@makaio/framework 1.0.0-dev-1782480236258 → 1.0.0-dev-1783282710723

package/dist/node/transports/index.mjs

@@ -1,2 +1,2 @@
-import{r as e}from"../../chunk-DTipWd-i.mjs";import{CorrelationTracker as t,DEFAULT_REQUEST_TIMEOUT_MS as n,NoHandlerError as r,TimeoutError as i,buildSubscribeMessage as a,buildUnsubscribeMessage as o,deserializeTransportError as s,getSubjectFromBusMessage as c,handleCorrelationResponse as l,isNoHandlerErrorForSubject as u,shouldReceiveMessage as d,trackMessageCorrelation as f}from"@makaio/framework/bus";import{isRecord as p}from"@makaio/framework/utils";const m={baseMs:1e3,maxMs:1e4};function ee(e,t,n){let r=Math.max(t,100),i=Math.max(n,r);return Math.min(r*2**e,i)}function te(e,t){return new Promise(n=>{if(t.aborted){n();return}let r=()=>{clearTimeout(i),t.removeEventListener(`abort`,r),n()},i=setTimeout(()=>{t.removeEventListener(`abort`,r),n()},e);t.addEventListener(`abort`,r)})}const ne={encode:async e=>JSON.stringify(e),decode:async e=>e};function re(e){return e===!1?!1:{baseMs:e?.baseMs??m.baseMs,maxMs:e?.maxMs??m.maxMs}}function h(e,t=`unknown error`){return`message`in e?String(e.message):t}async function g(e,t,n){let r=await t.encode(e);n.send(r)}function ie(e){return e.readyState===1?Promise.resolve():e.readyState>=2?Promise.reject(Error(`WebSocket closed before opening`)):new Promise((t,n)=>{let r=()=>{e.removeEventListener(`open`,i),e.removeEventListener(`error`,a),e.removeEventListener(`close`,o)},i=()=>{r(),t()},a=e=>{r(),n(Error(`WebSocket connection failed — ${h(e)}`))},o=()=>{r(),n(Error(`WebSocket closed before opening`))};e.addEventListener(`open`,i),e.addEventListener(`error`,a),e.addEventListener(`close`,o)})}async function ae(e,t,n){let r=await Promise.allSettled(Array.from(t).map(t=>t(e,n.receiveContext)));for(let e of r)e.status===`rejected`&&n.debug&&console.error(`[WebSocketClientTransport:${n.name}] Handler error:`,e.reason);return r.every(e=>e.status===`fulfilled`)}function oe(e,t){return{...t?.getReceiveContext?.(),transportName:e}}async function se(e,t){let{name:n,debug:r,auth:i,codec:a,messageTransform:o,correlations:s,handlers:c}=t;try{let u=JSON.parse(e.toString());if(typeof u!=`object`||!u||typeof u.type!=`string`){r&&console.error(`[WebSocketClientTransport:${n}] Invalid message structure:`,u);return}let d=u;if(i?.handleAuthMessage(d)||d.type===`heartbeat`)return;let f=await a.decode(d);if(o&&(f=await o(f)),f.type===`heartbeat`)return;if(f.type===`subscribe-sync-complete`){t.onSyncComplete();return}if(f.type===`subscription-ack`){typeof f.ackId==`string`&&t.onSubscriptionAck(f.ackId);return}if(l(f,s))return;let p=oe(n,i);await ae(f,c,{debug:r,name:n,receiveContext:p})&&(f.type===`subscribe`||f.type===`unsubscribe`)&&typeof f.ackId==`string`&&await t.sendSubscriptionAck(f.ackId)}catch(e){r&&console.error(`[WebSocketClientTransport:${n}] Failed to parse message:`,e)}}function ce(e,t){let n=n=>{se(n.data,{name:t.name,debug:t.debug,auth:t.auth,codec:t.codec,messageTransform:t.messageTransform,correlations:t.correlations,handlers:t.handlers,onSyncComplete:()=>{t.resolveReady()},onSubscriptionAck:e=>{t.resolveSubscriptionAck(e)},sendSubscriptionAck:async n=>{e.readyState===1&&await g({type:`subscription-ack`,ackId:n},t.codec,e)}})};t.setMessageListener(n),e.addEventListener(`message`,n)}function _(e,t){let n=t.getMessageListener();n!==null&&(e.removeEventListener(`message`,n),t.setMessageListener(null));let r=t.getCloseListener();r!==null&&(e.removeEventListener(`close`,r),t.setCloseListener(null))}async function v(e){e.resolveReady(),e.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: reconnecting before subscription ack`)),e.resetReadyPromise();let t=e.getSocket();t!==null&&_(t,e);let n=await e.wsFactory(e.url);e.setSocket(n),e.setAuthComplete(!1);try{ce(n,e),await ie(n),e.auth&&await e.auth.authenticateClient(e=>{if(n.readyState!==1)throw Error(`WebSocketClientTransport: cannot send auth message — socket not open`);n.send(JSON.stringify(e))}),e.setAuthComplete(!0),e.debug&&console.info(`[WebSocketClientTransport:${e.name}] Connected to ${e.url}`),e.localSubscriptions.size>0&&(await g(a(e.localSubscriptions),e.codec,n),e.debug&&console.info(`[WebSocketClientTransport:${e.name}] Replayed ${e.localSubscriptions.size} subscription(s)`)),e.notifyConnected()}catch(t){let r=e.getSocket()===n;throw r&&e.auth?.cleanup(),_(n,e),r&&e.setSocket(null),e.setAuthComplete(!1),r&&(n.readyState===0||n.readyState===1)&&n.close(),t}}function y(e,t){return new Promise(n=>{if(e.readyState===3||t.aborted){n();return}let r=()=>{t.removeEventListener(`abort`,i),n()},i=()=>{e.removeEventListener(`close`,r),n()};e.addEventListener(`close`,r),t.addEventListener(`abort`,i)})}async function le(e,t,n,r,i){i(!0);try{for(;!e.aborted;){let i=n.getSocket(),a=i!==null;if(i!==null&&i.readyState!==3&&await y(i,e),e.aborted)break;a&&(n.debug&&console.info(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Connection lost, starting reconnect loop (maxMs=${t.maxMs})`),n.notifyDisconnected());let o=0;for(;!e.aborted;){let i=ee(o,t.baseMs,t.maxMs);n.debug&&console.info(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Reconnecting in ${i}ms (attempt ${o+1})`);let a=new AbortController;if(r(a),await te(i,AbortSignal.any([e,a.signal])),r(null),e.aborted)break;try{await v(n),o=0;let t=n.getSocket();if(t!==null){let r=()=>{n.auth?.cleanup(),n.setAuthComplete(!1),n.debug&&console.info(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Connection closed`),n.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: disconnected before subscription ack`))};n.setCloseListener(r),t.addEventListener(`close`,r),await y(t,e)}break}catch(e){if(n.debug){let t=e instanceof Error?e.message:String(e);console.warn(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Connect attempt ${o+1} failed: ${t}`)}o++}}}}finally{i(!1)}}function ue(e,t,n){let r=()=>{t.auth?.cleanup(),_(e,t),t.setAuthComplete(!1),t.setSocket(null),n(),t.resolveReady(),t.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: disconnected before subscription ack`)),t.notifyDisconnected()};t.setCloseListener(r),e.addEventListener(`close`,r)}async function de(e,t,n,r){let i=r.localSubscriptions.get(e)?.filter,o=t??i;if(r.localSubscriptions.set(e,{filter:o,priorities:n}),r.socket!==null&&r.socket.readyState===1){let t=r.beginSubscriptionAck?.(),i=a(new Map([[e,{filter:o,priorities:n}]]),t?.ackId);try{await g(i,r.codec,r.socket),await t?.promise}catch(e){throw t?.reject(e),e}}r.debug&&console.info(`[WebSocketClientTransport:${r.name}] Subscribed to ${e}${o?` with filter`:``}`)}async function fe(e,t){let n=t.localSubscriptions.get(e);if(t.localSubscriptions.delete(e),t.socket!==null&&t.socket.readyState===1){let r=t.beginSubscriptionAck?.(),i=o({[e]:n?.priorities??[]},r?.ackId);try{await g(i,t.codec,t.socket),await r?.promise}catch(e){throw r?.reject(e),e}}t.debug&&console.info(`[WebSocketClientTransport:${t.name}] Unsubscribed from ${e}`)}var b=class{name;url;auth;codec;messageTransform;autoReconnectConfig;wsFactory;debug;onConnectedCallback;onDisconnectedCallback;socket=null;authComplete=!1;correlations=new t;handlers=new Set;localSubscriptions=new Map;pendingSubscriptionAcks=new Map;subscriptionAckSeq=0;messageListener=null;closeListener=null;reconnectAbort=null;backoffWakeAbort=null;reconnectLoopRunning=!1;readyResolve=null;ready;onNewReadySession=void 0;onConnected=void 0;onDisconnected=void 0;constructor(e){this.url=e.url,this.name=e.name??`ws-client`,this.auth=e.auth,this.codec=e.codec??ne,this.messageTransform=e.messageTransform,this.debug=e.debug??!1,this.autoReconnectConfig=re(e.autoReconnect),this.wsFactory=e.createWebSocket??this.defaultWsFactory,this.onConnectedCallback=e.onConnected,this.onDisconnectedCallback=e.onDisconnected,this.ready=new Promise(e=>{this.readyResolve=e})}async connect(){if(this.reconnectAbort!==null)throw Error(`WebSocketClientTransport: already connected`);let e=new AbortController;this.reconnectAbort=e;try{await v(this.connectionDeps())}catch(e){throw this.reconnectAbort=null,e}this.autoReconnectConfig===!1?this.socket!==null&&this.wireNoReconnectClose(this.socket):this.startReconnectLoop(e.signal)}async disconnect(){let e=this.reconnectAbort;if(this.reconnectAbort=null,e?.abort(),this.readyResolve?.(),this.readyResolve=null,this.socket!==null){_(this.socket,this.connectionDeps());let e=this.socket;this.socket=null,this.authComplete=!1,(e.readyState===0||e.readyState===1)&&e.close()}this.correlations.cleanup(),this.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: disconnected before subscription ack`)),this.auth?.cleanup(),this.handlers.clear(),this.debug&&console.info(`[WebSocketClientTransport:${this.name}] Disconnected`)}async send(e,t){if(this.socket===null||this.socket.readyState!==1)throw Error(`WebSocketClientTransport: not connected`);let r=await this.codec.encode(e);return this.socket.send(r),f(e,this.correlations,t??n)}onReceive(e){return this.handlers.add(e),()=>{this.handlers.delete(e)}}async subscribe(e,t,n=[]){await de(e,t,n,this.subscriptionDeps())}async unsubscribe(e){await fe(e,this.subscriptionDeps())}getSubscriptions(){return new Set(this.localSubscriptions.keys())}cancelRequest(e,t){this.correlations.cancel(e,t)}isReady(){return this.socket!==null&&this.socket.readyState===1&&this.authComplete}async reconnect(){if(!this.isReady()){if(this.backoffWakeAbort!==null){this.backoffWakeAbort.abort(),this.backoffWakeAbort=null;return}if(this.autoReconnectConfig!==!1){if(this.reconnectLoopRunning)return;this.reconnectAbort!==null&&this.startReconnectLoop(this.reconnectAbort.signal);return}try{await v(this.connectionDeps()),this.socket!==null&&(this.reconnectAbort=new AbortController,this.wireNoReconnectClose(this.socket))}catch{}}}startReconnectLoop(e){return le(e,this.autoReconnectConfig,this.connectionDeps(),e=>{this.backoffWakeAbort=e},e=>{this.reconnectLoopRunning=e})}subscriptionDeps(){return{name:this.name,debug:this.debug,codec:this.codec,socket:this.socket,localSubscriptions:this.localSubscriptions,beginSubscriptionAck:()=>this.beginSubscriptionAck()}}beginSubscriptionAck(){let e=`${this.name}:sub:${++this.subscriptionAckSeq}`,t,n,r=new Promise((e,r)=>{t=e,n=r});r.catch(()=>void 0);let i=t=>{this.pendingSubscriptionAcks.has(e)&&(this.pendingSubscriptionAcks.delete(e),t())};return this.pendingSubscriptionAcks.set(e,{resolve:()=>i(t),reject:e=>i(()=>n(e))}),{ackId:e,promise:r,reject:t=>this.rejectSubscriptionAck(e,t)}}resolveSubscriptionAck(e){this.pendingSubscriptionAcks.get(e)?.resolve()}rejectSubscriptionAck(e,t){this.pendingSubscriptionAcks.get(e)?.reject(t)}rejectPendingSubscriptionAcks(e){for(let t of this.pendingSubscriptionAcks.keys())this.rejectSubscriptionAck(t,e)}connectionDeps(){return{name:this.name,debug:this.debug,auth:this.auth,codec:this.codec,messageTransform:this.messageTransform,correlations:this.correlations,handlers:this.handlers,localSubscriptions:this.localSubscriptions,wsFactory:this.wsFactory,url:this.url,getSocket:()=>this.socket,setSocket:e=>{this.socket=e},setAuthComplete:e=>{this.authComplete=e},getMessageListener:()=>this.messageListener,setMessageListener:e=>{this.messageListener=e},getCloseListener:()=>this.closeListener,setCloseListener:e=>{this.closeListener=e},resolveReady:()=>{this.readyResolve?.