o)})}async function ae(e,t,n){let r=await Promise.allSettled(Array.from(t).map(t=>t(e,n.receiveContext)));for(let e of r)e.status===`rejected`&&n.debug&&console.error(`[WebSocketClientTransport:${n.name}] Handler error:`,e.reason);return r.every(e=>e.status===`fulfilled`)}function oe(e,t){return{...t?.getReceiveContext?.(),transportName:e}}async function se(e,t){let{name:n,debug:r,auth:i,codec:a,messageTransform:o,correlations:s,handlers:c}=t;try{let u=JSON.parse(e.toString());if(typeof u!=`object`||!u||typeof u.type!=`string`){r&&console.error(`[WebSocketClientTransport:${n}] Invalid message structure:`,u);return}let d=u;if(i?.handleAuthMessage(d)||d.type===`heartbeat`)return;let f=await a.decode(d);if(o&&(f=await o(f)),f.type===`heartbeat`)return;if(f.type===`subscribe-sync-complete`){t.onSyncComplete();return}if(f.type===`subscription-ack`){typeof f.ackId==`string`&&t.onSubscriptionAck(f.ackId);return}if(l(f,s))return;let p=oe(n,i);await ae(f,c,{debug:r,name:n,receiveContext:p})&&(f.type===`subscribe`||f.type===`unsubscribe`)&&typeof f.ackId==`string`&&await t.sendSubscriptionAck(f.ackId)}catch(e){r&&console.error(`[WebSocketClientTransport:${n}] Failed to parse message:`,e)}}function ce(e,t){let n=n=>{se(n.data,{name:t.name,debug:t.debug,auth:t.auth,codec:t.codec,messageTransform:t.messageTransform,correlations:t.correlations,handlers:t.handlers,onSyncComplete:()=>{t.resolveReady()},onSubscriptionAck:e=>{t.resolveSubscriptionAck(e)},sendSubscriptionAck:async n=>{e.readyState===1&&await g({type:`subscription-ack`,ackId:n},t.codec,e)}})};t.setMessageListener(n),e.addEventListener(`message`,n)}function _(e,t){let n=t.getMessageListener();n!==null&&(e.removeEventListener(`message`,n),t.setMessageListener(null));let r=t.getCloseListener();r!==null&&(e.removeEventListener(`close`,r),t.setCloseListener(null))}async function v(e){e.resolveReady(),e.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: reconnecting before subscription ack`)),e.resetReadyPromise();let t=e.getSocket();t!==null&&_(t,e);let n=await e.wsFactory(e.url);e.setSocket(n),e.setAuthComplete(!1);try{ce(n,e),await ie(n),e.auth&&await e.auth.authenticateClient(e=>{if(n.readyState!==1)throw Error(`WebSocketClientTransport: cannot send auth message — socket not open`);n.send(JSON.stringify(e))}),e.setAuthComplete(!0),e.debug&&console.info(`[WebSocketClientTransport:${e.name}] Connected to ${e.url}`),e.localSubscriptions.size>0&&(await g(a(e.localSubscriptions),e.codec,n),e.debug&&console.info(`[WebSocketClientTransport:${e.name}] Replayed ${e.localSubscriptions.size} subscription(s)`)),e.notifyConnected()}catch(t){let r=e.getSocket()===n;throw r&&e.auth?.cleanup(),_(n,e),r&&e.setSocket(null),e.setAuthComplete(!1),r&&(n.readyState===0||n.readyState===1)&&n.close(),t}}function y(e,t){return new Promise(n=>{if(e.readyState===3||t.aborted){n();return}let r=()=>{t.removeEventListener(`abort`,i),n()},i=()=>{e.removeEventListener(`close`,r),n()};e.addEventListener(`close`,r),t.addEventListener(`abort`,i)})}async function le(e,t,n,r,i){i(!0);try{for(;!e.aborted;){let i=n.getSocket(),a=i!==null;if(i!==null&&i.readyState!==3&&await y(i,e),e.aborted)break;a&&(n.debug&&console.info(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Connection lost, starting reconnect loop (maxMs=${t.maxMs})`),n.notifyDisconnected());let o=0;for(;!e.aborted;){let i=ee(o,t.baseMs,t.maxMs);n.debug&&console.info(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Reconnecting in ${i}ms (attempt ${o+1})`);let a=new AbortController;if(r(a),await te(i,AbortSignal.any([e,a.signal])),r(null),e.aborted)break;try{await v(n),o=0;let t=n.getSocket();if(t!==null){let r=()=>{n.auth?.cleanup(),n.setAuthComplete(!1),n.debug&&console.info(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Connection closed`),n.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: disconnected before subscription ack`))};n.setCloseListener(r),t.addEventListener(`close`,r),await y(t,e)}break}catch(e){if(n.debug){let t=e instanceof Error?e.message:String(e);console.warn(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Connect attempt ${o+1} failed: ${t}`)}o++}}}}finally{i(!1)}}function ue(e,t,n){let r=()=>{t.auth?.cleanup(),_(e,t),t.setAuthComplete(!1),t.setSocket(null),n(),t.resolveReady(),t.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: disconnected before subscription ack`)),t.notifyDisconnected()};t.setCloseListener(r),e.addEventListener(`close`,r)}async function de(e,t,n,r){let i=r.localSubscriptions.get(e)?.filter,o=t??i;if(r.localSubscriptions.set(e,{filter:o,priorities:n}),r.socket!==null&&r.socket.readyState===1){let t=r.beginSubscriptionAck?.(),i=a(new Map([[e,{filter:o,priorities:n}]]),t?.ackId);try{await g(i,r.codec,r.socket),await t?.promise}catch(e){throw t?.reject(e),e}}r.debug&&console.info(`[WebSocketClientTransport:${r.name}] Subscribed to ${e}${o?` with filter`:``}`)}async function fe(e,t){let n=t.localSubscriptions.get(e);if(t.localSubscriptions.delete(e),t.socket!==null&&t.socket.readyState===1){let r=t.beginSubscriptionAck?.(),i=o({[e]:n?.priorities??[]},r?.ackId);try{await g(i,t.codec,t.socket),await r?.promise}catch(e){throw r?.reject(e),e}}t.debug&&console.info(`[WebSocketClientTransport:${t.name}] Unsubscribed from ${e}`)}var b=class{name;url;auth;codec;messageTransform;autoReconnectConfig;wsFactory;debug;onConnectedCallback;onDisconnectedCallback;socket=null;authComplete=!1;correlations=new t;handlers=new Set;localSubscriptions=new Map;pendingSubscriptionAcks=new Map;subscriptionAckSeq=0;messageListener=null;closeListener=null;reconnectAbort=null;backoffWakeAbort=null;reconnectLoopRunning=!1;readyResolve=null;ready;onNewReadySession=void 0;onConnected=void 0;onDisconnected=void 0;constructor(e){this.url=e.url,this.name=e.name??`ws-client`,this.auth=e.auth,this.codec=e.codec??ne,this.messageTransform=e.messageTransform,this.debug=e.debug??!1,this.autoReconnectConfig=re(e.autoReconnect),this.wsFactory=e.createWebSocket??this.defaultWsFactory,this.onConnectedCallback=e.onConnected,this.onDisconnectedCallback=e.onDisconnected,this.ready=new Promise(e=>{this.readyResolve=e})}async connect(){if(this.reconnectAbort!==null)throw Error(`WebSocketClientTransport: already connected`);let e=new AbortController;this.reconnectAbort=e;try{await v(this.connectionDeps())}catch(e){throw this.reconnectAbort=null,e}this.autoReconnectConfig===!1?this.socket!==null&&this.wireNoReconnectClose(this.socket):this.startReconnectLoop(e.signal)}async disconnect(){let e=this.reconnectAbort;if(this.reconnectAbort=null,e?.abort(),this.readyResolve?.(),this.readyResolve=null,this.socket!==null){_(this.socket,this.connectionDeps());let e=this.socket;this.socket=null,this.authComplete=!1,(e.readyState===0||e.readyState===1)&&e.close()}this.correlations.cleanup(),this.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: disconnected before subscription ack`)),this.auth?.cleanup(),this.handlers.clear(),this.debug&&console.info(`[WebSocketClientTransport:${this.name}] Disconnected`)}async send(e,t){if(this.socket===null||this.socket.readyState!==1)throw Error(`WebSocketClientTransport: not connected`);let r=await this.codec.encode(e);return this.socket.send(r),f(e,this.correlations,t??n)}onReceive(e){return this.handlers.add(e),()=>{this.handlers.delete(e)}}async subscribe(e,t,n=[]){await de(e,t,n,this.subscriptionDeps())}async unsubscribe(e){await fe(e,this.subscriptionDeps())}getSubscriptions(){return new Set(this.localSubscriptions.keys())}cancelRequest(e,t){this.correlations.cancel(e,t)}isReady(){return this.socket!==null&&this.socket.readyState===1&&this.authComplete}async reconnect(){if(!this.isReady()){if(this.backoffWakeAbort!==null){this.backoffWakeAbort.abort(),this.backoffWakeAbort=null;return}if(this.autoReconnectConfig!==!1){if(this.reconnectLoopRunning)return;this.reconnectAbort!==null&&this.startReconnectLoop(this.reconnectAbort.signal);return}try{await v(this.connectionDeps()),this.socket!