(),this.readyResolve=null},resetReadyPromise:()=>{this.ready=new Promise(e=>{this.readyResolve=e}),this.onNewReadySession?.(this.ready)},resolveSubscriptionAck:e=>{this.resolveSubscriptionAck(e)},rejectPendingSubscriptionAcks:e=>{this.rejectPendingSubscriptionAcks(e)},notifyConnected:()=>{this.onConnectedCallback?.(),this.onConnected?.()},notifyDisconnected:()=>{this.onDisconnectedCallback?.(),this.onDisconnected?.()}}}defaultWsFactory=async e=>new(await(import(`ws`))).WebSocket(e);wireNoReconnectClose(e){ue(e,this.connectionDeps(),()=>{this.reconnectAbort=null})}};function x(e){e.timer!==void 0&&clearTimeout(e.timer)}var pe=class{pendingBroadcasts=new Map;timeout;debug;constructor(e={}){this.timeout=e.timeout??5e3,this.debug=e.debug??!1}startClientBroadcast(e,t,n,r,i){let a=t.correlationId,o=i??this.timeout,s={kind:`client`,sender:e,results:[],pendingClients:new Set(n),nodeResultsReceived:!1,timer:o===0?void 0:setTimeout(()=>{this.debug&&console.warn(`[BroadcastAggregator] Broadcast ${a} timed out`),this.finalizeBroadcast(a)},o)};this.pendingBroadcasts.set(a,s);let c=JSON.stringify(t);for(let e of n)r(e,c);this.debug&&console.info(`[BroadcastAggregator] Broadcast ${a} forwarded to ${n.length} clients`)}startServerBroadcast(e,t,n,r){let i=e.correlationId,a=r??this.timeout;return t.length===0?(this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${i} - no target clients`),Promise.resolve([])):new Promise(r=>{let o={kind:`server`,results:[],pendingClients:new Set(t),timer:a===0?void 0:setTimeout(()=>{this.debug&&console.warn(`[BroadcastAggregator] Server broadcast ${i} timed out`),this.finalizeServerBroadcast(i)},a),resolve:r};this.pendingBroadcasts.set(i,o);let s=JSON.stringify(e);for(let e of t)n(e,s);this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${i} sent to ${t.length} clients`)})}handleResponse(e,t){let n=this.pendingBroadcasts.get(t.correlationId);return n?(t.results&&n.results.push(...t.results),n.pendingClients.delete(e),this.debug&&console.info(`[BroadcastAggregator] Broadcast ${t.correlationId} got response, ${n.pendingClients.size} pending`),this.checkBroadcastComplete(t.correlationId,n),!0):!1}handleNodeResults(e,t,n){let r=this.pendingBroadcasts.get(e);return!r||r.kind!==`client`?!1:(r.results.push(...t),r.nodeResultsReceived=!0,r.nodeError=n,this.debug&&console.info(`[BroadcastAggregator] Broadcast ${e} node results aggregated${n?` (with error)`:``}`),this.checkBroadcastComplete(e,r),!0)}handleClientDisconnect(e){for(let[t,n]of this.pendingBroadcasts)n.kind===`client`&&n.sender===e?(x(n),this.pendingBroadcasts.delete(t)):n.pendingClients.has(e)&&(n.pendingClients.delete(e),this.checkBroadcastComplete(t,n))}cleanup(){for(let e of this.pendingBroadcasts.values())x(e),e.kind===`server`&&e.resolve(e.results);this.pendingBroadcasts.clear()}checkBroadcastComplete(e,t){if(!(t.pendingClients.size>0))if(t.kind===`client`){if(!t.nodeResultsReceived)return;this.finalizeBroadcast(e)}else this.finalizeServerBroadcast(e)}finalizeBroadcast(e){let t=this.pendingBroadcasts.get(e);if(!t||t.kind!==`client`)return;x(t),this.pendingBroadcasts.delete(e);let n=t.nodeError?{type:`broadcast-response`,correlationId:e,error:t.nodeError}:{type:`broadcast-response`,correlationId:e,results:t.results};t.sender.readyState===1&&t.sender.send(JSON.stringify(n)),this.debug&&console.info(`[BroadcastAggregator] Broadcast ${e} finalized with ${t.results.length} results`)}finalizeServerBroadcast(e){let t=this.pendingBroadcasts.get(e);!t||t.kind!==`server`||(x(t),this.pendingBroadcasts.delete(e),t.resolve(t.results),this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${e} finalized with ${t.results.length} results`))}},me=class{clients=new Set;authenticatingClients=new Set;clientSubscriptions=new Map;clientFilters=new Map;debug;constructor(e={}){this.debug=e.debug??!1}addAuthenticating(e){this.authenticatingClients.add(e)}removeAuthenticating(e){this.authenticatingClients.delete(e)}isAuthenticating(e){return this.authenticatingClients.has(e)}addClient(e){this.clients.add(e)}removeClient(e){this.clients.delete(e),this.authenticatingClients.delete(e),this.clientSubscriptions.delete(e),this.clientFilters.delete(e),this.debug&&console.info(`[ClientRegistry] Client removed (${this.clients.size} remaining)`)}get size(){return this.clients.size}getAllSockets(){return new Set([...this.clients,...this.authenticatingClients])}handleSubscribeMessage(e,t){let n=this.clientSubscriptions.get(e);n||(n=new Set,this.clientSubscriptions.set(e,n));let r=this.clientFilters.get(e);for(let[i]of Object.entries(t.subjects)){n.add(i);let a=t.filters?.[i];a===void 0?r?.delete(i):(r||(r=new Map,this.clientFilters.set(e,r)),r.set(i,a))}if(this.debug){let e=Object.keys(t.subjects).length,n=t.filters?Object.keys(t.filters).length:0;console.info(`[ClientRegistry] Client subscribed to ${e} subjects, ${n} filters`)}}handleUnsubscribeMessage(e,t){let n=this.clientSubscriptions.get(e),r=this.clientFilters.get(e);for(let e of Object.keys(t))n?.delete(e),r?.delete(e);this.debug&&console.info(`[ClientRegistry] Client unsubscribed from ${Object.keys(t).length} subjects`)}getReadyClients(){let e=[];for(let t of this.clients)t.readyState===1&&e.push(t);return e}getRequestRoutingPriority(e,t,n){let r=this.clientSubscriptions.get(e);return!r||r.size===0?1:this.clientWantsMessage(e,t,n)?2:0}getInterestedClients(e,t,n){let r=[];for(let i of this.clients)i!==n&&i.readyState===1&&this.clientWantsMessage(i,e,t)&&r.push(i);return r}forwardEventToClients(e,t,n){let r=c(t)??void 0,i=`payload`in t?t.payload:void 0,a=JSON.stringify(t),o=this.getInterestedClients(r,i,e);for(let e of o)n(e,a)}clientWantsMessage(e,t,n){return d(t,n,this.clientSubscriptions.get(e)??new Set,this.clientFilters.get(e)??new Map)}};async function S(e,t,n){let r=await Promise.allSettled(Array.from(t).map(t=>t(e,n.receiveContext)));for(let e of r)if(e.status===`rejected`&&n.debug){let t=n.logContext?` ${n.logContext}`:``;console.error(`[ServerTransport] Handler error${t}:`,e.reason)}return r.every(e=>e.status===`fulfilled`)}function he(e,t,n){let{correlations:r,broadcastAggregator:i,debug:a}=t;if(e.type===`heartbeat`)return!0;if(e.type===`response`){let t=e;return typeof t.correlationId==`string`?(t.error?r.reject(t.correlationId,s(t.error)):r.resolve(t.correlationId,t.result),!0):(a&&console.warn(`[ServerTransport] Malformed response message: missing correlationId`),!0)}if(e.type===`broadcast-response`){let t=e;return typeof t.correlationId==`string`?(i.handleResponse(n,t),!0):(a&&console.warn(`[ServerTransport] Malformed broadcast-response: missing correlationId`),!0)}return!1}async function ge(e,t,n){let{registry:r,broadcastAggregator:i,handlers:a,normalizeBroadcastTimeout:o,sendSafely:s,debug:c}=n;if(he(e,n,t))return;let l=n.auth?.getReceiveContext?.(t);if(e.type===`subscribe`){let n=e;if(!p(n.subjects)){c&&console.warn(`[ServerTransport] Malformed subscribe message: missing subjects record`);return}r.handleSubscribeMessage(t,n),await S(n,a,{debug:c,receiveContext:l,logContext:`dispatching subscribe`})&&typeof n.ackId==`string`&&s(t,JSON.stringify({type:`subscription-ack`,ackId:n.ackId}));return}if(e.type===`unsubscribe`){let n=e;if(!p(n.subjects)){c&&console.warn(`[ServerTransport] Malformed unsubscribe message: missing subjects record`);return}r.handleUnsubscribeMessage(t,n.subjects),await S(n,a,{debug:c,receiveContext:l,logContext:`dispatching unsubscribe`})&&typeof n.ackId==`string`&&s(t,JSON.stringify({type:`subscription-ack`,ackId:n.ackId}));return}if(e.type===`broadcast`){let n=e;if(typeof n.correlationId!=`string`||typeof n.subject!=`string`){c&&console.warn(`[ServerTransport] Malformed broadcast message: missing correlationId or subject`);return}let u=r.getInterestedClients(n.subject,n.payload,t),d=o(n.timeout);i.startClientBroadcast(t,n,u,s,d),await S(e,a,{debug:c,receiveContext:l});return}e.type===`event`&&r.forwardEventToClients(t,e,s),await S(e,a,{debug:c,receiveContext:l})}function _e(e,t){let{auth:n,registry:r,debug:i}=t;return async a=>{let o;try{o=JSON.parse(a.toString())}catch(e){i&&console.error(`[ServerTransport] Failed to parse message:`,e);return}let s=o&&typeof o==`object`?o:void 0;if(!s||typeof s.type!=`string`){i&&console.error(`[ServerTransport] Invalid message structure:`,o);return}let c=o;try{if(n?.handleAuthMessage(c,e))return;if(n&&r.isAuthenticating(e)){i&&console.warn(`[ServerTransport] Ignoring message from unauthenticated client`);return}if(n?.isSocketAuthenticated?.(e)===!1){i&&console.warn(`[ServerTransport] Closing socket with expired authentication`),n.cleanupSocket(e),e.close(1008,`Authentication expired`);return}await ge(c,e,t)}catch(e){i&&console.error(`[ServerTransport] Failed to process message:`,e)}}}function ve(e){return typeof e!=`number`||!Number.isFinite(e)||e<=0?5e3:Math.min(e,6e4)}async function ye(e,t){let{registry:n,correlations:r,broadcastAggregator:i,handlers:o,auth:s,serverSubscriptions:c,sendSafely:l,debug:u}=t;s&&n.addAuthenticating(e);let d=_e(e,{registry:n,correlations:r,broadcastAggregator:i,handlers:o,auth:s,normalizeBroadcastTimeout:ve,sendSafely:l,debug:u}),f=e=>{d(e.data)},p=()=>{s?.cleanupSocket(e),n.removeClient(e),e.removeEventListener(`message`,f),e.removeEventListener(`close`,p),e.removeEventListener(`error`,m),i.handleClientDisconnect(e),u&&console.info(`[ServerTransport] Client disconnected (${n.size} remaining)`)},m=e=>{u&&console.error(`[ServerTransport] Client socket error:`,e)};e.addEventListener(`message`,f),e.addEventListener(`close`,p),e.addEventListener(`error`,m);try{if(s&&(await s.authenticateServer(e,t=>{if(e.readyState!==1)throw Error(`Cannot send auth message: socket not ready (state: ${e.readyState})`);e.send(JSON.stringify(t))}),n.removeAuthenticating(e)),e.readyState!==1)return;if(n.addClient(e),c.size>0){let t=a(c);l(e,JSON.stringify(t))}l(e,JSON.stringify({type:`subscribe-sync-complete`})),u&&console.info(`[ServerTransport] Client connected (${n.size} total)`)}catch(t){u&&console.error(`[ServerTransport] Client authentication failed:`,t),e.close(1008,`Authentication failed`)}}async function be(e,t,n){let{registry:a,correlations:o}=n,s=`${e.namespace}.