==null&&(this.reconnectAbort=new AbortController,this.wireNoReconnectClose(this.socket))}catch{}}}startReconnectLoop(e){return le(e,this.autoReconnectConfig,this.connectionDeps(),e=>{this.backoffWakeAbort=e},e=>{this.reconnectLoopRunning=e})}subscriptionDeps(){return{name:this.name,debug:this.debug,codec:this.codec,socket:this.socket,localSubscriptions:this.localSubscriptions,beginSubscriptionAck:()=>this.beginSubscriptionAck()}}beginSubscriptionAck(){let e=`${this.name}:sub:${++this.subscriptionAckSeq}`,t,n,r=new Promise((e,r)=>{t=e,n=r});r.catch(()=>void 0);let i=t=>{this.pendingSubscriptionAcks.has(e)&&(this.pendingSubscriptionAcks.delete(e),t())};return this.pendingSubscriptionAcks.set(e,{resolve:()=>i(t),reject:e=>i(()=>n(e))}),{ackId:e,promise:r,reject:t=>this.rejectSubscriptionAck(e,t)}}resolveSubscriptionAck(e){this.pendingSubscriptionAcks.get(e)?.resolve()}rejectSubscriptionAck(e,t){this.pendingSubscriptionAcks.get(e)?.reject(t)}rejectPendingSubscriptionAcks(e){for(let t of this.pendingSubscriptionAcks.keys())this.rejectSubscriptionAck(t,e)}connectionDeps(){return{name:this.name,debug:this.debug,auth:this.auth,codec:this.codec,messageTransform:this.messageTransform,correlations:this.correlations,handlers:this.handlers,localSubscriptions:this.localSubscriptions,wsFactory:this.wsFactory,url:this.url,getSocket:()=>this.socket,setSocket:e=>{this.socket=e},setAuthComplete:e=>{this.authComplete=e},getMessageListener:()=>this.messageListener,setMessageListener:e=>{this.messageListener=e},getCloseListener:()=>this.closeListener,setCloseListener:e=>{this.closeListener=e},resolveReady:()=>{this.readyResolve?.(),this.readyResolve=null},resetReadyPromise:()=>{this.ready=new Promise(e=>{this.readyResolve=e}),this.onNewReadySession?.(this.ready)},resolveSubscriptionAck:e=>{this.resolveSubscriptionAck(e)},rejectPendingSubscriptionAcks:e=>{this.rejectPendingSubscriptionAcks(e)},notifyConnected:()=>{this.onConnectedCallback?.(),this.onConnected?.()},notifyDisconnected:()=>{this.onDisconnectedCallback?.(),this.onDisconnected?.()}}}defaultWsFactory=async e=>new(await(import(`ws`))).WebSocket(e);wireNoReconnectClose(e){ue(e,this.connectionDeps(),()=>{this.reconnectAbort=null})}};function x(e){e.timer!==void 0&&clearTimeout(e.timer)}var pe=class{pendingBroadcasts=new Map;timeout;debug;constructor(e={}){this.timeout=e.timeout??5e3,this.debug=e.debug??!1}startClientBroadcast(e,t,n,r,i){let a=t.correlationId,o=i??this.timeout,s={kind:`client`,sender:e,results:[],pendingClients:new Set(n),nodeResultsReceived:!1,timer:o===0?void 0:setTimeout(()=>{this.debug&&console.warn(`[BroadcastAggregator] Broadcast ${a} timed out`),this.finalizeBroadcast(a)},o)};this.pendingBroadcasts.set(a,s);let c=JSON.stringify(t);for(let e of n)r(e,c);this.debug&&console.info(`[BroadcastAggregator] Broadcast ${a} forwarded to ${n.length} clients`)}startServerBroadcast(e,t,n,r){let i=e.correlationId,a=r??this.timeout;return t.length===0?(this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${i} - no target clients`),Promise.resolve([])):new Promise(r=>{let o={kind:`server`,results:[],pendingClients:new Set(t),timer:a===0?void 0:setTimeout(()=>{this.debug&&console.warn(`[BroadcastAggregator] Server broadcast ${i} timed out`),this.finalizeServerBroadcast(i)},a),resolve:r};this.pendingBroadcasts.set(i,o);let s=JSON.stringify(e);for(let e of t)n(e,s);this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${i} sent to ${t.length} clients`)})}handleResponse(e,t){let n=this.pendingBroadcasts.get(t.correlationId);return n?(t.results&&n.results.push(...t.results),n.pendingClients.delete(e),this.debug&&console.info(`[BroadcastAggregator] Broadcast ${t.correlationId} got response, ${n.pendingClients.size} pending`),this.checkBroadcastComplete(t.correlationId,n),!0):!1}handleNodeResults(e,t,n){let r=this.pendingBroadcasts.get(e);return!r||r.kind!==`client`?!1:(r.results.push(...t),r.nodeResultsReceived=!0,r.nodeError=n,this.debug&&console.info(`[BroadcastAggregator] Broadcast ${e} node results aggregated${n?` (with error)`:``}`),this.checkBroadcastComplete(e,r),!0)}handleClientDisconnect(e){for(let[t,n]of this.pendingBroadcasts)n.kind===`client`&&n.sender===e?(x(n),this.pendingBroadcasts.delete(t)):n.pendingClients.has(e)&&(n.pendingClients.delete(e),this.checkBroadcastComplete(t,n))}cleanup(){for(let e of this.pendingBroadcasts.values())x(e),e.kind===`server`&&e.resolve(e.results);this.pendingBroadcasts.clear()}checkBroadcastComplete(e,t){if(!(t.pendingClients.size>0))if(t.kind===`client`){if(!t.nodeResultsReceived)return;this.finalizeBroadcast(e)}else this.finalizeServerBroadcast(e)}finalizeBroadcast(e){let t=this.pendingBroadcasts.get(e);if(!t||t.kind!==`client`)return;x(t),this.pendingBroadcasts.delete(e);let n=t.nodeError?{type:`broadcast-response`,correlationId:e,error:t.nodeError}:{type:`broadcast-response`,correlationId:e,results:t.results};t.sender.readyState===1&&t.sender.send(JSON.stringify(n)),this.debug&&console.info(`[BroadcastAggregator] Broadcast ${e} finalized with ${t.results.length} results`)}finalizeServerBroadcast(e){let t=this.pendingBroadcasts.get(e);!t||t.kind!==`server`||(x(t),this.pendingBroadcasts.delete(e),t.resolve(t.results),this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${e} finalized with ${t.results.length} results`))}},me=class{clients=new Set;authenticatingClients=new Set;clientSubscriptions=new Map;clientFilters=new Map;debug;constructor(e={}){this.debug=e.debug??!1}addAuthenticating(e){this.authenticatingClients.add(e)}removeAuthenticating(e){this.authenticatingClients.delete(e)}isAuthenticating(e){return this.authenticatingClients.has(e)}addClient(e){this.clients.add(e)}removeClient(e){this.clients.delete(e),this.authenticatingClients.delete(e),this.clientSubscriptions.delete(e),this.clientFilters.delete(e),this.debug&&console.info(`[ClientRegistry] Client removed (${this.clients.size} remaining)`)}get size(){return this.clients.size}getAllSockets(){return new Set([...this.clients,...this.authenticatingClients])}handleSubscribeMessage(e,t){let n=this.clientSubscriptions.get(e);n||(n=new Set,this.clientSubscriptions.set(e,n));let r=this.clientFilters.get(e);for(let[i]of Object.entries(t.subjects)){n.add(i);let a=t.filters?.[i];a===void 0?r?.delete(i):(r||(r=new Map,this.clientFilters.set(e,r)),r.set(i,a))}if(this.debug){let e=Object.keys(t.subjects).length,n=t.filters?Object.keys(t.filters).length:0;console.info(`[ClientRegistry] Client subscribed to ${e} subjects, ${n} filters`)}}handleUnsubscribeMessage(e,t){let n=this.clientSubscriptions.get(e),r=this.clientFilters.get(e);for(let e of Object.keys(t))n?.delete(e),r?.delete(e);this.debug&&console.info(`[ClientRegistry] Client unsubscribed from ${Object.keys(t).length} subjects`)}getReadyClients(){let e=[];for(let t of this.clients)t.readyState===1&&e.push(t);return e}getRequestRoutingPriority(e,t,n){let r=this.clientSubscriptions.get(e);return!r||r.size===0?1:this.clientWantsMessage(e,t,n)?2:0}getInterestedClients(e,t,n){let r=[];for(let i of this.clients)i!==n&&i.readyState===1&&this.clientWantsMessage(i,e,t)&&r.push(i);return r}forwardEventToClients(e,t,n){let r=c(t)??void 0,i=`payload`in t?t.payload:void 0,a=JSON.stringify(t),o=this.getInterestedClients(r,i,e);for(let e of o)n(e,a)}clientWantsMessage(e,t,n){return d(t,n,this.clientSubscriptions.get(e)??new Set,this.clientFilters.get(e)??new Map)}};async function S(e,t,n){let r=await Promise.allSettled(Array.from(t).map(t=>t(e,n.receiveContext)));for(let e of r)if(e.status===`rejected`&&n.debug){let t=n.logContext?` ${n.logContext}`:``;console.error(`[ServerTransport] Handler error${t}:`,e.reason)}return r.every(e=>e.status===`fulfilled`)}function he(e,t,n){let{correlations:r,broadcastAggregator:i,debug:a}=t;if(e.type===`heartbeat`)return!0;if(e.type===`response`){let t=e;return typeof t.correlationId==`string`?(t.error?r.reject(t.correlationId,s(t.error)):r.resolve(t.correlationId,t.result),!0):(a&&console.warn(`[ServerTransport] Malformed response message: missing correlationId`),!0)}if(e.type===`broadcast-response`){let t=e;return typeof t.correlationId==`string`?(i.handleResponse(n,t),!0):(a&&console.warn(`[ServerTransport] Malformed broadcast-response: missing correlationId`),!0)}return!1}async function ge(e,t,n){let{registry:r,broadcastAggregator:i,handlers:a,normalizeBroadcastTimeout:o,sendSafely:s,debug:c}=n;if(he(e,n,t))return;let l=n.auth?.getReceiveContext?.