${e.subject}`,c=a.getReadyClients().map(t=>({client:t,priority:a.getRequestRoutingPriority(t,s,e.payload)})).sort((e,t)=>t.priority-e.priority).map(({client:e})=>e);if(c.length===0)throw new r(s);for(let[n,r]of c.entries()){let a=`${e.correlationId}:attempt-${n+1}`,c={...e,correlationId:a};try{r.send(JSON.stringify(c))}catch{continue}try{return await o.track(a,t)}catch(e){if(u(e,s)||e instanceof i)continue;throw e}}throw new r(s)}var C=class{name;wss;auth;debug;handlers=new Set;registry;serverSubscriptions=new Map;broadcastAggregator;correlations=new t;connectionListener=null;constructor(e){let{websocket:t,name:n=`websocket`,auth:r,debug:i=!1}=e;this.wss=t,this.name=n,this.auth=r,this.debug=i,this.registry=new me({debug:i}),this.broadcastAggregator=new pe({debug:i})}sendToClientSafely(e,t){try{e.send(t)}catch(e){this.debug&&console.warn(`[ServerTransport] Failed to send message to client:`,e)}}async connect(){if(this.connectionListener!==null)throw Error(`ServerTransport.connect() called while already connected`);this.connectionListener=e=>{ye(e,{registry:this.registry,correlations:this.correlations,broadcastAggregator:this.broadcastAggregator,handlers:this.handlers,auth:this.auth,serverSubscriptions:this.serverSubscriptions,sendSafely:(e,t)=>this.sendToClientSafely(e,t),debug:this.debug})},this.wss.on(`connection`,this.connectionListener),this.debug&&console.info(`[ServerTransport] Listening for connections`)}async disconnect(){this.connectionListener&&=(this.wss.off(`connection`,this.connectionListener),null);let e=this.registry.getAllSockets();for(let t of e)t.close();await new Promise((e,t)=>{this.wss.close(n=>n?t(n):e())}),this.correlations.cleanup(),this.broadcastAggregator.cleanup(),this.auth?.cleanup(),this.handlers.clear(),this.serverSubscriptions.clear(),this.debug&&console.info(`[ServerTransport] Disconnected`)}async send(e,t){if(e.type===`broadcast`){let n=c(e)??void 0,r=`payload`in e?e.payload:void 0,i=this.registry.getInterestedClients(n,r);return this.broadcastAggregator.startServerBroadcast(e,i,(e,t)=>{this.sendToClientSafely(e,t)},t)}if(e.type===`request`)return be(e,t??n,{registry:this.registry,correlations:this.correlations});if(this.registry.size===0){if(this.debug){let t=c(e);console.debug(`[ServerTransport] No clients to receive ${e.type}${t?`: ${t}`:``}`)}return!1}let r=c(e)??void 0,i=`payload`in e?e.payload:void 0,a=JSON.stringify(e),o=this.registry.getInterestedClients(r,i);for(let e of o)this.sendToClientSafely(e,a);let s=o.length>0;if(!s){if(r&&this.debug&&console.warn(`[ServerTransport] No interested clients for subject: ${r}`),e.type===`response`)return!1;if(!r)throw Error(`No connected clients available to receive message`)}return s}onReceive(e){return this.handlers.add(e),()=>{this.handlers.delete(e)}}cancelRequest(e,t){this.correlations.cancel(e,t)}onBroadcastResults(e,t,n){this.broadcastAggregator.handleNodeResults(e,t,n)}async subscribe(e,t,n=[]){let r=this.serverSubscriptions.get(e)?.filter,i=t??r;if(this.serverSubscriptions.set(e,{filter:i,priorities:n}),this.registry.size>0){let t=a(new Map([[e,{filter:i,priorities:n}]])),r=JSON.stringify(t);for(let e of this.registry.getReadyClients())this.sendToClientSafely(e,r)}}getConnectionCount(){return this.registry.getReadyClients().length}async unsubscribe(e){if(this.serverSubscriptions.delete(e),this.registry.size>0){let t=o({[e]:[]}),n=JSON.stringify(t);for(let e of this.registry.getReadyClients())this.sendToClientSafely(e,n)}}};function xe(e,t){let n=new Event(`close`);return Object.defineProperties(n,{code:{value:e??1e3,enumerable:!0},reason:{value:t??``,enumerable:!0}}),n}function Se(e){if(typeof e!=`object`||!e)throw TypeError(`WebSocket transport options must be an object`);let t=e;if(t.mode!==`client`&&t.mode!==`server`)throw TypeError(`WebSocket transport mode must be "client" or "server"`);if(t.mode===`client`){if(!Ce(t.websocket))throw TypeError(`WebSocket transport client mode requires a websocket with addEventListener/removeEventListener`);return}if(!we(t.websocket))throw TypeError(`WebSocket transport server mode requires a websocket with on/off listener methods`)}function Ce(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.send==`function`&&typeof t.close==`function`&&typeof t.addEventListener==`function`&&typeof t.removeEventListener==`function`}function we(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.on==`function`&&typeof t.off==`function`&&typeof t.close==`function`}var Te=class{secret;algorithm;challengeTimeout;identityId;resolveSecret;resolvePeer;pendingChallenge;pendingResult;queuedChallengeNonce;queuedResult;clientAuthComplete=!1;serverPendingResponses=new Map;serverAuthenticatedSockets=new Set;serverAuthenticatedPeers=new Map;constructor(e){this.secret=e.secret,this.algorithm=e.algorithm??`sha256`,this.challengeTimeout=e.challengeTimeout??5e3,this.identityId=e.identityId,this.resolveSecret=e.resolveSecret,this.resolvePeer=e.resolvePeer}async authenticateServer(e,t){let n=crypto.getRandomValues(new Uint8Array(32)),r=Array.from(n).map(e=>e.toString(16).padStart(2,`0`)).join(``),i=await this.computeHmac(r);t({type:`auth-challenge`,nonce:r});let a=!1;try{let{signature:n,identityId:o}=await this.waitForAuthResponseWithIdentity(e),s;if(this.resolveSecret&&o!==void 0){let i=this.resolveSecret(o);if(i===null)throw this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!1,error:`Unknown identity`}),a=!0,Error(`HMAC authentication failed: Unknown identity '${o}'`);s=await this.computeHmacWithSecret(r,i),this.constantTimeEqual(n,s)&&this.serverAuthenticatedPeers.set(e,o)}else s=i;if(!this.constantTimeEqual(n,s))throw this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!1,error:`Invalid signature`}),a=!0,Error(`HMAC authentication failed: Invalid signature`);this.serverAuthenticatedSockets.add(e),this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!0}),a=!0}catch(n){let r=this.serverPendingResponses.has(e);throw this.serverPendingResponses.delete(e),!a&&r&&this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!1,error:n instanceof Error?n.message:`Authentication failed`}),n}finally{this.serverPendingResponses.delete(e)}}async authenticateClient(e){this.clientAuthComplete=!1;let t=await this.waitForAuthChallenge();e({type:`auth-response`,signature:await this.computeHmac(t),...this.identityId!==void 0&&{identityId:this.identityId}});let n=await this.waitForAuthResult();if(!n.success)throw Error(`HMAC authentication failed: ${n.error??`Unknown error`}`);this.clientAuthComplete=!0}handleAuthMessage(e,t){if(typeof e!=`object`||!e||!(`type`in e)||typeof e.type!=`string`)return!1;let n=e;if(n.type===`auth-challenge`)return typeof n.nonce!=`string`||this.clientAuthComplete||(this.pendingChallenge?(clearTimeout(this.pendingChallenge.timeoutHandle),this.pendingChallenge.resolve(n.nonce),this.pendingChallenge=void 0):this.queuedChallengeNonce=n.nonce),!0;if(n.type===`auth-result`){if(typeof n.success!=`boolean`||this.clientAuthComplete)return!0;let e={success:n.success,error:n.error};return this.pendingResult?(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.resolve(e),this.pendingResult=void 0):this.queuedResult=e,!0}if(n.type===`auth-response`){if(t){let e=this.serverPendingResponses.get(t);e&&(clearTimeout(e.timeoutHandle),e.resolve({signature:n.signature,identityId:n.identityId}))}return!0}return!1}async waitForAuthChallenge(){if(this.queuedChallengeNonce!==void 0){let e=this.queuedChallengeNonce;return this.queuedChallengeNonce=void 0,e}return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingChallenge=void 0,t(Error(`Authentication challenge timeout`))},this.challengeTimeout);this.pendingChallenge={resolve:e,reject:t,timeoutHandle:n}})}async waitForAuthResponseWithIdentity(e){return new Promise((t,n)=>{let r={resolve:t,reject:n,timeoutHandle:setTimeout(()=>{n(Error(`Authentication response timeout`))},this.challengeTimeout)};this.serverPendingResponses.set(e,r)})}async waitForAuthResult(){if(this.queuedResult!==void 0){let e=this.queuedResult;return this.queuedResult=void 0,e}return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingResult=void 0,t(Error(`Authentication result timeout`))},this.challengeTimeout);this.pendingResult={resolve:e,reject:t,timeoutHandle:n}})}async computeHmac(e){return this.computeHmacWithSecret(e,this.secret)}async computeHmacWithSecret(e,t){let n=new TextEncoder,r=n.encode(t),i=this.algorithm.replace(/^sha/,`SHA-`),a=await crypto.subtle.importKey(`raw`,r,{name:`HMAC`,hash:i},!1,[`sign`]),o=await crypto.subtle.sign(`HMAC`,a,n.encode(e));return Array.from(new Uint8Array(o)).map(e=>e.toString(16).padStart(2,`0`)).join(``)}getReceiveContext(e){if(!e)return;let t=this.serverAuthenticatedPeers.get(e);if(t===void 0)return;let n=this.resolvePeer?.(t);if(this.resolvePeer!==void 0&&n===null)return;let r=n??{kind:`workflow-execution`,id:t};return{transportName:``,peer:{...r,id:r.id??t,authenticated:!0}}}isSocketAuthenticated(e){if(!this.serverAuthenticatedSockets.has(e))return!1;if(!this.resolveSecret)return!0;let t=this.serverAuthenticatedPeers.get(e);return t===void 0?!0:this.resolveSecret(t)===null?(this.cleanupSocket(e),!1):!0}constantTimeEqual(e,t){if(e.length!==t.length)return!1;let n=new Uint8Array(e.length/2),r=new Uint8Array(t.length/2);for(let i=0;i<n.length;i++)n[i]=parseInt(e.slice(i*2,i*2+2),16),r[i]=parseInt(t.slice(i*2,i*2+2),16);let i=0;for(let e=0;e<n.length;e++)i|=n[e]^r[e];return i===0}sendAuthResultBestEffort(e,t){try{e(t)}catch{}}cleanupSocket(e){let t=this.serverPendingResponses.get(e);t&&(clearTimeout(t.timeoutHandle),this.serverPendingResponses.delete(e),t.reject(Error(`Socket disconnected during HMAC authentication`))),this.serverAuthenticatedPeers.delete(e),this.serverAuthenticatedSockets.delete(e)}cleanup(){this.pendingChallenge&&=(clearTimeout(this.pendingChallenge.timeoutHandle),void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),void 0),this.queuedChallengeNonce=void 0,this.queuedResult=void 0,this.clientAuthComplete=!1;for(let e of this.serverPendingResponses.values())clearTimeout(e.timeoutHandle);this.serverPendingResponses.clear(),this.serverAuthenticatedPeers.clear(),this.serverAuthenticatedSockets.clear()}};const w=new Map;function Ee(e,t,n={}){if(e.trim().length===0)throw Error(`registerHmacIdentitySecret requires a non-empty identityId`);if(t.length===0)throw Error(`registerHmacIdentitySecret requires a non-empty secret`);let r={secret:t,peerKind:n.peerKind?.trim()||`workflow-execution`};w.set(e,r);let i=!0;return()=>{i&&(i=!1,w.get(e)===r&&w.delete(e))}}function De(e){return w.get(e)?.secret??null}function Oe(e){let t=w.get(e);return t?{kind:t.peerKind,id:e,authenticated:!0}:null}function ke(){w.clear()}function T(e){let t=Array.from(e,e=>String.fromCharCode(e)).join(``);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``)}function E(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=(4-t.length%4)%4;t+=`=`.repeat(n);let r=atob(t),i=new Uint8Array(r.length);for(let e=0;e<r.length;e++)i[e]=r.charCodeAt(e);return i}function D(e){return new TextEncoder().encode(e)}function O(e){return new TextDecoder().decode(e)}async function k(e){let t=await crypto.subtle.exportKey(`spki`,e);return T(new Uint8Array(t))}async function A(e){let t=await crypto.subtle.exportKey(`raw`,e);return T(new Uint8Array(t))}async function j(e,t,n=[]){let r=E(e);return crypto.subtle.importKey(`spki`,r,t,!0,n)}async function M(e,t,n=[]){let r=E(e);return crypto.subtle.importKey(`raw`,r,t,!0,n)}async function N(e){let t=await crypto.subtle.exportKey(`pkcs8`,e),n=T(new Uint8Array(t)).replace(/-/g,`+`).replace(/_/g,`/`),r=(4-n.length%4)%4;return n+=`=`.repeat(r),`-----BEGIN PRIVATE KEY-----\n${n.match(/.{1,64}/g)?.join(`
-`)??n}\n-----END PRIVATE KEY-----`}async function P(e,t,n){let r=E(e.replace(/-----BEGIN PRIVATE KEY-----/,``).replace(/-----END PRIVATE KEY-----/,``).replace(/\s/g,``).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``));return crypto.subtle.importKey(`pkcs8`,r,t,!0,n)}const F={name:`ECDH`,namedCurve:`P-256`};async function I(e=!0){return crypto.subtle.generateKey(F,e,[`deriveKey`,`deriveBits`])}async function L(e){return k(e)}async function Ae(e){return A(e)}async function je(e){return M(e,F)}async function R(e,t=[]){return j(e,F,t)}async function Me(e){return N(e)}async function Ne(e){return P(e,F,[`deriveKey`,`deriveBits`])}async function z(e,t){return crypto.subtle.deriveBits({name:`ECDH`,public:t},e,256)}async function B(e,t){let n=crypto.getRandomValues(new Uint8Array(12)),r=await crypto.subtle.encrypt({name:`AES-GCM`,iv:n},e,t);return{ciphertext:new Uint8Array(r),nonce:n}}async function V(e,t,n){let r=await crypto.subtle.decrypt({name:`AES-GCM`,iv:n},e,t);return new Uint8Array(r)}async function Pe(e){return crypto.subtle.importKey(`raw`,e,{name:`AES-GCM`},!1,[`encrypt`,`decrypt`])}async function H(e,t,n){let r=await crypto.subtle.importKey(`raw`,e,{name:`HKDF`},!1,[`deriveKey`]);return crypto.subtle.deriveKey({name:`HKDF`,hash:`SHA-256`,salt:t,info:D(n)},r,{name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`])}const U={name:`ECDSA`,namedCurve:`P-256`};async function Fe(e=!0){return crypto.subtle.generateKey(U,e,[`sign`,`verify`])}async function W(e,t){let n=await crypto.subtle.sign({name:`ECDSA`,hash:{name:`SHA-256`}},e,t);return new Uint8Array(n)}async function G(e,t,n){return crypto.subtle.verify({name:`ECDSA`,hash:{name:`SHA-256`}},e,t,n)}async function Ie(e){return k(e)}async function Le(e){return j(e,U,[`verify`])}async function Re(e){return A(e)}async function ze(e){return M(e,U,[`verify`])}async function Be(e){return N(e)}async function Ve(e){return P(e,U,[`sign`])}var He=e({decodeText:()=>O,decrypt:()=>V,deriveSessionKey:()=>H,deriveSharedSecret:()=>z,encodeText:()=>D,encrypt:()=>B,exportPrivateKeyPEM:()=>Me,exportPublicKey:()=>L,exportPublicKeyRaw:()=>Ae,exportSigningPrivateKeyPEM:()=>Be,exportSigningPublicKey:()=>Ie,exportSigningPublicKeyRaw:()=>Re,fromBase64Url:()=>E,generateECDHKeyPair:()=>I,generateSigningKeyPair:()=>Fe,importAESKey:()=>Pe,importPrivateKeyPEM:()=>Ne,importPublicKey:()=>R,importPublicKeyRaw:()=>je,importSigningPrivateKeyPEM:()=>Ve,importSigningPublicKey:()=>Le,importSigningPublicKeyRaw:()=>ze,sign:()=>W,toBase64Url:()=>T,verify:()=>G});function K(e){let t=e.match(/.{1,2}/g);return new Uint8Array(t?.map(e=>parseInt(e,16))??[])}function q(e){return Array.from(e).map(e=>e.toString(16).padStart(2,`0`)).join(``)}async function J(e,t){let n=await I(!0),r=await L(n.publicKey);return{ephemeralKeyPair:n,ephemeralPublicKey:r,signature:q(await W(e,D(r+t)))}}function Ue(){return q(crypto.getRandomValues(new Uint8Array(16)))}async function Y(e,t,n,r){let i=D(t+r);return G(e,K(n),i)}async function X(e,t,n,r){return H(await z(e,await R(t)),K(n),r)}async function We(e,t,n,r){if(e===t)throw Error(`deriveRelaySaltHex: identityId must differ from peerId`);let[i,a]=e<t?[e,t]:[t,e],[o,s]=e<t?[n,r]:[r,n],c=D(`${i}${a}${o}${s}`),l=new Uint8Array(c).buffer,u=await crypto.subtle.digest(`SHA-256`,l);return q(new Uint8Array(u))}var Ge=class{signingKeyPair;identityId;peerId;getPeerSigningKey;timeout;pendingKeyExchange;pendingResult;clientSession;clientEphemeralKeyPair;serverPendingKeyExchange=new Map;serverSessions=new Map;serverEphemeralKeyPairs=new Map;constructor(e){this.signingKeyPair=e.signingKeyPair,this.identityId=e.identityId,this.peerId=e.peerId,this.getPeerSigningKey=e.getPeerSigningKey,this.timeout=e.timeout??1e4}async authenticateClient(e){if(!this.peerId)throw Error(`E2E authentication failed: peerId is required for client authentication`);let{ephemeralKeyPair:t,ephemeralPublicKey:n,signature:r}=await J(this.signingKeyPair.privateKey,this.identityId);this.clientEphemeralKeyPair=t;try{let i=this.waitForKeyExchangeResponse(),a=this.waitForAuthResult();e({type:`e2e-key-exchange`,deviceId:this.identityId,ephemeralPublicKey:n,signature:r});let o=await i,s=await this.getPeerSigningKey(this.peerId);if(!s)throw Error(`E2E authentication failed: Unknown server`);if(!await Y(s,o.ephemeralPublicKey,o.signature,this.peerId))throw Error(`E2E authentication failed: Invalid server signature`);let c=await X(t.privateKey,o.ephemeralPublicKey,o.salt,`makaio-e2e-session-v1`);this.clientSession={sessionKey:c,peerId:this.peerId};let l=await a;if(!l.success)throw Error(`E2E authentication failed: ${l.error??`Unknown error`}`)}catch(e){throw this.pendingKeyExchange&&=(clearTimeout(this.pendingKeyExchange.timeoutHandle),void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),void 0),this.clientSession=void 0,this.clientEphemeralKeyPair=void 0,e}}async authenticateServer(e,t){try{let n=await this.waitForClientKeyExchange(e),r=await this.getPeerSigningKey(n.deviceId);if(!r)throw t({type:`e2e-auth-result`,success:!1,error:`Unknown device`}),Error(`E2E authentication failed: Unknown device ${n.deviceId}`);if(!await Y(r,n.ephemeralPublicKey,n.signature,n.deviceId))throw t({type:`e2e-auth-result`,success:!1,error:`Invalid signature`}),Error(`E2E authentication failed: Invalid client signature`);let{ephemeralKeyPair:i,ephemeralPublicKey:a,signature:o}=await J(this.signingKeyPair.privateKey,this.identityId),s=Ue();this.serverEphemeralKeyPairs.set(e,i),t({type:`e2e-key-exchange-response`,ephemeralPublicKey:a,signature:o,salt:s});let c=await X(i.privateKey,n.ephemeralPublicKey,s,`makaio-e2e-session-v1`);this.serverSessions.set(e,{sessionKey:c,peerId:n.deviceId}),t({type:`e2e-auth-result`,success:!0})}catch(n){throw this.serverPendingKeyExchange.delete(e),this.serverEphemeralKeyPairs.delete(e),t({type:`e2e-auth-result`,success:!1,error:n instanceof Error?n.message:`Authentication failed`}),n}finally{this.serverPendingKeyExchange.delete(e)}}handleAuthMessage(e,t){if(typeof e!=`object`||!e||!(`type`in e)||typeof e.type!=`string`)return!1;let n=e;if(n.type===`e2e-key-exchange-response`)return this.pendingKeyExchange&&=(clearTimeout(this.pendingKeyExchange.timeoutHandle),this.pendingKeyExchange.resolve({ephemeralPublicKey:n.ephemeralPublicKey,signature:n.signature,salt:n.salt}),void 0),!0;if(n.type===`e2e-auth-result`)return this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.resolve({success:n.success,error:n.error}),void 0),!0;if(n.type===`e2e-key-exchange`&&t){let e=this.serverPendingKeyExchange.get(t);return e&&(clearTimeout(e.timeoutHandle),e.resolve({deviceId:n.deviceId,ephemeralPublicKey:n.ephemeralPublicKey,signature:n.signature})),!0}return!1}async waitForKeyExchangeResponse(){return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingKeyExchange=void 0,t(Error(`E2E key exchange timeout`))},this.timeout);this.pendingKeyExchange={resolve:e,reject:t,timeoutHandle:n}})}async waitForAuthResult(){return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingResult=void 0,t(Error(`E2E authentication result timeout`))},this.timeout);this.pendingResult={resolve:e,reject:t,timeoutHandle:n}})}async waitForClientKeyExchange(e){return new Promise((t,n)=>{let r={resolve:t,reject:n,timeoutHandle:setTimeout(()=>{this.serverPendingKeyExchange.delete(e),n(Error(`E2E key exchange timeout`))},this.timeout)};this.serverPendingKeyExchange.set(e,r)})}getSessionKey(e){return e?this.serverSessions.get(e)?.sessionKey??null:this.clientSession?.sessionKey??null}getPeerId(e){return e?this.serverSessions.get(e)?.peerId??null:this.clientSession?.peerId??null}getReceiveContext(e){let t=this.getPeerId(e);if(t!==null)return{transportName:``,peer:{kind:`e2e`,id:t,authenticated:!0,encrypted:!0}}}cleanupSocket(e){let t=this.serverPendingKeyExchange.get(e);t&&(clearTimeout(t.timeoutHandle),this.serverPendingKeyExchange.delete(e)),this.serverSessions.delete(e),this.serverEphemeralKeyPairs.delete(e)}cleanup(){this.pendingKeyExchange&&=(clearTimeout(this.pendingKeyExchange.timeoutHandle),void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),void 0),this.clientSession=void 0,this.clientEphemeralKeyPair=void 0;for(let e of this.serverPendingKeyExchange.values())clearTimeout(e.timeoutHandle);this.serverPendingKeyExchange.clear(),this.serverSessions.clear(),this.serverEphemeralKeyPairs.clear()}};const Z=`E2E relay auth session aborted by reconnect`;var Ke=class{signingKeyPair;identityId;getPeerSigningKey;timeout;mode;blocking;pendingPeer;sessionKey;peerId;localEphemeral;localExchangeMessage;sentLocalExchange=!1;earlyPeer;sendAuthMessage;authGeneration=0;processingExchange=!1;constructor(e){this.signingKeyPair=e.signingKeyPair,this.identityId=e.identityId,this.getPeerSigningKey=e.getPeerSigningKey,this.timeout=e.timeout??1e4,this.mode=e.mode??`initiator`,this.blocking=e.blocking??!0}async authenticateClient(e){let t=this.sendAuthMessage===void 0?this.earlyPeer:void 0;this.cleanup();let n=this.authGeneration;if(this.earlyPeer=t,this.sendAuthMessage=e,this.mode===`initiator`){if(await this.ensureLocalExchangeMessage(),n!==this.authGeneration)throw Error(Z);this.sendLocalExchange()}if(!this.blocking){if(this.earlyPeer){let e=this.earlyPeer;this.earlyPeer=void 0,this.dispatchPeerExchange(e,n)}return}let r=await this.waitForPeerExchange();if(await this.processPeerExchange(r,n),n!==this.authGeneration||!this.sessionKey)throw Error(Z)}async authenticateServer(e,t){throw Error(`E2ERelayAuth does not support server authentication`)}handleAuthMessage(e){let t=e;return!t||t.type!==`e2e-relay-key-exchange`?!1:t.identityId===this.identityId?!0:this.pendingPeer?(this.pendingPeer.resolve(t),this.pendingPeer=void 0,!0):(this.earlyPeer=t,!this.blocking&&this.sendAuthMessage&&!this.sessionKey&&!this.processingExchange&&this.dispatchPeerExchange(t,this.authGeneration),!0)}cleanupSocket(e){}cleanup(){this.authGeneration++,this.pendingPeer&&=(this.pendingPeer.reject(Error(Z)),void 0),this.earlyPeer&&=void 0,this.sessionKey=void 0,this.peerId=void 0,this.localEphemeral=void 0,this.localExchangeMessage=void 0,this.sentLocalExchange=!1,this.processingExchange=!1,this.sendAuthMessage=void 0}dispatchPeerExchange(e,t){this.processingExchange=!0,this.processPeerExchange(e,t).catch(e=>{e instanceof Error&&e.message===Z||console.error(`[E2ERelayAuth] Peer exchange failed:`,e)}).finally(()=>{t===this.authGeneration&&(this.processingExchange=!1,this.retryQueuedPeerExchange(t))})}getSessionKey(){return this.sessionKey??null}getPeerId(){return this.peerId??null}getReceiveContext(){let e=this.getPeerId();if(e!