(t);if(e.type===`subscribe`){let n=e;if(!p(n.subjects)){c&&console.warn(`[ServerTransport] Malformed subscribe message: missing subjects record`);return}r.handleSubscribeMessage(t,n),await S(n,a,{debug:c,receiveContext:l,logContext:`dispatching subscribe`})&&typeof n.ackId==`string`&&s(t,JSON.stringify({type:`subscription-ack`,ackId:n.ackId}));return}if(e.type===`unsubscribe`){let n=e;if(!p(n.subjects)){c&&console.warn(`[ServerTransport] Malformed unsubscribe message: missing subjects record`);return}r.handleUnsubscribeMessage(t,n.subjects),await S(n,a,{debug:c,receiveContext:l,logContext:`dispatching unsubscribe`})&&typeof n.ackId==`string`&&s(t,JSON.stringify({type:`subscription-ack`,ackId:n.ackId}));return}if(e.type===`broadcast`){let n=e;if(typeof n.correlationId!=`string`||typeof n.subject!=`string`){c&&console.warn(`[ServerTransport] Malformed broadcast message: missing correlationId or subject`);return}let u=r.getInterestedClients(n.subject,n.payload,t),d=o(n.timeout);i.startClientBroadcast(t,n,u,s,d),await S(e,a,{debug:c,receiveContext:l});return}e.type===`event`&&r.forwardEventToClients(t,e,s),await S(e,a,{debug:c,receiveContext:l})}function _e(e,t){let{auth:n,registry:r,debug:i}=t;return async a=>{let o;try{o=JSON.parse(a.toString())}catch(e){i&&console.error(`[ServerTransport] Failed to parse message:`,e);return}let s=o&&typeof o==`object`?o:void 0;if(!s||typeof s.type!=`string`){i&&console.error(`[ServerTransport] Invalid message structure:`,o);return}let c=o;try{if(n?.handleAuthMessage(c,e))return;if(n&&r.isAuthenticating(e)){i&&console.warn(`[ServerTransport] Ignoring message from unauthenticated client`);return}if(n?.isSocketAuthenticated?.(e)===!1){i&&console.warn(`[ServerTransport] Closing socket with expired authentication`),n.cleanupSocket(e),e.close(1008,`Authentication expired`);return}await ge(c,e,t)}catch(e){i&&console.error(`[ServerTransport] Failed to process message:`,e)}}}function ve(e){return typeof e!=`number`||!Number.isFinite(e)||e<=0?5e3:Math.min(e,6e4)}async function ye(e,t){let{registry:n,correlations:r,broadcastAggregator:i,handlers:o,auth:s,serverSubscriptions:c,sendSafely:l,debug:u}=t;s&&n.addAuthenticating(e);let d=_e(e,{registry:n,correlations:r,broadcastAggregator:i,handlers:o,auth:s,normalizeBroadcastTimeout:ve,sendSafely:l,debug:u}),f=e=>{d(e.data)},p=()=>{s?.cleanupSocket(e),n.removeClient(e),e.removeEventListener(`message`,f),e.removeEventListener(`close`,p),e.removeEventListener(`error`,m),i.handleClientDisconnect(e),u&&console.info(`[ServerTransport] Client disconnected (${n.size} remaining)`)},m=e=>{u&&console.error(`[ServerTransport] Client socket error:`,e)};e.addEventListener(`message`,f),e.addEventListener(`close`,p),e.addEventListener(`error`,m);try{if(s&&(await s.authenticateServer(e,t=>{if(e.readyState!==1)throw Error(`Cannot send auth message: socket not ready (state: ${e.readyState})`);e.send(JSON.stringify(t))}),n.removeAuthenticating(e)),e.readyState!==1)return;if(n.addClient(e),c.size>0){let t=a(c);l(e,JSON.stringify(t))}l(e,JSON.stringify({type:`subscribe-sync-complete`})),u&&console.info(`[ServerTransport] Client connected (${n.size} total)`)}catch(t){u&&console.error(`[ServerTransport] Client authentication failed:`,t),e.close(1008,`Authentication failed`)}}async function be(e,t,n){let{registry:a,correlations:o}=n,s=`${e.namespace}.${e.subject}`,c=a.getReadyClients().map(t=>({client:t,priority:a.getRequestRoutingPriority(t,s,e.payload)})).sort((e,t)=>t.priority-e.priority).map(({client:e})=>e);if(c.length===0)throw new r(s);for(let[n,r]of c.entries()){let a=`${e.correlationId}:attempt-${n+1}`,c={...e,correlationId:a};try{r.send(JSON.stringify(c))}catch{continue}try{return await o.track(a,t)}catch(e){if(u(e,s)||e instanceof i)continue;throw e}}throw new r(s)}var C=class{name;wss;auth;debug;handlers=new Set;registry;serverSubscriptions=new Map;broadcastAggregator;correlations=new t;connectionListener=null;constructor(e){let{websocket:t,name:n=`websocket`,auth:r,debug:i=!1}=e;this.wss=t,this.name=n,this.auth=r,this.debug=i,this.registry=new me({debug:i}),this.broadcastAggregator=new pe({debug:i})}sendToClientSafely(e,t){try{e.send(t)}catch(e){this.debug&&console.warn(`[ServerTransport] Failed to send message to client:`,e)}}async connect(){if(this.connectionListener!==null)throw Error(`ServerTransport.connect() called while already connected`);this.connectionListener=e=>{ye(e,{registry:this.registry,correlations:this.correlations,broadcastAggregator:this.broadcastAggregator,handlers:this.handlers,auth:this.auth,serverSubscriptions:this.serverSubscriptions,sendSafely:(e,t)=>this.sendToClientSafely(e,t),debug:this.debug})},this.wss.on(`connection`,this.connectionListener),this.debug&&console.info(`[ServerTransport] Listening for connections`)}async disconnect(){this.connectionListener&&=(this.wss.off(`connection`,this.connectionListener),null);let e=this.registry.getAllSockets();for(let t of e)t.close();await new Promise((e,t)=>{this.wss.close(n=>n?t(n):e())}),this.correlations.cleanup(),this.broadcastAggregator.cleanup(),this.auth?.cleanup(),this.handlers.clear(),this.serverSubscriptions.clear(),this.debug&&console.info(`[ServerTransport] Disconnected`)}async send(e,t){if(e.type===`broadcast`){let n=c(e)??void 0,r=`payload`in e?e.payload:void 0,i=this.registry.getInterestedClients(n,r);return this.broadcastAggregator.startServerBroadcast(e,i,(e,t)=>{this.sendToClientSafely(e,t)},t)}if(e.type===`request`)return be(e,t??n,{registry:this.registry,correlations:this.correlations});if(this.registry.size===0){if(this.debug){let t=c(e);console.debug(`[ServerTransport] No clients to receive ${e.type}${t?`: ${t}`:``}`)}return!1}let r=c(e)??void 0,i=`payload`in e?e.payload:void 0,a=JSON.stringify(e),o=this.registry.getInterestedClients(r,i);for(let e of o)this.sendToClientSafely(e,a);let s=o.length>0;if(!s){if(r&&this.debug&&console.warn(`[ServerTransport] No interested clients for subject: ${r}`),e.type===`response`)return!1;if(!r)throw Error(`No connected clients available to receive message`)}return s}onReceive(e){return this.handlers.add(e),()=>{this.handlers.delete(e)}}cancelRequest(e,t){this.correlations.cancel(e,t)}onBroadcastResults(e,t,n){this.broadcastAggregator.handleNodeResults(e,t,n)}async subscribe(e,t,n=[]){let r=this.serverSubscriptions.get(e)?.filter,i=t??r;if(this.serverSubscriptions.set(e,{filter:i,priorities:n}),this.registry.size>0){let t=a(new Map([[e,{filter:i,priorities:n}]])),r=JSON.stringify(t);for(let e of this.registry.getReadyClients())this.sendToClientSafely(e,r)}}getConnectionCount(){return this.registry.getReadyClients().length}async unsubscribe(e){if(this.serverSubscriptions.delete(e),this.registry.size>0){let t=o({[e]:[]}),n=JSON.stringify(t);for(let e of this.registry.getReadyClients())this.sendToClientSafely(e,n)}}};function xe(e,t){let n=new Event(`close`);return Object.defineProperties(n,{code:{value:e??1e3,enumerable:!0},reason:{value:t??``,enumerable:!0}}),n}function Se(e){if(typeof e!=`object`||!e)throw TypeError(`WebSocket transport options must be an object`);let t=e;if(t.mode!==`client`&&t.mode!==`server`)throw TypeError(`WebSocket transport mode must be "client" or "server"`);if(t.mode===`client`){if(!Ce(t.websocket))throw TypeError(`WebSocket transport client mode requires a websocket with addEventListener/removeEventListener`);return}if(!we(t.websocket))throw TypeError(`WebSocket transport server mode requires a websocket with on/off listener methods`)}function Ce(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.send==`function`&&typeof t.close==`function`&&typeof t.addEventListener==`function`&&typeof t.removeEventListener==`function`}function we(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.on==`function`&&typeof t.off==`function`&&typeof t.close==`function`}var Te=class{secret;algorithm;challengeTimeout;identityId;resolveSecret;resolvePeer;pendingChallenge;pendingResult;queuedChallengeNonce;queuedResult;clientAuthComplete=!1;serverPendingResponses=new Map;serverAuthenticatedSockets=new Set;serverAuthenticatedPeers=new Map;constructor(e){this.secret=e.secret,this.algorithm=e.algorithm??