==null)return{transportName:``,peer:{kind:`e2e`,id:e,authenticated:!0,encrypted:!0}}}async waitForPeerExchange(){if(this.earlyPeer){let e=this.earlyPeer;return this.earlyPeer=void 0,e}return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingPeer=void 0,t(Error(`E2E relay key exchange timeout`))},this.timeout),r=()=>{clearTimeout(n),this.pendingPeer=void 0};this.pendingPeer={resolve:t=>{r(),e(t)},reject:e=>{r(),t(e)},timeoutHandle:n}})}async ensureLocalExchangeMessage(){if(this.localExchangeMessage&&this.localEphemeral)return this.localExchangeMessage;let{ephemeralKeyPair:e,ephemeralPublicKey:t,signature:n}=await J(this.signingKeyPair.privateKey,this.identityId);return this.localEphemeral=e,this.localExchangeMessage={type:`e2e-relay-key-exchange`,identityId:this.identityId,ephemeralPublicKey:t,signature:n},this.localExchangeMessage}sendLocalExchange(e=!1){!this.sendAuthMessage||!this.localExchangeMessage||!e&&this.sentLocalExchange||(this.sendAuthMessage(this.localExchangeMessage),this.sentLocalExchange=!0)}retryQueuedPeerExchange(e){if(this.blocking||!this.sendAuthMessage||this.sessionKey||this.processingExchange||e!==this.authGeneration)return;let t=this.earlyPeer;t&&(this.earlyPeer=void 0,this.dispatchPeerExchange(t,e))}async processPeerExchange(e,t){if(!this.sendAuthMessage){this.earlyPeer=e;return}let n=await this.ensureLocalExchangeMessage();if(t!==this.authGeneration)return;let r=await this.getPeerSigningKey(e.identityId);if(!r)throw Error(`E2E relay authentication failed: Unknown peer ${e.identityId}`);if(!await Y(r,e.ephemeralPublicKey,e.signature,e.identityId))throw Error(`E2E relay authentication failed: Invalid peer signature`);let i=await We(this.identityId,e.identityId,n.ephemeralPublicKey,e.ephemeralPublicKey);if(!this.localEphemeral)throw Error(`E2E relay authentication failed: Local ephemeral key missing`);let a=await X(this.localEphemeral.privateKey,e.ephemeralPublicKey,i,`makaio-e2e-relay-v1`);t===this.authGeneration&&(this.sessionKey=a,this.peerId=e.identityId,this.mode===`initiator`?this.sendLocalExchange(!0):this.sendLocalExchange())}},qe=class{hmac;e2e;socketStrategy=new Map;pendingServerAuth=new Map;hmacCancelled=new Map;constructor(e){this.hmac=e.hmac,this.e2e=e.e2e}setE2EAuth(e){this.e2e=e}async authenticateClient(e){let t=this.hmac??this.e2e;if(!t)throw Error(`DispatchingAuth: no auth strategy configured`);return t.authenticateClient(e)}async authenticateServer(e,t){let n=this.resolveSingleStrategy();if(n)return n.authenticateServer(e,t);if(!this.hmac||!this.e2e)throw Error(`DispatchingAuth: no auth strategy configured`);let r={cancelled:!1};this.hmacCancelled.set(e,r);let i=this.hmac.authenticateServer(e,e=>{r.cancelled||t(e)});return new Promise((n,a)=>{this.pendingServerAuth.set(e,{resolve:n,reject:a,send:t}),i.then(n).catch(e=>{r.cancelled||a(e instanceof Error?e:Error(String(e)))})})}handleAuthMessage(e,t){if(!t)return(this.hmac??this.e2e)?.handleAuthMessage(e)??!1;let n=this.socketStrategy.get(t);if(n)return n.handleAuthMessage(e,t);let r=this.resolveStrategy(e),i=this.pendingServerAuth.get(t);return r?(this.socketStrategy.set(t,r),this.pendingServerAuth.delete(t),r===this.hmac?this.hmacCancelled.delete(t):(this.cancelHmac(t),i&&r.authenticateServer(t,i.send).then(i.resolve).catch(e=>{i.reject(e instanceof Error?e:Error(String(e)))})),r.handleAuthMessage(e,t)):(this.cancelHmac(t),i&&(this.pendingServerAuth.delete(t),i.reject(Error(`DispatchingAuth: unrecognised auth message type "${this.peekType(e)}" — no matching strategy`))),!1)}cleanupSocket(e){let t=this.socketStrategy.get(e);t&&(t.cleanupSocket(e),this.socketStrategy.delete(e)),this.cancelHmac(e);let n=this.pendingServerAuth.get(e);n&&(this.pendingServerAuth.delete(e),n.reject(Error(`DispatchingAuth: socket disconnected before auth type was determined`)))}cleanup(){this.hmac?.cleanup(),this.e2e?.cleanup(),this.socketStrategy.clear();for(let e of this.pendingServerAuth.values())e.reject(Error(`DispatchingAuth: cleanup called before authentication completed`));this.pendingServerAuth.clear(),this.hmacCancelled.clear()}peekType(e){if(typeof e!=`object`||!e||!(`type`in e))return;let{type:t}=e;return typeof t==`string`?t:void 0}resolveSingleStrategy(){if(this.hmac&&!this.e2e)return this.hmac;if(this.e2e&&!this.hmac)return this.e2e}resolveStrategy(e){let t=this.peekType(e);if(t){if(t===`e2e-key-exchange`&&this.e2e)return this.e2e;if(t===`auth-response`&&this.hmac)return this.hmac}}cancelHmac(e){let t=this.hmacCancelled.get(e);t&&(t.cancelled=!0,this.hmacCancelled.delete(e),this.hmac?.cleanupSocket(e))}};function Je(e){return`payload`in e}async function Ye(e,t,n){if(e.type!==`response`||e.result===void 0||e.error!==void 0)return;let{ciphertext:r,nonce:i}=await B(n,D(JSON.stringify(e.result)));t.result=T(r),t.e2e={nonce:T(i),v:1}}async function Xe(e,t,n){if(e.type!==`broadcast-response`||e.results===void 0||e.error!==void 0)return;let{ciphertext:r,nonce:i}=await B(n,D(JSON.stringify(e.results)));t.results=T(r),t.e2e={nonce:T(i),v:1}}async function Ze(e,t,n){if(!Je(e)||e.payload===void 0)return;let{ciphertext:r,nonce:i}=await B(n,D(JSON.stringify(e.payload)));t.payload=T(r),t.e2e={nonce:T(i),v:1}}async function Qe(e,t,n){if(e.type!==`response`&&e.type!==`broadcast-response`||e.error===void 0)return;let{ciphertext:r,nonce:i}=await B(n,D(JSON.stringify(e.error)));t.error=T(r),t.e2e={nonce:T(i),v:1}}async function $e(e,t,n,r){if(!Je(e)||typeof e.payload!=`string`)return;let i=O(await V(n,E(e.payload),r));t.payload=JSON.parse(i)}async function et(e,t,n,r){if(e.type!==`response`||typeof e.result!=`string`)return;let i=O(await V(n,E(e.result),r));t.result=JSON.parse(i)}async function tt(e,t,n,r){if(e.type!==`broadcast-response`||typeof e.results!=`string`)return;let i=O(await V(n,E(e.results),r));t.results=JSON.parse(i)}async function nt(e,t,n,r){if(e.type!==`response`&&e.type!==`broadcast-response`||typeof e.error!=`string`)return;let i=O(await V(n,E(e.error),r));t.error=JSON.parse(i)}async function rt(e,t){let n={...e};return await Ze(e,n,t),await Ye(e,n,t),await Xe(e,n,t),await Qe(e,n,t),n}async function it(e,t){if(!e.e2e)return e;let n={...e};delete n.e2e;let r=E(e.e2e.nonce);return await $e(e,n,t,r),await et(e,n,t,r),await tt(e,n,t,r),await nt(e,n,t,r),n}function at(e){return e.type===`subscription-ack`&&typeof e.ackId==`string`}function ot(e){let{e2eAuth:t,websocket:n,...r}=e,i=new b({...r,url:`<pre-connected>`,createWebSocket:()=>n,auth:t,autoReconnect:!1,messageTransform:async e=>{let n=t.getSessionKey();if(!n||at(e))return e;let r=e;if(!r.e2e)throw Error(`Received plaintext message on E2E-encrypted channel — possible injection`);return it(r,n)}});async function a(e,n){let r=t.getSessionKey();if(!r)throw Error(`E2E session key not available - authentication may have failed`);let a=await rt(e,r);return i.send(a,n)}return{name:i.name,connect:i.connect.bind(i),disconnect:i.disconnect.bind(i),send:a,cancelRequest:i.cancelRequest.bind(i),onReceive:i.onReceive.bind(i),subscribe:i.subscribe.bind(i),unsubscribe:i.unsubscribe.bind(i),getSubscriptions:i.getSubscriptions.bind(i)}}function st(e){return ot(e)}function ct(e){if(!e||typeof e!=`object`)return!1;let t=e;if(t.type!==`e2e-relay-envelope`||typeof t.payload!=`string`)return!1;let n=t.e2e;return!!n&&typeof n.nonce==`string`&&typeof n.v==`number`}async function lt(e,t){let{ciphertext:n,nonce:r}=await B(t,D(JSON.stringify(e)));return{type:`e2e-relay-envelope`,payload:T(n),e2e:{nonce:T(r),v:1}}}async function ut(e,t){let n=E(e.e2e.nonce),r=O(await V(t,E(e.payload),n));return JSON.parse(r)}function dt(e){let t=()=>{if(!e.isFrozen())throw Error(`RelayControlRegistry must be frozen before processing relay control messages`)};function n(t){return typeof t.namespace!=`string`||typeof t.subject!=`string`||!e.isControlEvent(t.namespace,t.subject)||typeof t.messageId!=`string`?!1:t.payload!==void 0}function r(t){return typeof t.namespace!=`string`||typeof t.subject!=`string`||!e.isControlRequest(t.namespace,t.subject)||typeof t.messageId!=`string`||typeof t.correlationId!=`string`?!1:t.payload!==void 0}function i(e){if(t(),!e||typeof e!=`object`)return!1;let i=e;return i.type===`event`?n(i):i.type===`request`?r(i):!1}function a(e){if(t(),!e||typeof e!=`object`)return!1;let n=e;return n.type!==`relay-control`||n.v!==1||!n.payload||typeof n.payload!=`object`?!1:i(n.payload)}function o(e){if(t(),!i(e))throw Error(`Invalid relay control message`);return{type:`relay-control`,v:1,payload:e}}return{createRelayControlEnvelope:o,isRelayControlEnvelopeMessage:a,isRelayControlBusMessage:i}}function Q(e){let t=Date.now()-3e5;for(let[n,r]of e)r>=t||e.delete(n);for(;e.size>2048;){let t=e.keys().next().value;if(!t)break;e.delete(t)}}const ft=e=>{if(!e||typeof e!=`object`)return!1;let t=e;return t.type===`response`&&typeof t.correlationId==`string`},pt=e=>e.type===`subscribe`||e.type===`unsubscribe`,mt=e=>{if(!e||typeof e!=`object`)return!1;let t=e;return t.type===`subscription-ack`&&typeof t.ackId==`string`};function $(e,t,n,r){if(!r.isFrozen())throw Error(`E2ERelay transport requires a frozen relay control registry`);let{createRelayControlEnvelope:i,isRelayControlEnvelopeMessage:a,isRelayControlBusMessage:o}=dt(r),s=e=>{n.delete(e),n.set(e,Date.now()),Q(n)};return{encode:async t=>{if(o(t))return t.type===`request`&&s(t.correlationId),JSON.stringify(i(t));if(Q(n),t.type===`response`&&n.has(t.correlationId))return n.delete(t.correlationId),JSON.stringify(t);let r=e.getSessionKey();if(!r&&pt(t)||!r&&mt(t))return JSON.stringify(t);if(!r)throw Error(`E2E relay session not established`);let a=await lt(t,r);return JSON.stringify(a)},decode:async r=>{let i=e.getSessionKey();if(a(r)){let e=r.payload;return t&&console.info(`[E2ERelayTransport] Decoded relay control envelope:`,e.type,e.namespace,e.subject),e.type===`request`&&s(e.correlationId),e}if(Q(n),ft(r)&&n.has(r.correlationId))return n.delete(r.correlationId),r;if(!i&&mt(r))return r;if(!i)throw Error(`E2E relay session not established`);if(!ct(r))throw Error(`Received plaintext message on relay E2E channel — possible injection`);return ut(r,i)}}}function ht(e,t,n=!1){let r=new Map;return{codec:$(e,n,r,t),reset:()=>r.clear()}}function gt(e){let{e2eAuth:t,registry:n,websocket:r,...i}=e,a=e.debug??!1,o=new Map,s=$(t,a,o,n);a&&console.info(`[E2ERelayTransport] Creating inner transport...