`sha256`,this.challengeTimeout=e.challengeTimeout??5e3,this.identityId=e.identityId,this.resolveSecret=e.resolveSecret,this.resolvePeer=e.resolvePeer}async authenticateServer(e,t){let n=crypto.getRandomValues(new Uint8Array(32)),r=Array.from(n).map(e=>e.toString(16).padStart(2,`0`)).join(``),i=await this.computeHmac(r);t({type:`auth-challenge`,nonce:r});let a=!1;try{let{signature:n,identityId:o}=await this.waitForAuthResponseWithIdentity(e),s;if(this.resolveSecret&&o!==void 0){let i=this.resolveSecret(o);if(i===null)throw this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!1,error:`Unknown identity`}),a=!0,Error(`HMAC authentication failed: Unknown identity '${o}'`);s=await this.computeHmacWithSecret(r,i),this.constantTimeEqual(n,s)&&this.serverAuthenticatedPeers.set(e,o)}else s=i;if(!this.constantTimeEqual(n,s))throw this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!1,error:`Invalid signature`}),a=!0,Error(`HMAC authentication failed: Invalid signature`);this.serverAuthenticatedSockets.add(e),this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!0}),a=!0}catch(n){let r=this.serverPendingResponses.has(e);throw this.serverPendingResponses.delete(e),!a&&r&&this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!1,error:n instanceof Error?n.message:`Authentication failed`}),n}finally{this.serverPendingResponses.delete(e)}}async authenticateClient(e){this.clientAuthComplete=!1;let t=await this.waitForAuthChallenge();e({type:`auth-response`,signature:await this.computeHmac(t),...this.identityId!==void 0&&{identityId:this.identityId}});let n=await this.waitForAuthResult();if(!n.success)throw Error(`HMAC authentication failed: ${n.error??`Unknown error`}`);this.clientAuthComplete=!0}handleAuthMessage(e,t){if(typeof e!=`object`||!e||!(`type`in e)||typeof e.type!=`string`)return!1;let n=e;if(n.type===`auth-challenge`)return typeof n.nonce!=`string`||this.clientAuthComplete||(this.pendingChallenge?(clearTimeout(this.pendingChallenge.timeoutHandle),this.pendingChallenge.resolve(n.nonce),this.pendingChallenge=void 0):this.queuedChallengeNonce=n.nonce),!0;if(n.type===`auth-result`){if(typeof n.success!=`boolean`||this.clientAuthComplete)return!0;let e={success:n.success,error:n.error};return this.pendingResult?(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.resolve(e),this.pendingResult=void 0):this.queuedResult=e,!0}if(n.type===`auth-response`){if(t){let e=this.serverPendingResponses.get(t);e&&(clearTimeout(e.timeoutHandle),e.resolve({signature:n.signature,identityId:n.identityId}))}return!0}return!1}async waitForAuthChallenge(){if(this.queuedChallengeNonce!==void 0){let e=this.queuedChallengeNonce;return this.queuedChallengeNonce=void 0,e}return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingChallenge=void 0,t(Error(`Authentication challenge timeout`))},this.challengeTimeout);this.pendingChallenge={resolve:e,reject:t,timeoutHandle:n}})}async waitForAuthResponseWithIdentity(e){return new Promise((t,n)=>{let r={resolve:t,reject:n,timeoutHandle:setTimeout(()=>{n(Error(`Authentication response timeout`))},this.challengeTimeout)};this.serverPendingResponses.set(e,r)})}async waitForAuthResult(){if(this.queuedResult!==void 0){let e=this.queuedResult;return this.queuedResult=void 0,e}return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingResult=void 0,t(Error(`Authentication result timeout`))},this.challengeTimeout);this.pendingResult={resolve:e,reject:t,timeoutHandle:n}})}async computeHmac(e){return this.computeHmacWithSecret(e,this.secret)}async computeHmacWithSecret(e,t){let n=new TextEncoder,r=n.encode(t),i=this.algorithm.replace(/^sha/,`SHA-`),a=await crypto.subtle.importKey(`raw`,r,{name:`HMAC`,hash:i},!1,[`sign`]),o=await crypto.subtle.sign(`HMAC`,a,n.encode(e));return Array.from(new Uint8Array(o)).map(e=>e.toString(16).padStart(2,`0`)).join(``)}getReceiveContext(e){if(!e)return;let t=this.serverAuthenticatedPeers.get(e);if(t===void 0)return;let n=this.resolvePeer?.(t);if(this.resolvePeer!==void 0&&n===null)return;let r=n??{kind:`workflow-execution`,id:t};return{transportName:``,peer:{...r,id:r.id??t,authenticated:!0}}}isSocketAuthenticated(e){if(!this.serverAuthenticatedSockets.has(e))return!1;if(!this.resolveSecret)return!0;let t=this.serverAuthenticatedPeers.get(e);return t===void 0?!0:this.resolveSecret(t)===null?(this.cleanupSocket(e),!1):!0}constantTimeEqual(e,t){if(e.length!==t.length)return!1;let n=new Uint8Array(e.length/2),r=new Uint8Array(t.length/2);for(let i=0;i<n.length;i++)n[i]=parseInt(e.slice(i*2,i*2+2),16),r[i]=parseInt(t.slice(i*2,i*2+2),16);let i=0;for(let e=0;e<n.length;e++)i|=n[e]^r[e];return i===0}sendAuthResultBestEffort(e,t){try{e(t)}catch{}}cleanupSocket(e){let t=this.serverPendingResponses.get(e);t&&(clearTimeout(t.timeoutHandle),this.serverPendingResponses.delete(e),t.reject(Error(`Socket disconnected during HMAC authentication`))),this.serverAuthenticatedPeers.delete(e),this.serverAuthenticatedSockets.delete(e)}cleanup(){this.pendingChallenge&&=(clearTimeout(this.pendingChallenge.timeoutHandle),void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),void 0),this.queuedChallengeNonce=void 0,this.queuedResult=void 0,this.clientAuthComplete=!1;for(let e of this.serverPendingResponses.values())clearTimeout(e.timeoutHandle);this.serverPendingResponses.clear(),this.serverAuthenticatedPeers.clear(),this.serverAuthenticatedSockets.clear()}};const w=new Map;function Ee(e,t,n={}){if(e.trim().length===0)throw Error(`registerHmacIdentitySecret requires a non-empty identityId`);if(t.length===0)throw Error(`registerHmacIdentitySecret requires a non-empty secret`);let r={secret:t,peerKind:n.peerKind?.trim()||`workflow-execution`};w.set(e,r);let i=!0;return()=>{i&&(i=!1,w.get(e)===r&&w.delete(e))}}function De(e){return w.get(e)?.secret??null}function Oe(e){let t=w.get(e);return t?{kind:t.peerKind,id:e,authenticated:!0}:null}function ke(){w.clear()}function T(e){let t=Array.from(e,e=>String.fromCharCode(e)).join(``);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``)}function E(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=(4-t.length%4)%4;t+=`=`.repeat(n);let r=atob(t),i=new Uint8Array(r.length);for(let e=0;e<r.length;e++)i[e]=r.charCodeAt(e);return i}function D(e){return new TextEncoder().encode(e)}function O(e){return new TextDecoder().decode(e)}async function k(e){let t=await crypto.subtle.exportKey(`spki`,e);return T(new Uint8Array(t))}async function A(e){let t=await crypto.subtle.exportKey(`raw`,e);return T(new Uint8Array(t))}async function j(e,t,n=[]){let r=E(e);return crypto.subtle.importKey(`spki`,r,t,!0,n)}async function M(e,t,n=[]){let r=E(e);return crypto.subtle.importKey(`raw`,r,t,!0,n)}async function N(e){let t=await crypto.subtle.exportKey(`pkcs8`,e),n=T(new Uint8Array(t)).replace(/-/g,`+`).replace(/_/g,`/`),r=(4-n.length%4)%4;return n+=`=`.repeat(r),`-----BEGIN PRIVATE KEY-----\n${n.match(/.{1,64}/g)?.join(`
+`)??n}\n-----END PRIVATE KEY-----`}async function P(e,t,n){let r=E(e.replace(/-----BEGIN PRIVATE KEY-----/,``).replace(/-----END PRIVATE KEY-----/,``).replace(/\s/g,``).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``));return crypto.subtle.importKey(`pkcs8`,r,t,!0,n)}const F={name:`ECDH`,namedCurve:`P-256`};async function I(e=!0){return crypto.subtle.generateKey(F,e,[`deriveKey`,`deriveBits`])}async function L(e){return k(e)}async function Ae(e){return A(e)}async function je(e){return M(e,F)}async function R(e,t=[]){return j(e,F,t)}async function Me(e){return N(e)}async function Ne(e){return P(e,F,[`deriveKey`,`deriveBits`])}async function z(e,t){return crypto.subtle.deriveBits({name:`ECDH`,public:t},e,256)}async function B(e,t){let n=crypto.getRandomValues(new Uint8Array(12)),r=await crypto.subtle.encrypt({name:`AES-GCM`,iv:n},e,t);return{ciphertext:new Uint8Array(r),nonce:n}}async function V(e,t,n){let r=await crypto.subtle.decrypt({name:`AES-GCM`,iv:n},e,t);return new Uint8Array(r)}async function Pe(e){return crypto.subtle.importKey(`raw`,e,{name:`AES-GCM`},!1,[`encrypt`,`decrypt`])}async function H(e,t,n){let r=await crypto.subtle.importKey(`raw`,e,{name:`HKDF`},!1,[`deriveKey`]);return crypto.subtle.deriveKey({name:`HKDF`,hash:`SHA-256`,salt:t,info:D(n)},r,{name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`])}const U={name:`ECDSA`,namedCurve:`P-256`};async function Fe(e=!0){return crypto.subtle.generateKey(U,e,[`sign`,`verify`])}async function W(e,t){let n=await crypto.subtle.sign({name:`ECDSA`,hash:{name:`SHA-256`}},e,t);return new Uint8Array(n)}async function G(e,t,n){return crypto.subtle.verify({name:`ECDSA`,hash:{name:`SHA-256`}},e,t,n)}async function Ie(e){return k(e)}async function Le(e){return j(e,U,[`verify`])}async function Re(e){return A(e)}async function ze(e){return M(e,U,[`verify`])}async function Be(e){return N(e)}async function Ve(e){return P(e,U,[`sign`])}var He=e({decodeText:()=>O,decrypt:()=>V,deriveSessionKey:()=>H,deriveSharedSecret:()=>z,encodeText:()=>D,encrypt:()=>B,exportPrivateKeyPEM:()=>Me,exportPublicKey:()=>L,exportPublicKeyRaw:()=>Ae,exportSigningPrivateKeyPEM:()=>Be,exportSigningPublicKey:()=>Ie,exportSigningPublicKeyRaw:()=>Re,fromBase64Url:()=>E,generateECDHKeyPair:()=>I,generateSigningKeyPair:()=>Fe,importAESKey:()=>Pe,importPrivateKeyPEM:()=>Ne,importPublicKey:()=>R,importPublicKeyRaw:()=>je,importSigningPrivateKeyPEM:()=>Ve,importSigningPublicKey:()=>Le,importSigningPublicKeyRaw:()=>ze,sign:()=>W,toBase64Url:()=>T,verify:()=>G});function K(e){let t=e.match(/.