`);let c=new b({...i,url:`<pre-connected>`,createWebSocket:()=>r,auth:t,codec:s,autoReconnect:!1});return a&&console.info(`[E2ERelayTransport] Inner transport created`),{name:c.name,connect:async()=>{if(!n.isFrozen())throw Error(`E2ERelayClientTransport: registry must be frozen before connect()`);o.clear();try{await c.connect()}catch(e){throw o.clear(),e}},disconnect:async()=>{o.clear();try{await c.disconnect()}finally{o.clear()}},send:c.send.bind(c),cancelRequest:c.cancelRequest.bind(c),onReceive:(...e)=>(a&&console.info(`[E2ERelayTransport] onReceive called, delegating to inner transport`),c.onReceive(...e)),subscribe:c.subscribe.bind(c),unsubscribe:c.unsubscribe.bind(c),getSubscriptions:c.getSubscriptions.bind(c),isReady:()=>!!t.getSessionKey()&&c.isReady()}}function _t(){let e=!1,t=new Map,n=new Map,r=()=>{if(e)throw Error(`RelayControlRegistry is frozen and cannot be modified`)};return{registerEventSubjects(e,n){r();let i=t.get(e)??new Set;for(let e of n)i.add(e);t.set(e,i)},registerRequestNamespace(e,t){if(r(),t.length===0)throw Error(`RelayControlRegistry request namespace "${e}" requires at least one subject`);let i=n.get(e)??new Set;for(let e of t)i.add(e);n.set(e,i)},freeze(){e=!0},isFrozen(){return e},isControlEvent(e,n){return t.get(e)?.has(n)??!1},isControlRequest(e,t){return n.get(e)?.has(t)??!1}}}function vt(e){if(Se(e),e.mode===`client`){if(e.connectionOptions!==void 0)throw Error(`createWebSocketTransport(client) does not support connectionOptions when wrapping a pre-created WebSocket. Use WebSocketClientTransport for reconnect or dial-time socket options.`);let t=e.websocket;return new b({url:`<pre-connected>`,createWebSocket:()=>t,auth:e.auth,debug:e.debug,autoReconnect:!1})}else return new C({websocket:e.websocket,auth:e.auth,debug:e.debug})}export{qe as DispatchingAuth,Ge as E2EAuth,Ke as E2ERelayAuth,Te as HmacAuth,C as ServerTransport,b as WebSocketClientTransport,ke as clearHmacIdentitySecretsForTesting,st as createE2EClientTransport,gt as createE2ERelayClientTransport,ht as createE2ERelayCodec,dt as createRelayControlHelpers,_t as createRelayControlRegistry,xe as createWebSocketCloseEvent,vt as createWebSocketTransport,He as crypto,h as extractSocketErrorMessage,Ee as registerHmacIdentitySecret,Oe as resolveHmacIdentityPeer,De as resolveHmacIdentitySecret};
+import{r as e}from"../../chunk-DTipWd-i.mjs";import{ConnectionLostError as t,CorrelationTracker as n,DEFAULT_REQUEST_TIMEOUT_MS as r,NoHandlerError as i,TimeoutError as a,buildSubscribeMessage as o,buildUnsubscribeMessage as s,deserializeTransportError as c,getSubjectFromBusMessage as l,handleCorrelationResponse as u,isNoHandlerErrorForSubject as d,shouldReceiveMessage as f,trackMessageCorrelation as p}from"@makaio/framework/bus";import{isRecord as m}from"@makaio/framework/utils";const h={baseMs:1e3,maxMs:1e4};function ee(e,t,n){let r=Math.max(t,100),i=Math.max(n,r);return Math.min(r*2**e,i)}function te(e,t){return new Promise(n=>{if(t.aborted){n();return}let r=()=>{clearTimeout(i),t.removeEventListener(`abort`,r),n()},i=setTimeout(()=>{t.removeEventListener(`abort`,r),n()},e);t.addEventListener(`abort`,r)})}const ne={encode:async e=>JSON.stringify(e),decode:async e=>e};function re(e){return e===!1?!1:{baseMs:e?.baseMs??h.baseMs,maxMs:e?.maxMs??h.maxMs}}function ie(e,t=`unknown error`){return`message`in e?String(e.message):t}async function g(e,t,n){let r=await t.encode(e);n.send(r)}function ae(e){return e.readyState===1?Promise.resolve():e.readyState>=2?Promise.reject(Error(`WebSocket closed before opening`)):new Promise((t,n)=>{let r=()=>{e.removeEventListener(`open`,i),e.removeEventListener(`error`,a),e.removeEventListener(`close`,o)},i=()=>{r(),t()},a=e=>{r(),n(Error(`WebSocket connection failed — ${ie(e)}`))},o=()=>{r(),n(Error(`WebSocket closed before opening`))};e.addEventListener(`open`,i),e.addEventListener(`error`,a),e.addEventListener(`close`,o)})}async function oe(e,t,n){let r=await Promise.allSettled(Array.from(t).map(t=>t(e,n.receiveContext)));for(let e of r)e.status===`rejected`&&n.debug&&console.error(`[WebSocketClientTransport:${n.name}] Handler error:`,e.reason);return r.every(e=>e.status===`fulfilled`)}function se(e,t){return{...t?.getReceiveContext?.(),transportName:e}}async function ce(e,t){let{name:n,debug:r,auth:i,codec:a,messageTransform:o,correlations:s}=t,c=JSON.parse(e.toString());if(typeof c!=`object`||!c||typeof c.type!=`string`)return r&&console.error(`[WebSocketClientTransport:${n}] Invalid message structure:`,c),null;let l=c;if(i?.handleAuthMessage(l)||l.type===`heartbeat`)return null;let d=await a.decode(l);return o&&(d=await o(d)),d.type===`heartbeat`?null:d.type===`subscribe-sync-complete`?(t.onSyncComplete(),null):d.type===`subscription-ack`?(typeof d.ackId==`string`&&t.onSubscriptionAck(d.ackId),null):u(d,s)?null:d}async function le(e,t){let{name:n,debug:r,auth:i,handlers:a}=t,o=null;try{o=await ce(e,t)}catch(e){r&&console.error(`[WebSocketClientTransport:${n}] Failed to parse message:`,e);return}if(o===null)return;let s=se(n,i),c=o;oe(c,a,{debug:r,name:n,receiveContext:s}).then(async e=>{e&&(c.type===`subscribe`||c.type===`unsubscribe`)&&typeof c.ackId==`string`&&await t.sendSubscriptionAck(c.ackId)}).catch(e=>{r&&console.error(`[WebSocketClientTransport:${n}] Handler dispatch error:`,e)})}async function _(e){await Promise.allSettled(e.inFlightMessages),e.correlations.rejectAll(new t(e.name))}function ue(e,t){let n=n=>{let r=le(n.data,{name:t.name,debug:t.debug,auth:t.auth,codec:t.codec,messageTransform:t.messageTransform,correlations:t.correlations,handlers:t.handlers,onSyncComplete:()=>{t.resolveReady()},onSubscriptionAck:e=>{t.resolveSubscriptionAck(e)},sendSubscriptionAck:async n=>{e.readyState===1&&await g({type:`subscription-ack`,ackId:n},t.codec,e)}}).finally(()=>{t.inFlightMessages.delete(r)});t.inFlightMessages.add(r)};t.setMessageListener(n),e.addEventListener(`message`,n)}function v(e,t){let n=t.getMessageListener();n!==null&&(e.removeEventListener(`message`,n),t.setMessageListener(null));let r=t.getCloseListener();r!==null&&(e.removeEventListener(`close`,r),t.setCloseListener(null))}async function y(e){await _(e),e.inFlightMessages.clear(),e.resolveReady(),e.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: reconnecting before subscription ack`)),e.resetReadyPromise();let t=e.getSocket();t!==null&&v(t,e);let n=await e.wsFactory(e.url);e.setSocket(n),e.setAuthComplete(!1);try{ue(n,e),await ae(n),e.auth&&await e.auth.authenticateClient(e=>{if(n.readyState!==1)throw Error(`WebSocketClientTransport: cannot send auth message — socket not open`);n.send(JSON.stringify(e))}),e.setAuthComplete(!0),e.debug&&console.info(`[WebSocketClientTransport:${e.name}] Connected to ${e.url}`),e.localSubscriptions.size>0&&(await g(o(e.localSubscriptions),e.codec,n),e.debug&&console.info(`[WebSocketClientTransport:${e.name}] Replayed ${e.localSubscriptions.size} subscription(s)`)),e.notifyConnected()}catch(t){let r=e.getSocket()===n;throw r&&e.auth?.cleanup(),v(n,e),r&&e.setSocket(null),e.setAuthComplete(!1),r&&(n.readyState===0||n.readyState===1)&&n.close(),t}}function b(e,t){return new Promise(n=>{if(e.readyState===3||t.aborted){n();return}let r=()=>{t.removeEventListener(`abort`,i),n()},i=()=>{e.removeEventListener(`close`,r),n()};e.addEventListener(`close`,r),t.addEventListener(`abort`,i)})}async function de(e,t,n,r,i){i(!0);try{for(;!e.aborted;){let i=n.getSocket(),a=i!==null;if(i!==null&&i.readyState!==3&&await b(i,e),e.aborted)break;a&&(await _(n),n.debug&&console.info(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Connection lost, starting reconnect loop (maxMs=${t.maxMs})`),n.notifyDisconnected());let o=0;for(;!e.aborted;){let i=ee(o,t.baseMs,t.maxMs);n.debug&&console.info(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Reconnecting in ${i}ms (attempt ${o+1})`);let a=new AbortController;if(r(a),await te(i,AbortSignal.any([e,a.signal])),r(null),e.aborted)break;try{await y(n),o=0;let t=n.getSocket();if(t!==null){let r=async()=>{await _(n),n.auth?.cleanup(),n.setAuthComplete(!1),n.debug&&console.info(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Connection closed`),n.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: disconnected before subscription ack`))};n.setCloseListener(r),t.addEventListener(`close`,r),await b(t,e)}break}catch(e){if(n.debug){let t=e instanceof Error?e.message:String(e);console.warn(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Connect attempt ${o+1} failed: ${t}`)}o++}}}}finally{i(!1)}}function fe(e,t,n){let r=async()=>{await _(t),t.auth?.cleanup(),v(e,t),t.setAuthComplete(!1),t.setSocket(null),n(),t.resolveReady(),t.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: disconnected before subscription ack`)),t.notifyDisconnected()};t.setCloseListener(r),e.addEventListener(`close`,r)}async function pe(e,t,n,r){let i=r.localSubscriptions.get(e)?.filter,a=t??i;if(r.localSubscriptions.set(e,{filter:a,priorities:n}),r.socket!==null&&r.socket.readyState===1){let t=r.beginSubscriptionAck?.(),i=o(new Map([[e,{filter:a,priorities:n}]]),t?.ackId);try{await g(i,r.codec,r.socket),await t?.promise}catch(e){throw t?.reject(e),e}}r.debug&&console.info(`[WebSocketClientTransport:${r.name}] Subscribed to ${e}${a?` with filter`:``}`)}async function me(e,t){let n=t.localSubscriptions.get(e);if(t.localSubscriptions.delete(e),t.socket!==null&&t.socket.readyState===1){let r=t.beginSubscriptionAck?.(),i=s({[e]:n?.priorities??[]},r?.ackId);try{await g(i,t.codec,t.socket),await r?.promise}catch(e){throw r?.reject(e),e}}t.debug&&console.info(`[WebSocketClientTransport:${t.name}] Unsubscribed from ${e}`)}var x=class{name;url;auth;codec;messageTransform;autoReconnectConfig;wsFactory;debug;onConnectedCallback;onDisconnectedCallback;socket=null;authComplete=!1;correlations=new n;handlers=new Set;localSubscriptions=new Map;pendingSubscriptionAcks=new Map;subscriptionAckSeq=0;messageListener=null;closeListener=null;reconnectAbort=null;inFlightMessages=new Set;backoffWakeAbort=null;reconnectLoopRunning=!1;readyResolve=null;ready;onNewReadySession=void 0;onConnected=void 0;onDisconnected=void 0;constructor(e){this.url=e.url,this.name=e.name??`ws-client`,this.auth=e.auth,this.codec=e.codec??ne,this.messageTransform=e.messageTransform,this.debug=e.debug??!1,this.autoReconnectConfig=re(e.autoReconnect),this.wsFactory=e.createWebSocket??this.defaultWsFactory,this.onConnectedCallback=e.onConnected,this.onDisconnectedCallback=e.onDisconnected,this.ready=new Promise(e=>{this.readyResolve=e})}async connect(){if(this.reconnectAbort!==null)throw Error(`WebSocketClientTransport: already connected`);let e=new AbortController;this.reconnectAbort=e;try{await y(this.connectionDeps())}catch(e){throw this.reconnectAbort=null,e}this.autoReconnectConfig===!1?this.socket!==null&&this.wireNoReconnectClose(this.socket):this.startReconnectLoop(e.signal)}async disconnect(){let e=this.reconnectAbort;if(this.reconnectAbort=null,e?.abort(),this.readyResolve?.(),this.readyResolve=null,this.socket!==null){v(this.socket,this.connectionDeps());let e=this.socket;this.socket=null,this.authComplete=!1,(e.readyState===0||e.readyState===1)&&e.close()}this.correlations.cleanup(),this.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: disconnected before subscription ack`)),this.auth?.cleanup(),this.handlers.clear(),this.debug&&console.info(`[WebSocketClientTransport:${this.name}] Disconnected`)}async send(e,t){if(this.socket===null||this.socket.readyState!==1)throw Error(`WebSocketClientTransport: not connected`);let n=await this.codec.encode(e);return this.socket.send(n),p(e,this.correlations,t??r)}onReceive(e){return this.handlers.add(e),()=>{this.handlers.delete(e)}}async subscribe(e,t,n=[]){await pe(e,t,n,this.subscriptionDeps())}async unsubscribe(e){await me(e,this.subscriptionDeps())}getSubscriptions(){return new Set(this.localSubscriptions.keys())}cancelRequest(e,t){this.correlations.cancel(e,t)}isReady(){return this.socket!==null&&this.socket.readyState===1&&this.authComplete}async reconnect(){if(!this.isReady()){if(this.backoffWakeAbort!==null){this.backoffWakeAbort.abort(),this.backoffWakeAbort=null;return}if(this.autoReconnectConfig!==!1){if(this.reconnectLoopRunning)return;this.reconnectAbort!==null&&this.startReconnectLoop(this.reconnectAbort.signal);return}try{await y(this.connectionDeps()),this.socket!==null&&(this.reconnectAbort=new AbortController,this.wireNoReconnectClose(this.socket))}catch{}}}startReconnectLoop(e){return de(e,this.autoReconnectConfig,this.connectionDeps(),e=>{this.backoffWakeAbort=e},e=>{this.reconnectLoopRunning=e})}subscriptionDeps(){return{name:this.name,debug:this.debug,codec:this.codec,socket:this.socket,localSubscriptions:this.localSubscriptions,beginSubscriptionAck:()=>this.beginSubscriptionAck()}}beginSubscriptionAck(){let e=`${this.name}:sub:${++this.subscriptionAckSeq}`,t,n,r=new Promise((e,r)=>{t=e,n=r});r.catch(()=>void 0);let i=t=>{this.pendingSubscriptionAcks.has(e)&&(this.pendingSubscriptionAcks.delete(e),t())};return this.pendingSubscriptionAcks.set(e,{resolve:()=>i(t),reject:e=>i(()=>n(e))}),{ackId:e,promise:r,reject:t=>this.rejectSubscriptionAck(e,t)}}resolveSubscriptionAck(e){this.pendingSubscriptionAcks.get(e)?.resolve()}rejectSubscriptionAck(e,t){this.pendingSubscriptionAcks.get(e)?.reject(t)}rejectPendingSubscriptionAcks(e){for(let t of this.pendingSubscriptionAcks.keys())this.rejectSubscriptionAck(t,e)}connectionDeps(){return{name:this.name,debug:this.debug,auth:this.auth,codec:this.codec,messageTransform:this.messageTransform,correlations:this.correlations,handlers:this.handlers,localSubscriptions:this.localSubscriptions,wsFactory:this.wsFactory,url:this.url,getSocket:()=>this.socket,setSocket:e=>{this.socket=e},setAuthComplete:e=>{this.authComplete=e},getMessageListener:()=>this.messageListener,setMessageListener:e=>{this.messageListener=e},getCloseListener:()=>this.closeListener,setCloseListener:e=>{this.closeListener=e},resolveReady:()=>{this.readyResolve?.(),this.readyResolve=null},resetReadyPromise:()=>{this.ready=new Promise(e=>{this.readyResolve=e}),this.onNewReadySession?.(this.ready)},resolveSubscriptionAck:e=>{this.resolveSubscriptionAck(e)},rejectPendingSubscriptionAcks:e=>{this.rejectPendingSubscriptionAcks(e)},notifyConnected:()=>{this.onConnectedCallback?.(),this.onConnected?.()},notifyDisconnected:()=>{this.onDisconnectedCallback?.(),this.onDisconnected?.()},inFlightMessages:this.inFlightMessages}}defaultWsFactory=async e=>new(await(import(`ws`))).WebSocket(e);wireNoReconnectClose(e){fe(e,this.connectionDeps(),()=>{this.reconnectAbort=null})}};function S(e){e.timer!==void 0&&clearTimeout(e.timer)}var he=class{pendingBroadcasts=new Map;timeout;debug;constructor(e={}){this.timeout=e.timeout??5e3,this.debug=e.debug??!1}startClientBroadcast(e,t,n,r,i){let a=t.correlationId,o=i??this.timeout,s={kind:`client`,sender:e,results:[],pendingClients:new Set(n),nodeResultsReceived:!1,timer:o===0?void 0:setTimeout(()=>{this.debug&&console.warn(`[BroadcastAggregator] Broadcast ${a} timed out`),this.finalizeBroadcast(a)},o)};this.pendingBroadcasts.set(a,s);let c=JSON.stringify(t);for(let e of n)r(e,c);this.debug&&console.info(`[BroadcastAggregator] Broadcast ${a} forwarded to ${n.length} clients`)}startServerBroadcast(e,t,n,r){let i=e.correlationId,a=r??this.timeout;return t.length===0?(this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${i} - no target clients`),Promise.resolve([])):new Promise(r=>{let o={kind:`server`,results:[],pendingClients:new Set(t),timer:a===0?void 0:setTimeout(()=>{this.debug&&console.warn(`[BroadcastAggregator] Server broadcast ${i} timed out`),this.finalizeServerBroadcast(i)},a),resolve:r};this.pendingBroadcasts.set(i,o);let s=JSON.stringify(e);for(let e of t)n(e,s);this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${i} sent to ${t.length} clients`)})}handleResponse(e,t){let n=this.pendingBroadcasts.get(t.correlationId);return n?(t.results&&n.results.push(...t.results),n.pendingClients.delete(e),this.debug&&console.info(`[BroadcastAggregator] Broadcast ${t.correlationId} got response, ${n.pendingClients.size} pending`),this.checkBroadcastComplete(t.correlationId,n),!0):!1}handleNodeResults(e,t,n){let r=this.pendingBroadcasts.get(e);return!r||r.kind!==`client`?!1:(r.results.push(...t),r.nodeResultsReceived=!0,r.nodeError=n,this.debug&&console.info(`[BroadcastAggregator] Broadcast ${e} node results aggregated${n?` (with error)`:``}`),this.checkBroadcastComplete(e,r),!0)}handleClientDisconnect(e){for(let[t,n]of this.pendingBroadcasts)n.kind===`client`&&n.sender===e?(S(n),this.pendingBroadcasts.delete(t)):n.pendingClients.has(e)&&(n.pendingClients.delete(e),this.checkBroadcastComplete(t,n))}cleanup(){for(let e of this.pendingBroadcasts.values())S(e),e.kind===`server`&&e.resolve(e.results);this.pendingBroadcasts.clear()}checkBroadcastComplete(e,t){if(!(t.pendingClients.size>0))if(t.kind===`client`){if(!t.nodeResultsReceived)return;this.finalizeBroadcast(e)}else this.finalizeServerBroadcast(e)}finalizeBroadcast(e){let t=this.pendingBroadcasts.get(e);if(!t||t.kind!==`client`)return;S(t),this.pendingBroadcasts.delete(e);let n=t.nodeError?{type:`broadcast-response`,correlationId:e,error:t.nodeError}:{type:`broadcast-response`,correlationId:e,results:t.results};t.sender.readyState===1&&t.sender.send(JSON.stringify(n)),this.debug&&console.info(`[BroadcastAggregator] Broadcast ${e} finalized with ${t.results.length} results`)}finalizeServerBroadcast(e){let t=this.pendingBroadcasts.get(e);!t||t.kind!==`server`||(S(t),this.pendingBroadcasts.delete(e),t.resolve(t.results),this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${e} finalized with ${t.results.length} results`))}},ge=class{clients=new Set;authenticatingClients=new Set;clientSubscriptions=new Map;clientFilters=new Map;debug;constructor(e={}){this.debug=e.debug??!1}addAuthenticating(e){this.authenticatingClients.add(e)}removeAuthenticating(e){this.authenticatingClients.delete(e)}isAuthenticating(e){return this.authenticatingClients.has(e)}addClient(e){this.clients.add(e)}removeClient(e){this.clients.delete(e),this.authenticatingClients.delete(e),this.clientSubscriptions.delete(e),this.clientFilters.delete(e),this.debug&&console.info(`[ClientRegistry] Client removed (${this.clients.size} remaining)`)}get size(){return this.clients.size}getAllSockets(){return new Set([...this.clients,...this.authenticatingClients])}handleSubscribeMessage(e,t){let n=this.clientSubscriptions.get(e);n||(n=new Set,this.clientSubscriptions.set(e,n));let r=this.clientFilters.get(e);for(let[i]of Object.entries(t.subjects)){n.add(i);let a=t.filters?.[i];a===void 0?r?.delete(i):(r||(r=new Map,this.clientFilters.set(e,r)),r.set(i,a))}if(this.debug){let e=Object.keys(t.subjects).length,n=t.filters?Object.keys(t.filters).length:0;console.info(`[ClientRegistry] Client subscribed to ${e} subjects, ${n} filters`)}}handleUnsubscribeMessage(e,t){let n=this.clientSubscriptions.get(e),r=this.clientFilters.get(e);for(let e of Object.keys(t))n?.delete(e),r?.delete(e);this.debug&&console.info(`[ClientRegistry] Client unsubscribed from ${Object.keys(t).length} subjects`)}getReadyClients(){let e=[];for(let t of this.clients)t.readyState===1&&e.push(t);return e}getRequestRoutingPriority(e,t,n){let r=this.clientSubscriptions.get(e);return!r||r.size===0?1:this.clientWantsMessage(e,t,n)?2:0}getInterestedClients(e,t,n){let r=[];for(let i of this.clients)i!==n&&i.readyState===1&&this.clientWantsMessage(i,e,t)&&r.push(i);return r}forwardEventToClients(e,t,n){let r=l(t)??void 0,i=`payload`in t?t.payload:void 0,a=JSON.stringify(t),o=this.getInterestedClients(r,i,e);for(let e of o)n(e,a)}clientWantsMessage(e,t,n){return f(t,n,this.clientSubscriptions.get(e)??new Set,this.clientFilters.get(e)??new Map)}};async function C(e,t,n){let r=await Promise.allSettled(Array.from(t).map(t=>t(e,n.receiveContext)));for(let e of r)if(e.status===`rejected`&&n.debug){let t=n.logContext?` ${n.logContext}`:``;console.error(`[ServerTransport] Handler error${t}:`,e.reason)}return r.every(e=>e.status===`fulfilled`)}function _e(e,t,n){let{correlations:r,broadcastAggregator:i,debug:a}=t;if(e.type===`heartbeat`)return!0;if(e.type===`response`){let t=e;return typeof t.correlationId==`string`?(t.error?r.reject(t.correlationId,c(t.error)):r.resolve(t.correlationId,t.result),!0):(a&&console.warn(`[ServerTransport] Malformed response message: missing correlationId`),!0)}if(e.type===`broadcast-response`){let t=e;return typeof t.correlationId==`string`?(i.handleResponse(n,t),!0):(a&&console.warn(`[ServerTransport] Malformed broadcast-response: missing correlationId`),!0)}return!1}async function ve(e,t,n){let{registry:r,broadcastAggregator:i,handlers:a,normalizeBroadcastTimeout:o,sendSafely:s,debug:c}=n;if(_e(e,n,t))return;let l=n.auth?.getReceiveContext?.(t);if(e.type===`subscribe`){let n=e;if(!m(n.subjects)){c&&console.warn(`[ServerTransport] Malformed subscribe message: missing subjects record`);return}r.handleSubscribeMessage(t,n),await C(n,a,{debug:c,receiveContext:l,logContext:`dispatching subscribe`})&&typeof n.ackId==`string`&&s(t,JSON.stringify({type:`subscription-ack`,ackId:n.ackId}));return}if(e.type===`unsubscribe`){let n=e;if(!m(n.subjects)){c&&console.warn(`[ServerTransport] Malformed unsubscribe message: missing subjects record`);return}r.handleUnsubscribeMessage(t,n.subjects),await C(n,a,{debug:c,receiveContext:l,logContext:`dispatching unsubscribe`})&&typeof n.ackId==`string`&&s(t,JSON.stringify({type:`subscription-ack`,ackId:n.ackId}));return}if(e.type===`broadcast`){let n=e;if(typeof n.correlationId!=`string`||typeof n.subject!