{1,2}/g);return new Uint8Array(t?.map(e=>parseInt(e,16))??[])}function q(e){return Array.from(e).map(e=>e.toString(16).padStart(2,`0`)).join(``)}async function J(e,t){let n=await I(!0),r=await L(n.publicKey);return{ephemeralKeyPair:n,ephemeralPublicKey:r,signature:q(await W(e,D(r+t)))}}function Ue(){return q(crypto.getRandomValues(new Uint8Array(16)))}async function Y(e,t,n,r){let i=D(t+r);return G(e,K(n),i)}async function X(e,t,n,r){return H(await z(e,await R(t)),K(n),r)}async function We(e,t,n,r){if(e===t)throw Error(`deriveRelaySaltHex: identityId must differ from peerId`);let[i,a]=e<t?[e,t]:[t,e],[o,s]=e<t?[n,r]:[r,n],c=D(`${i}${a}${o}${s}`),l=new Uint8Array(c).buffer,u=await crypto.subtle.digest(`SHA-256`,l);return q(new Uint8Array(u))}var Ge=class{signingKeyPair;identityId;peerId;getPeerSigningKey;timeout;pendingKeyExchange;pendingResult;clientSession;clientEphemeralKeyPair;serverPendingKeyExchange=new Map;serverSessions=new Map;serverEphemeralKeyPairs=new Map;constructor(e){this.signingKeyPair=e.signingKeyPair,this.identityId=e.identityId,this.peerId=e.peerId,this.getPeerSigningKey=e.getPeerSigningKey,this.timeout=e.timeout??1e4}async authenticateClient(e){if(!this.peerId)throw Error(`E2E authentication failed: peerId is required for client authentication`);let{ephemeralKeyPair:t,ephemeralPublicKey:n,signature:r}=await J(this.signingKeyPair.privateKey,this.identityId);this.clientEphemeralKeyPair=t;try{let i=this.waitForKeyExchangeResponse(),a=this.waitForAuthResult();e({type:`e2e-key-exchange`,deviceId:this.identityId,ephemeralPublicKey:n,signature:r});let o=await i,s=await this.getPeerSigningKey(this.peerId);if(!s)throw Error(`E2E authentication failed: Unknown server`);if(!await Y(s,o.ephemeralPublicKey,o.signature,this.peerId))throw Error(`E2E authentication failed: Invalid server signature`);let c=await X(t.privateKey,o.ephemeralPublicKey,o.salt,`makaio-e2e-session-v1`);this.clientSession={sessionKey:c,peerId:this.peerId};let l=await a;if(!l.success)throw Error(`E2E authentication failed: ${l.error??`Unknown error`}`)}catch(e){throw this.pendingKeyExchange&&=(clearTimeout(this.pendingKeyExchange.timeoutHandle),void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),void 0),this.clientSession=void 0,this.clientEphemeralKeyPair=void 0,e}}async authenticateServer(e,t){try{let n=await this.waitForClientKeyExchange(e),r=await this.getPeerSigningKey(n.deviceId);if(!r)throw t({type:`e2e-auth-result`,success:!1,error:`Unknown device`}),Error(`E2E authentication failed: Unknown device ${n.deviceId}`);if(!await Y(r,n.ephemeralPublicKey,n.signature,n.deviceId))throw t({type:`e2e-auth-result`,success:!1,error:`Invalid signature`}),Error(`E2E authentication failed: Invalid client signature`);let{ephemeralKeyPair:i,ephemeralPublicKey:a,signature:o}=await J(this.signingKeyPair.privateKey,this.identityId),s=Ue();this.serverEphemeralKeyPairs.set(e,i),t({type:`e2e-key-exchange-response`,ephemeralPublicKey:a,signature:o,salt:s});let c=await X(i.privateKey,n.ephemeralPublicKey,s,`makaio-e2e-session-v1`);this.serverSessions.set(e,{sessionKey:c,peerId:n.deviceId}),t({type:`e2e-auth-result`,success:!0})}catch(n){throw this.serverPendingKeyExchange.delete(e),this.serverEphemeralKeyPairs.delete(e),t({type:`e2e-auth-result`,success:!1,error:n instanceof Error?n.message:`Authentication failed`}),n}finally{this.serverPendingKeyExchange.delete(e)}}handleAuthMessage(e,t){if(typeof e!=`object`||!e||!(`type`in e)||typeof e.type!=`string`)return!1;let n=e;if(n.type===`e2e-key-exchange-response`)return this.pendingKeyExchange&&=(clearTimeout(this.pendingKeyExchange.timeoutHandle),this.pendingKeyExchange.resolve({ephemeralPublicKey:n.ephemeralPublicKey,signature:n.signature,salt:n.salt}),void 0),!0;if(n.type===`e2e-auth-result`)return this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.resolve({success:n.success,error:n.error}),void 0),!0;if(n.type===`e2e-key-exchange`&&t){let e=this.serverPendingKeyExchange.get(t);return e&&(clearTimeout(e.timeoutHandle),e.resolve({deviceId:n.deviceId,ephemeralPublicKey:n.ephemeralPublicKey,signature:n.signature})),!0}return!1}async waitForKeyExchangeResponse(){return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingKeyExchange=void 0,t(Error(`E2E key exchange timeout`))},this.timeout);this.pendingKeyExchange={resolve:e,reject:t,timeoutHandle:n}})}async waitForAuthResult(){return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingResult=void 0,t(Error(`E2E authentication result timeout`))},this.timeout);this.pendingResult={resolve:e,reject:t,timeoutHandle:n}})}async waitForClientKeyExchange(e){return new Promise((t,n)=>{let r={resolve:t,reject:n,timeoutHandle:setTimeout(()=>{this.serverPendingKeyExchange.delete(e),n(Error(`E2E key exchange timeout`))},this.timeout)};this.serverPendingKeyExchange.set(e,r)})}getSessionKey(e){return e?this.serverSessions.get(e)?.sessionKey??null:this.clientSession?.sessionKey??null}getPeerId(e){return e?this.serverSessions.get(e)?.peerId??null:this.clientSession?.peerId??null}getReceiveContext(e){let t=this.getPeerId(e);if(t!==null)return{transportName:``,peer:{kind:`e2e`,id:t,authenticated:!0,encrypted:!0}}}cleanupSocket(e){let t=this.serverPendingKeyExchange.get(e);t&&(clearTimeout(t.timeoutHandle),this.serverPendingKeyExchange.delete(e)),this.serverSessions.delete(e),this.serverEphemeralKeyPairs.delete(e)}cleanup(){this.pendingKeyExchange&&=(clearTimeout(this.pendingKeyExchange.timeoutHandle),void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),void 0),this.clientSession=void 0,this.clientEphemeralKeyPair=void 0;for(let e of this.serverPendingKeyExchange.values())clearTimeout(e.timeoutHandle);this.serverPendingKeyExchange.clear(),this.serverSessions.clear(),this.serverEphemeralKeyPairs.clear()}};const Z=`E2E relay auth session aborted by reconnect`;var Ke=class{signingKeyPair;identityId;getPeerSigningKey;timeout;mode;blocking;pendingPeer;sessionKey;peerId;localEphemeral;localExchangeMessage;sentLocalExchange=!1;earlyPeer;sendAuthMessage;authGeneration=0;processingExchange=!1;constructor(e){this.signingKeyPair=e.signingKeyPair,this.identityId=e.identityId,this.getPeerSigningKey=e.getPeerSigningKey,this.timeout=e.timeout??1e4,this.mode=e.mode??`initiator`,this.blocking=e.blocking??!0}async authenticateClient(e){let t=this.sendAuthMessage===void 0?this.earlyPeer:void 0;this.cleanup();let n=this.authGeneration;if(this.earlyPeer=t,this.sendAuthMessage=e,this.mode===`initiator`){if(await this.ensureLocalExchangeMessage(),n!==this.authGeneration)throw Error(Z);this.sendLocalExchange()}if(!this.blocking){if(this.earlyPeer){let e=this.earlyPeer;this.earlyPeer=void 0,this.dispatchPeerExchange(e,n)}return}let r=await this.waitForPeerExchange();if(await this.processPeerExchange(r,n),n!==this.authGeneration||!this.sessionKey)throw Error(Z)}async authenticateServer(e,t){throw Error(`E2ERelayAuth does not support server authentication`)}handleAuthMessage(e){let t=e;return!t||t.type!==`e2e-relay-key-exchange`?!1:t.identityId===this.identityId?!0:this.pendingPeer?(this.pendingPeer.resolve(t),this.pendingPeer=void 0,!0):(this.earlyPeer=t,!this.blocking&&this.sendAuthMessage&&!this.sessionKey&&!this.processingExchange&&this.dispatchPeerExchange(t,this.authGeneration),!0)}cleanupSocket(e){}cleanup(){this.authGeneration++,this.pendingPeer&&=(this.pendingPeer.reject(Error(Z)),void 0),this.earlyPeer&&=void 0,this.sessionKey=void 0,this.peerId=void 0,this.localEphemeral=void 0,this.localExchangeMessage=void 0,this.sentLocalExchange=!1,this.processingExchange=!1,this.sendAuthMessage=void 0}dispatchPeerExchange(e,t){this.processingExchange=!0,this.processPeerExchange(e,t).catch(e=>{e instanceof Error&&e.message===Z||console.error(`[E2ERelayAuth] Peer exchange failed:`,e)}).finally(()=>{t===this.authGeneration&&(this.processingExchange=!1,this.retryQueuedPeerExchange(t))})}getSessionKey(){return this.sessionKey??null}getPeerId(){return this.peerId??null}getReceiveContext(){let e=this.getPeerId();if(e!==null)return{transportName:``,peer:{kind:`e2e`,id:e,authenticated:!0,encrypted:!0}}}async waitForPeerExchange(){if(this.earlyPeer){let e=this.earlyPeer;return this.earlyPeer=void 0,e}return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingPeer=void 0,t(Error(`E2E relay key exchange timeout`))},this.timeout),r=()=>{clearTimeout(n),this.pendingPeer=void 0};this.pendingPeer={resolve:t=>{r(),e(t)},reject:e=>{r(),t(e)},timeoutHandle:n}})}async ensureLocalExchangeMessage(){if(this.localExchangeMessage&&this.localEphemeral)return this.localExchangeMessage;let{ephemeralKeyPair:e,ephemeralPublicKey:t,signature:n}=await J(this.signingKeyPair.privateKey,this.identityId);return this.localEphemeral=e,this.localExchangeMessage={type:`e2e-relay-key-exchange`,identityId:this.identityId,ephemeralPublicKey:t,signature:n},this.localExchangeMessage}sendLocalExchange(e=!1){!this.sendAuthMessage||!this.localExchangeMessage||!e&&this.sentLocalExchange||(this.sendAuthMessage(this.localExchangeMessage),this.sentLocalExchange=!0)}retryQueuedPeerExchange(e){if(this.blocking||!this.sendAuthMessage||this.sessionKey||this.processingExchange||e!==this.authGeneration)return;let t=this.earlyPeer;t&&(this.earlyPeer=void 0,this.dispatchPeerExchange(t,e))}async processPeerExchange(e,t){if(!this.sendAuthMessage){this.earlyPeer=e;return}let n=await this.ensureLocalExchangeMessage();if(t!==this.authGeneration)return;let r=await this.getPeerSigningKey(e.identityId);if(!r)throw Error(`E2E relay authentication failed: Unknown peer ${e.identityId}`);if(!await Y(r,e.ephemeralPublicKey,e.signature,e.identityId))throw Error(`E2E relay authentication failed: Invalid peer signature`);let i=await We(this.identityId,e.identityId,n.ephemeralPublicKey,e.ephemeralPublicKey);if(!this.localEphemeral)throw Error(`E2E relay authentication failed: Local ephemeral key missing`);let a=await X(this.localEphemeral.privateKey,e.ephemeralPublicKey,i,`makaio-e2e-relay-v1`);t===this.authGeneration&&(this.sessionKey=a,this.peerId=e.identityId,this.mode===`initiator`?this.sendLocalExchange(!0):this.sendLocalExchange())}},qe=class{hmac;e2e;socketStrategy=new Map;pendingServerAuth=new Map;hmacCancelled=new Map;constructor(e){this.hmac=e.hmac,this.e2e=e.e2e}setE2EAuth(e){this.e2e=e}async authenticateClient(e){let t=this.hmac??this.e2e;if(!t)throw Error(`DispatchingAuth: no auth strategy configured`);return t.authenticateClient(e)}async authenticateServer(e,t){let n=this.resolveSingleStrategy();if(n)return n.authenticateServer(e,t);if(!this.hmac||!this.e2e)throw Error(`DispatchingAuth: no auth strategy configured`);let r={cancelled:!1};this.hmacCancelled.set(e,r);let i=this.hmac.authenticateServer(e,e=>{r.cancelled||t(e)});return new Promise((n,a)=>{this.pendingServerAuth.set(e,{resolve:n,reject:a,send:t}),i.then(n).catch(e=>{r.cancelled||a(e instanceof Error?e:Error(String(e)))})})}handleAuthMessage(e,t){if(!t)return(this.hmac??this.e2e)?.handleAuthMessage(e)??!1;let n=this.socketStrategy.get(t);if(n)return n.handleAuthMessage(e,t);let r=this.resolveStrategy(e),i=this.pendingServerAuth.get(t);return r?(this.socketStrategy.set(t,r),this.pendingServerAuth.delete(t),r===this.hmac?this.hmacCancelled.delete(t):(this.cancelHmac(t),i&&r.authenticateServer(t,i.send).then(i.resolve).catch(e=>{i.reject(e instanceof Error?e:Error(String(e)))})),r.handleAuthMessage(e,t)):(this.cancelHmac(t),i&&(this.pendingServerAuth.delete(t),i.reject(Error(`DispatchingAuth: unrecognised auth message type "${this.peekType(e)}" — no matching strategy`))),!1)}cleanupSocket(e){let t=this.socketStrategy.get(e);t&&(t.cleanupSocket(e),this.socketStrategy.delete(e)),this.cancelHmac(e);let n=this.pendingServerAuth.get(e);n&&(this.pendingServerAuth.delete(e),n.reject(Error(`DispatchingAuth: socket disconnected before auth type was determined`)))}cleanup(){this.hmac?.cleanup(),this.e2e?.cleanup(),this.socketStrategy.clear();for(let e of this.pendingServerAuth.values())e.reject(Error(`DispatchingAuth: cleanup called before authentication completed`));this.pendingServerAuth.clear(),this.hmacCancelled.clear()}peekType(e){if(typeof e!=`object`||!e||!(`type`in e))return;let{type:t}=e;return typeof t==`string`?t:void 0}resolveSingleStrategy(){if(this.hmac&&!this.e2e)return this.hmac;if(this.e2e&&!this.hmac)return this.e2e}resolveStrategy(e){let t=this.peekType(e);if(t){if(t===`e2e-key-exchange`&&this.e2e)return this.e2e;if(t===`auth-response`&&this.hmac)return this.hmac}}cancelHmac(e){let t=this.hmacCancelled.get(e);t&&(t.cancelled=!0,this.hmacCancelled.delete(e),this.hmac?.cleanupSocket(e))}};function Je(e){return`payload`in e}async function Ye(e,t,n){if(e.type!==`response`||e.result===void 0||e.error!==void 0)return;let{ciphertext:r,nonce:i}=await B(n,D(JSON.stringify(e.result)));t.result=T(r),t.e2e={nonce:T(i),v:1}}async function Xe(e,t,n){if(e.type!==`broadcast-response`||e.results===void 0||e.error!==void 0)return;let{ciphertext:r,nonce:i}=await B(n,D(JSON.stringify(e.results)));t.results=T(r),t.e2e={nonce:T(i),v:1}}async function Ze(e,t,n){if(!Je(e)||e.payload===void 0)return;let{ciphertext:r,nonce:i}=await B(n,D(JSON.stringify(e.payload)));t.payload=T(r),t.e2e={nonce:T(i),v:1}}async function Qe(e,t,n){if(e.type!==`response`&&e.type!==`broadcast-response`||e.error===void 0)return;let{ciphertext:r,nonce:i}=await B(n,D(JSON.stringify(e.error)));t.error=T(r),t.e2e={nonce:T(i),v:1}}async function $e(e,t,n,r){if(!Je(e)||typeof e.payload!=`string`)return;let i=O(await V(n,E(e.payload),r));t.payload=JSON.parse(i)}async function et(e,t,n,r){if(e.type!==`response`||typeof e.result!=`string`)return;let i=O(await V(n,E(e.result),r));t.result=JSON.parse(i)}async function tt(e,t,n,r){if(e.type!==`broadcast-response`||typeof e.results!=`string`)return;let i=O(await V(n,E(e.results),r));t.results=JSON.parse(i)}async function nt(e,t,n,r){if(e.type!==`response`&&e.type!==`broadcast-response`||typeof e.error!=`string`)return;let i=O(await V(n,E(e.error),r));t.error=JSON.parse(i)}async function rt(e,t){let n={...e};return await Ze(e,n,t),await Ye(e,n,t),await Xe(e,n,t),await Qe(e,n,t),n}async function it(e,t){if(!e.e2e)return e;let n={...e};delete n.e2e;let r=E(e.e2e.nonce);return await $e(e,n,t,r),await et(e,n,t,r),await tt(e,n,t,r),await nt(e,n,t,r),n}function at(e){return e.type===`subscription-ack`&&typeof e.ackId==`string`}function ot(e){let{e2eAuth:t,websocket:n,...r}=e,i=new b({...r,url:`<pre-connected>`,createWebSocket:()=>n,auth:t,autoReconnect:!1,messageTransform:async e=>{let n=t.getSessionKey();if(!n||at(e))return e;let r=e;if(!r.e2e)throw Error(`Received plaintext message on E2E-encrypted channel — possible injection`);return it(r,n)}});async function a(e,n){let r=t.getSessionKey();if(!r)throw Error(`E2E session key not available - authentication may have failed`);let a=await rt(e,r);return i.send(a,n)}return{name:i.name,connect:i.connect.bind(i),disconnect:i.disconnect.bind(i),send:a,cancelRequest:i.cancelRequest.bind(i),onReceive:i.onReceive.bind(i),subscribe:i.subscribe.bind(i),unsubscribe:i.unsubscribe.bind(i),getSubscriptions:i.getSubscriptions.bind(i)}}function st(e){return ot(e)}function ct(e){if(!e||typeof e!=`object`)return!1;let t=e;if(t.type!==`e2e-relay-envelope`||typeof t.payload!=`string`)return!1;let n=t.e2e;return!!n&&typeof n.nonce==`string`&&typeof n.v==`number`}async function lt(e,t){let{ciphertext:n,nonce:r}=await B(t,D(JSON.stringify(e)));return{type:`e2e-relay-envelope`,payload:T(n),e2e:{nonce:T(r),v:1}}}async function ut(e,t){let n=E(e.e2e.nonce),r=O(await V(t,E(e.payload),n));return JSON.parse(r)}function dt(e){let t=()=>{if(!e.isFrozen())throw Error(`RelayControlRegistry must be frozen before processing relay control messages`)};function n(t){return typeof t.namespace!=`string`||typeof t.subject!=`string`||!e.isControlEvent(t.namespace,t.subject)||typeof t.messageId!=`string`?!1:t.payload!==void 0}function r(t){return typeof t.namespace!=`string`||typeof t.subject!=`string`||!e.isControlRequest(t.namespace,t.subject)||typeof t.messageId!=`string`||typeof t.correlationId!=`string`?!1:t.payload!==void 0}function i(e){if(t(),!e||typeof e!=`object`)return!1;let i=e;return i.type===`event`?n(i):i.type===`request`?r(i):!1}function a(e){if(t(),!e||typeof e!=`object`)return!1;let n=e;return n.type!==`relay-control`||n.v!==1||!n.payload||typeof n.payload!=`object`?!1:i(n.payload)}function o(e){if(t(),!i(e))throw Error(`Invalid relay control message`);return{type:`relay-control`,v:1,payload:e}}return{createRelayControlEnvelope:o,isRelayControlEnvelopeMessage:a,isRelayControlBusMessage:i}}function Q(e){let t=Date.now()-3e5;for(let[n,r]of e)r>=t||e.delete(n);for(;e.size>2048;){let t=e.keys().next().value;if(!t)break;e.delete(t)}}const ft=e=>{if(!e||typeof e!=`object`)return!1;let t=e;return t.type===`response`&&typeof t.correlationId==`string`},pt=e=>e.type===`subscribe`||e.type===`unsubscribe`,mt=e=>{if(!e||typeof e!=`object`)return!1;let t=e;return t.type===`subscription-ack`&&typeof t.ackId==`string`};function $(e,t,n,r){if(!r.isFrozen())throw Error(`E2ERelay transport requires a frozen relay control registry`);let{createRelayControlEnvelope:i,isRelayControlEnvelopeMessage:a,isRelayControlBusMessage:o}=dt(r),s=e=>{n.delete(e),n.set(e,Date.now()),Q(n)};return{encode:async t=>{if(o(t))return t.type===`request`&&s(t.correlationId),JSON.stringify(i(t));if(Q(n),t.type===`response`&&n.has(t.correlationId))return n.delete(t.correlationId),JSON.stringify(t);let r=e.getSessionKey();if(!r&&pt(t)||!r&&mt(t))return JSON.stringify(t);if(!r)throw Error(`E2E relay session not established`);let a=await lt(t,r);return JSON.stringify(a)},decode:async r=>{let i=e.getSessionKey();if(a(r)){let e=r.payload;return t&&console.info(`[E2ERelayTransport] Decoded relay control envelope:`,e.type,e.namespace,e.subject),e.type===`request`&&s(e.correlationId),e}if(Q(n),ft(r)&&n.has(r.correlationId))return n.delete(r.correlationId),r;if(!i&&mt(r))return r;if(!i)throw Error(`E2E relay session not established`);if(!ct(r))throw Error(`Received plaintext message on relay E2E channel — possible injection`);return ut(r,i)}}}function ht(e,t,n=!1){let r=new Map;return{codec:$(e,n,r,t),reset:()=>r.clear()}}function gt(e){let{e2eAuth:t,registry:n,websocket:r,...i}=e,a=e.debug??!1,o=new Map,s=$(t,a,o,n);a&&console.info(`[E2ERelayTransport] Creating inner transport...`);let c=new b({...i,url:`<pre-connected>`,createWebSocket:()=>r,auth:t,codec:s,autoReconnect:!1});return a&&console.info(`[E2ERelayTransport] Inner transport created`),{name:c.name,connect:async()=>{if(!n.isFrozen())throw Error(`E2ERelayClientTransport: registry must be frozen before connect()`);o.clear();try{await c.connect()}catch(e){throw o.clear(),e}},disconnect:async()=>{o.clear();try{await c.disconnect()}finally{o.clear()}},send:c.send.bind(c),cancelRequest:c.cancelRequest.bind(c),onReceive:(...e)=>(a&&console.info(`[E2ERelayTransport] onReceive called, delegating to inner transport`),c.onReceive(...e)),subscribe:c.subscribe.bind(c),unsubscribe:c.unsubscribe.bind(c),getSubscriptions:c.getSubscriptions.bind(c),isReady:()=>!!t.getSessionKey()&&c.isReady()}}function _t(){let e=!1,t=new Map,n=new Map,r=()=>{if(e)throw Error(`RelayControlRegistry is frozen and cannot be modified`)};return{registerEventSubjects(e,n){r();let i=t.get(e)??new Set;for(let e of n)i.add(e);t.set(e,i)},registerRequestNamespace(e,t){if(r(),t.length===0)throw Error(`RelayControlRegistry request namespace "${e}" requires at least one subject`);let i=n.get(e)??new Set;for(let e of t)i.add(e);n.set(e,i)},freeze(){e=!0},isFrozen(){return e},isControlEvent(e,n){return t.get(e)?.has(n)??!1},isControlRequest(e,t){return n.get(e)?.has(t)??!1}}}function vt(e){if(Se(e),e.mode===`client`){if(e.connectionOptions!==void 0)throw Error(`createWebSocketTransport(client) does not support connectionOptions when wrapping a pre-created WebSocket. Use WebSocketClientTransport for reconnect or dial-time socket options.`);let t=e.websocket;return new b({url:`<pre-connected>`,createWebSocket:()=>t,auth:e.auth,debug:e.debug,autoReconnect:!1})}else return new C({websocket:e.websocket,auth:e.auth,debug:e.debug})}export{qe as DispatchingAuth,Ge as E2EAuth,Ke as E2ERelayAuth,Te as HmacAuth,C as ServerTransport,b as WebSocketClientTransport,ke as clearHmacIdentitySecretsForTesting,st as createE2EClientTransport,gt as createE2ERelayClientTransport,ht as createE2ERelayCodec,dt as createRelayControlHelpers,_t as createRelayControlRegistry,xe as createWebSocketCloseEvent,vt as createWebSocketTransport,He as crypto,h as extractSocketErrorMessage,Ee as registerHmacIdentitySecret,Oe as resolveHmacIdentityPeer,De as resolveHmacIdentitySecret};

package/dist/{orchestrator-shared-D2txLAUs.mjs → orchestrator-shared-CIDiFJMD.mjs}

@@ -1 +1 @@
-import{n as e}from"./namespace-DGMO2E8f.mjs";import{MakaioBus as t}from"@makaio/framework/bus";import{AdapterSubjects as n,AgentSubjects as r,SessionSubjects as i}from"@makaio/framework/contracts";function a(){t.__resetHandlers?.()}function o(e=10){return new Promise(t=>setTimeout(t,e))}function s(e,t){let n=Date.now();return{agentId:e,adapterId:`adapter-${e}`,adapterName:`test-adapter`,sessionId:t?.sessionId??`test-session`,role:`member`,status:`idle`,createdAt:n,lastActivityAt:n,...t}}async function c(e,r=e){await t.emit(n.initialized,{adapterName:e,adapterId:r,capabilities:[]})}async function l(n){return(await t.request(e.getEvents,{sessionId:n})).events}function u(e,n,r){let i=[];return r.push(t.on(e,(e=>{let t=e.payload;i.push(n(t))}))),{received:i,clear:()=>{i.length=0}}}function d(e){return u(i.turn.started,e=>({sessionId:e.sessionId,turnId:e.turnId,messageId:e.messageId,agentIds:[...e.agentIds],initiator:e.initiator}),e)}function f(e){return u(i.turn.completed,e=>({sessionId:e.sessionId,turnId:e.turnId,success:e.success,error:e.error,initiator:e.initiator}),e)}function p(e){return u(i.user_message.sent,e=>({sessionId:e.sessionId,turnId:e.turnId,messageId:e.messageId,content:e.content,agentIds:[...e.agentIds],origin:e.origin}),e)}function m(e){return u(i.user_message.acknowledged,e=>({sessionId:e.sessionId,turnId:e.turnId,messageId:e.messageId,agentId:e.agentId}),e)}function h(e){return u(i.user_message.completed,e=>({sessionId:e.sessionId,turnId:e.turnId,messageId:e.messageId,agentId:e.agentId,outcome:e.outcome,error:e.error}),e)}const g=s;function _(e){let t=Date.now();return{sessionId:e.sessionId,createdAt:t,lastActivityAt:t,status:e.status??`active`,agents:e.agents??[],leadAgentId:e.leadAgentId,targetWorkingDirectory:e.targetWorkingDirectory}}function v(e){return t.on(i.create,t=>{let n=t.payload.sessionId??`session-${crypto.randomUUID().slice(0,8)}`;e.set(n,_({sessionId:n,agents:[]})),t.setResult({sessionId:n})})}function y(e){return t.on(i.agent.added,t=>{let n=e.get(t.payload.sessionId);if(!n)return;let r=n.agents.length===0,i=t.payload.role??(r?`lead`:`member`);r&&(n.adapterSessionId=t.payload.adapterSessionId,n.adapterName=t.payload.adapterName,n.adapterId=t.payload.adapterId);let a=Date.now();n.agents.push({agentId:t.payload.agentId,adapterId:t.payload.adapterId,adapterName:t.payload.adapterName,sessionId:t.payload.sessionId,role:i,status:`idle`,createdAt:a,lastActivityAt:a}),i===`lead`&&(n.leadAgentId=t.payload.agentId),n.lastActivityAt=Date.now()})}function b(e){return t.on(i.get,t=>{t.setResult({session:e.get(t.payload.sessionId)??null})})}function x(e){return t.on(n.getAgent,t=>{for(let n of e.values()){let e=n.agents.find(e=>e.agentId===t.payload.agentId);if(e){t.setResult({agent:{agentId:e.agentId,sessionId:n.sessionId,adapterSessionId:``}});return}}t.setResult({agent:null})})}function S(){return t.on(n.rehydrateAgent,e=>{e.setResult({})})}function C(e=`/previous/cwd`){return t.on(r.cwd.change,t=>{t.setResult({success:!0,previousCwd:e})})}function w(){return t.on(r.model.change,e=>{e.setResult({success:!0,swapped:!1})})}function T(e){return t.on(n.startAgent,t=>{let{adapterId:n,initialMessage:r}=t.payload,i=t.payload.sessionId??`session-${crypto.randomUUID().slice(0,8)}`,a=`agent-${crypto.randomUUID().slice(0,8)}`,o=r?`msg-${crypto.randomUUID().slice(0,8)}`:void 0,s=`adapter-session-${i}`;e?.({adapterId:n,sessionId:i,initialMessage:r}),t.setResult({success:!0,agentId:a,adapterId:n,adapterSessionId:s,sessionId:i,...o&&{messageId:o}}),j({sessionId:i,agentId:a,adapterId:n,adapterSessionId:s})})}function E(e){return t.on(n.startAgent,t=>{t.setResult({success:!1,message:e})})}function D(e){return t.on(r.sendMessage,t=>{let{agentId:n,adapterId:r,message:i,messageId:a,sessionContext:o,responseSchema:s}=t.payload,c=a??`msg-${crypto.randomUUID().slice(0,8)}`;e?.({agentId:n,adapterId:r,message:i,messageId:c,sessionContext:o,responseSchema:s}),t.setResult({messageId:c})})}function O(e,n){return t.on(r.sendMessage,t=>{if(e.has(t.payload.agentId))throw Error(n);t.setResult({messageId:t.payload.messageId??`generated-id`})})}async function k(e,n){await t.emit(r.complete,{agentId:e,adapterId:`adapter-${e}`,adapterName:`test-adapter`,adapterSessionId:`adapter-session-${e}`,messageId:n})}async function A(e,n){await t.emit(r.complete,{agentId:e,adapterId:`adapter-${e}`,adapterName:`test-adapter`,adapterSessionId:`adapter-session-${e}`,messageId:`msg-error-${e}`,outcome:`error`,error:n})}function j(e){setImmediate(()=>{t.emit(i.agent.added,{sessionId:e.sessionId,agentId:e.agentId,adapterId:e.adapterId,adapterName:e.adapterId,adapterSessionId:e.adapterSessionId,role:e.role})})}function M(e,r){let i=new Map,a=t.on(n.startAgent,t=>{r.payload=t.payload;let n=`agent-${crypto.randomUUID().slice(0,8)}`,a=t.payload.initialMessage?`msg-${crypto.randomUUID().slice(0,8)}`:void 0,o=`adapter-session-${e}`;i.set(n,{agentId:n,sessionId:e,adapterSessionId:o,adapterId:t.payload.adapterId}),t.setResult({success:!0,agentId:n,adapterId:t.payload.adapterId,adapterSessionId:o,sessionId:e,...a&&{messageId:a}}),j({sessionId:e,agentId:n,adapterId:t.payload.adapterId,adapterSessionId:o})}),o=t.on(n.getAgent,e=>{let t=i.get(e.payload.agentId);e.setResult({agent:t?{agentId:t.agentId,sessionId:t.sessionId,adapterSessionId:t.adapterSessionId}:null})});return()=>{a(),o()}}export{c as C,o as E,p as S,a as T,T as _,A as a,m as b,v as c,E as d,x as f,D as g,S as h,k as i,C as l,w as m,_ as n,y as o,b as p,j as r,M as s,g as t,O as u,f as v,l as w,h as x,d as y};
+import{n as e}from"./namespace-DuXK5AYN.mjs";import{MakaioBus as t}from"@makaio/framework/bus";import{AdapterSubjects as n,AgentSubjects as r,SessionSubjects as i}from"@makaio/framework/contracts";function a(){t.__resetHandlers?.()}function o(e=10){return new Promise(t=>setTimeout(t,e))}function s(e,t){let n=Date.now();return{agentId:e,adapterId:`adapter-${e}`,adapterName:`test-adapter`,sessionId:t?.sessionId??`test-session`,role:`member`,status:`idle`,createdAt:n,lastActivityAt:n,...t}}async function c(e,r=e){await t.emit(n.initialized,{adapterName:e,adapterId:r,capabilities:[]})}async function l(n){return(await t.request(e.getEvents,{sessionId:n})).events}function u(e,n,r){let i=[];return r.push(t.on(e,(e=>{let t=e.payload;i.push(n(t))}))),{received:i,clear:()=>{i.length=0}}}function d(e){return u(i.turn.started,e=>({sessionId:e.sessionId,turnId:e.turnId,messageId:e.messageId,agentIds:[...e.agentIds],initiator:e.initiator}),e)}function f(e){return u(i.turn.completed,e=>({sessionId:e.sessionId,turnId:e.turnId,success:e.success,error:e.error,initiator:e.initiator}),e)}function p(e){return u(i.user_message.sent,e=>({sessionId:e.sessionId,turnId:e.turnId,messageId:e.messageId,content:e.content,agentIds:[...e.agentIds],origin:e.origin}),e)}function m(e){return u(i.user_message.acknowledged,e=>({sessionId:e.sessionId,turnId:e.turnId,messageId:e.messageId,agentId:e.agentId}),e)}function h(e){return u(i.user_message.completed,e=>({sessionId:e.sessionId,turnId:e.turnId,messageId:e.messageId,agentId:e.agentId,outcome:e.outcome,error:e.error}),e)}const g=s;function _(e){let t=Date.now();return{sessionId:e.sessionId,createdAt:t,lastActivityAt:t,status:e.status??`active`,agents:e.agents??[],leadAgentId:e.leadAgentId,targetWorkingDirectory:e.targetWorkingDirectory}}function v(e){return t.on(i.create,t=>{let n=t.payload.sessionId??`session-${crypto.randomUUID().slice(0,8)}`;e.set(n,_({sessionId:n,agents:[]})),t.setResult({sessionId:n})})}function y(e){return t.on(i.agent.added,t=>{let n=e.get(t.payload.sessionId);if(!n)return;let r=n.agents.length===0,i=t.payload.role??(r?`lead`:`member`);r&&(n.adapterSessionId=t.payload.adapterSessionId,n.adapterName=t.payload.adapterName,n.adapterId=t.payload.adapterId);let a=Date.now();n.agents.push({agentId:t.payload.agentId,adapterId:t.payload.adapterId,adapterName:t.payload.adapterName,sessionId:t.payload.sessionId,role:i,status:`idle`,createdAt:a,lastActivityAt:a}),i===`lead`&&(n.leadAgentId=t.payload.agentId),n.lastActivityAt=Date.now()})}function b(e){return t.on(i.get,t=>{t.setResult({session:e.get(t.payload.sessionId)??null})})}function x(e){return t.on(n.getAgent,t=>{for(let n of e.values()){let e=n.agents.find(e=>e.agentId===t.payload.agentId);if(e){t.setResult({agent:{agentId:e.agentId,sessionId:n.sessionId,adapterSessionId:``}});return}}t.setResult({agent:null})})}function S(){return t.on(n.rehydrateAgent,e=>{e.setResult({})})}function C(e=`/previous/cwd`){return t.on(r.cwd.change,t=>{t.setResult({success:!0,previousCwd:e})})}function w(){return t.on(r.model.change,e=>{e.setResult({success:!0,swapped:!1})})}function T(e){return t.on(n.startAgent,t=>{let{adapterId:n,initialMessage:r}=t.payload,i=t.payload.sessionId??`session-${crypto.randomUUID().slice(0,8)}`,a=`agent-${crypto.randomUUID().slice(0,8)}`,o=r?`msg-${crypto.randomUUID().slice(0,8)}`:void 0,s=`adapter-session-${i}`;e?.({adapterId:n,sessionId:i,initialMessage:r}),t.setResult({success:!0,agentId:a,adapterId:n,adapterSessionId:s,sessionId:i,...o&&{messageId:o}}),j({sessionId:i,agentId:a,adapterId:n,adapterSessionId:s})})}function E(e){return t.on(n.startAgent,t=>{t.setResult({success:!1,message:e})})}function D(e){return t.on(r.sendMessage,t=>{let{agentId:n,adapterId:r,message:i,messageId:a,sessionContext:o,responseSchema:s}=t.payload,c=a??`msg-${crypto.randomUUID().slice(0,8)}`;e?.({agentId:n,adapterId:r,message:i,messageId:c,sessionContext:o,responseSchema:s}),t.setResult({messageId:c})})}function O(e,n){return t.on(r.sendMessage,t=>{if(e.has(t.payload.agentId))throw Error(n);t.setResult({messageId:t.payload.messageId??`generated-id`})})}async function k(e,n){await t.emit(r.complete,{agentId:e,adapterId:`adapter-${e}`,adapterName:`test-adapter`,adapterSessionId:`adapter-session-${e}`,messageId:n})}async function A(e,n){await t.emit(r.complete,{agentId:e,adapterId:`adapter-${e}`,adapterName:`test-adapter`,adapterSessionId:`adapter-session-${e}`,messageId:`msg-error-${e}`,outcome:`error`,error:n})}function j(e){setImmediate(()=>{t.emit(i.agent.added,{sessionId:e.sessionId,agentId:e.agentId,adapterId:e.adapterId,adapterName:e.adapterId,adapterSessionId:e.adapterSessionId,role:e.role})})}function M(e,r){let i=new Map,a=t.on(n.startAgent,t=>{r.payload=t.payload;let n=`agent-${crypto.randomUUID().slice(0,8)}`,a=t.payload.initialMessage?`msg-${crypto.randomUUID().slice(0,8)}`:void 0,o=`adapter-session-${e}`;i.set(n,{agentId:n,sessionId:e,adapterSessionId:o,adapterId:t.payload.adapterId}),t.setResult({success:!0,agentId:n,adapterId:t.payload.adapterId,adapterSessionId:o,sessionId:e,...a&&{messageId:a}}),j({sessionId:e,agentId:n,adapterId:t.payload.adapterId,adapterSessionId:o})}),o=t.on(n.getAgent,e=>{let t=i.get(e.payload.agentId);e.setResult({agent:t?{agentId:t.agentId,sessionId:t.sessionId,adapterSessionId:t.adapterSessionId}:null})});return()=>{a(),o()}}export{c as C,o as E,p as S,a as T,T as _,A as a,m as b,v as c,E as d,x as f,D as g,S as h,k as i,C as l,w as m,_ as n,y as o,b as p,j as r,M as s,g as t,O as u,f as v,l as w,h as x,d as y};