=`string`){c&&console.warn(`[ServerTransport] Malformed broadcast message: missing correlationId or subject`);return}let u=r.getInterestedClients(n.subject,n.payload,t),d=o(n.timeout);i.startClientBroadcast(t,n,u,s,d),await C(e,a,{debug:c,receiveContext:l});return}e.type===`event`&&r.forwardEventToClients(t,e,s),await C(e,a,{debug:c,receiveContext:l})}function ye(e,t){let{auth:n,registry:r,debug:i}=t;return async a=>{let o;try{o=JSON.parse(a.toString())}catch(e){i&&console.error(`[ServerTransport] Failed to parse message:`,e);return}let s=o&&typeof o==`object`?o:void 0;if(!s||typeof s.type!=`string`){i&&console.error(`[ServerTransport] Invalid message structure:`,o);return}let c=o;try{if(n?.handleAuthMessage(c,e))return;if(n&&r.isAuthenticating(e)){i&&console.warn(`[ServerTransport] Ignoring message from unauthenticated client`);return}if(n?.isSocketAuthenticated?.(e)===!1){i&&console.warn(`[ServerTransport] Closing socket with expired authentication`),n.cleanupSocket(e),e.close(1008,`Authentication expired`);return}await ve(c,e,t)}catch(e){i&&console.error(`[ServerTransport] Failed to process message:`,e)}}}function be(e){return typeof e!=`number`||!Number.isFinite(e)||e<=0?5e3:Math.min(e,6e4)}async function xe(e,t){let{registry:n,correlations:r,broadcastAggregator:i,handlers:a,auth:s,serverSubscriptions:c,sendSafely:l,debug:u}=t;s&&n.addAuthenticating(e);let d=ye(e,{registry:n,correlations:r,broadcastAggregator:i,handlers:a,auth:s,normalizeBroadcastTimeout:be,sendSafely:l,debug:u}),f=e=>{d(e.data)},p=()=>{s?.cleanupSocket(e),n.removeClient(e),e.removeEventListener(`message`,f),e.removeEventListener(`close`,p),e.removeEventListener(`error`,m),i.handleClientDisconnect(e),u&&console.info(`[ServerTransport] Client disconnected (${n.size} remaining)`)},m=e=>{u&&console.error(`[ServerTransport] Client socket error:`,e)};e.addEventListener(`message`,f),e.addEventListener(`close`,p),e.addEventListener(`error`,m);try{if(s&&(await s.authenticateServer(e,t=>{if(e.readyState!==1)throw Error(`Cannot send auth message: socket not ready (state: ${e.readyState})`);e.send(JSON.stringify(t))}),n.removeAuthenticating(e)),e.readyState!==1)return;if(n.addClient(e),c.size>0){let t=o(c);l(e,JSON.stringify(t))}l(e,JSON.stringify({type:`subscribe-sync-complete`})),u&&console.info(`[ServerTransport] Client connected (${n.size} total)`)}catch(t){u&&console.error(`[ServerTransport] Client authentication failed:`,t),e.close(1008,`Authentication failed`)}}async function Se(e,t,n){let{registry:r,correlations:o}=n,s=`${e.namespace}.${e.subject}`,c=r.getReadyClients().map(t=>({client:t,priority:r.getRequestRoutingPriority(t,s,e.payload)})).sort((e,t)=>t.priority-e.priority).map(({client:e})=>e);if(c.length===0)throw new i(s);for(let[n,r]of c.entries()){let i=`${e.correlationId}:attempt-${n+1}`,c={...e,correlationId:i};try{r.send(JSON.stringify(c))}catch{continue}try{return await o.track(i,t)}catch(e){if(d(e,s)||e instanceof a)continue;throw e}}throw new i(s)}var w=class{name;wss;auth;debug;handlers=new Set;registry;serverSubscriptions=new Map;broadcastAggregator;correlations=new n;connectionListener=null;constructor(e){let{websocket:t,name:n=`websocket`,auth:r,debug:i=!1}=e;this.wss=t,this.name=n,this.auth=r,this.debug=i,this.registry=new ge({debug:i}),this.broadcastAggregator=new he({debug:i})}sendToClientSafely(e,t){try{e.send(t)}catch(e){this.debug&&console.warn(`[ServerTransport] Failed to send message to client:`,e)}}async connect(){if(this.connectionListener!==null)throw Error(`ServerTransport.connect() called while already connected`);this.connectionListener=e=>{xe(e,{registry:this.registry,correlations:this.correlations,broadcastAggregator:this.broadcastAggregator,handlers:this.handlers,auth:this.auth,serverSubscriptions:this.serverSubscriptions,sendSafely:(e,t)=>this.sendToClientSafely(e,t),debug:this.debug})},this.wss.on(`connection`,this.connectionListener),this.debug&&console.info(`[ServerTransport] Listening for connections`)}async disconnect(){this.connectionListener&&=(this.wss.off(`connection`,this.connectionListener),null);let e=this.registry.getAllSockets();for(let t of e)t.close();await new Promise((e,t)=>{this.wss.close(n=>n?t(n):e())}),this.correlations.cleanup(),this.broadcastAggregator.cleanup(),this.auth?.cleanup(),this.handlers.clear(),this.serverSubscriptions.clear(),this.debug&&console.info(`[ServerTransport] Disconnected`)}async send(e,t){if(e.type===`broadcast`){let n=l(e)??void 0,r=`payload`in e?e.payload:void 0,i=this.registry.getInterestedClients(n,r);return this.broadcastAggregator.startServerBroadcast(e,i,(e,t)=>{this.sendToClientSafely(e,t)},t)}if(e.type===`request`)return Se(e,t??r,{registry:this.registry,correlations:this.correlations});if(this.registry.size===0){if(this.debug){let t=l(e);console.debug(`[ServerTransport] No clients to receive ${e.type}${t?`: ${t}`:``}`)}return!1}let n=l(e)??void 0,i=`payload`in e?e.payload:void 0,a=JSON.stringify(e),o=this.registry.getInterestedClients(n,i);for(let e of o)this.sendToClientSafely(e,a);let s=o.length>0;if(!s){if(n&&this.debug&&console.warn(`[ServerTransport] No interested clients for subject: ${n}`),e.type===`response`)return!1;if(!n)throw Error(`No connected clients available to receive message`)}return s}onReceive(e){return this.handlers.add(e),()=>{this.handlers.delete(e)}}cancelRequest(e,t){this.correlations.cancel(e,t)}onBroadcastResults(e,t,n){this.broadcastAggregator.handleNodeResults(e,t,n)}async subscribe(e,t,n=[]){let r=this.serverSubscriptions.get(e)?.filter,i=t??r;if(this.serverSubscriptions.set(e,{filter:i,priorities:n}),this.registry.size>0){let t=o(new Map([[e,{filter:i,priorities:n}]])),r=JSON.stringify(t);for(let e of this.registry.getReadyClients())this.sendToClientSafely(e,r)}}getConnectionCount(){return this.registry.getReadyClients().length}async unsubscribe(e){if(this.serverSubscriptions.delete(e),this.registry.size>0){let t=s({[e]:[]}),n=JSON.stringify(t);for(let e of this.registry.getReadyClients())this.sendToClientSafely(e,n)}}};function Ce(e,t){let n=new Event(`close`);return Object.defineProperties(n,{code:{value:e??1e3,enumerable:!0},reason:{value:t??``,enumerable:!0}}),n}function we(e){if(typeof e!=`object`||!e)throw TypeError(`WebSocket transport options must be an object`);let t=e;if(t.mode!==`client`&&t.mode!==`server`)throw TypeError(`WebSocket transport mode must be "client" or "server"`);if(t.mode===`client`){if(!Te(t.websocket))throw TypeError(`WebSocket transport client mode requires a websocket with addEventListener/removeEventListener`);return}if(!Ee(t.websocket))throw TypeError(`WebSocket transport server mode requires a websocket with on/off listener methods`)}function Te(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.send==`function`&&typeof t.close==`function`&&typeof t.addEventListener==`function`&&typeof t.removeEventListener==`function`}function Ee(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.on==`function`&&typeof t.off==`function`&&typeof t.close==`function`}var De=class{secret;algorithm;challengeTimeout;identityId;resolveSecret;resolvePeer;pendingChallenge;pendingResult;queuedChallengeNonce;queuedResult;clientAuthComplete=!1;serverPendingResponses=new Map;serverAuthenticatedSockets=new Set;serverAuthenticatedPeers=new Map;constructor(e){this.secret=e.secret,this.algorithm=e.algorithm??`sha256`,this.challengeTimeout=e.challengeTimeout??5e3,this.identityId=e.identityId,this.resolveSecret=e.resolveSecret,this.resolvePeer=e.resolvePeer}async authenticateServer(e,t){let n=crypto.getRandomValues(new Uint8Array(32)),r=Array.from(n).map(e=>e.toString(16).padStart(2,`0`)).join(``),i=await this.computeHmac(r);t({type:`auth-challenge`,nonce:r});let a=!1;try{let{signature:n,identityId:o}=await this.waitForAuthResponseWithIdentity(e),s;if(this.resolveSecret&&o!==void 0){let i=this.resolveSecret(o);if(i===null)throw this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!1,error:`Unknown identity`}),a=!0,Error(`HMAC authentication failed: Unknown identity '${o}'`);s=await this.computeHmacWithSecret(r,i),this.constantTimeEqual(n,s)&&this.serverAuthenticatedPeers.set(e,o)}else s=i;if(!this.constantTimeEqual(n,s))throw this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!1,error:`Invalid signature`}),a=!0,Error(`HMAC authentication failed: Invalid signature`);this.serverAuthenticatedSockets.add(e),this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!0}),a=!0}catch(n){let r=this.serverPendingResponses.has(e);throw this.serverPendingResponses.delete(e),!a&&r&&this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!1,error:n instanceof Error?n.message:`Authentication failed`}),n}finally{this.serverPendingResponses.delete(e)}}async authenticateClient(e){this.clientAuthComplete=!1;let t=await this.waitForAuthChallenge();e({type:`auth-response`,signature:await this.computeHmac(t),...this.identityId!==void 0&&{identityId:this.identityId}});let n=await this.waitForAuthResult();if(!n.success)throw Error(`HMAC authentication failed: ${n.error??`Unknown error`}`);this.clientAuthComplete=!0}handleAuthMessage(e,t){if(typeof e!=`object`||!e||!(`type`in e)||typeof e.type!=`string`)return!1;let n=e;if(n.type===`auth-challenge`)return typeof n.nonce!=`string`||this.clientAuthComplete||(this.pendingChallenge?(clearTimeout(this.pendingChallenge.timeoutHandle),this.pendingChallenge.resolve(n.nonce),this.pendingChallenge=void 0):this.queuedChallengeNonce=n.nonce),!0;if(n.type===`auth-result`){if(typeof n.success!=`boolean`||this.clientAuthComplete)return!0;let e={success:n.success,error:n.error};return this.pendingResult?(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.resolve(e),this.pendingResult=void 0):this.queuedResult=e,!0}if(n.type===`auth-response`){if(t){let e=this.serverPendingResponses.get(t);e&&(clearTimeout(e.timeoutHandle),e.resolve({signature:n.signature,identityId:n.identityId}))}return!0}return!1}async waitForAuthChallenge(){if(this.queuedChallengeNonce!==void 0){let e=this.queuedChallengeNonce;return this.queuedChallengeNonce=void 0,e}return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingChallenge=void 0,t(Error(`Authentication challenge timeout`))},this.challengeTimeout);this.pendingChallenge={resolve:e,reject:t,timeoutHandle:n}})}async waitForAuthResponseWithIdentity(e){return new Promise((t,n)=>{let r={resolve:t,reject:n,timeoutHandle:setTimeout(()=>{n(Error(`Authentication response timeout`))},this.challengeTimeout)};this.serverPendingResponses.set(e,r)})}async waitForAuthResult(){if(this.queuedResult!==void 0){let e=this.queuedResult;return this.queuedResult=void 0,e}return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingResult=void 0,t(Error(`Authentication result timeout`))},this.challengeTimeout);this.pendingResult={resolve:e,reject:t,timeoutHandle:n}})}async computeHmac(e){return this.computeHmacWithSecret(e,this.secret)}async computeHmacWithSecret(e,t){let n=new TextEncoder,r=n.encode(t),i=this.algorithm.replace(/^sha/,`SHA-`),a=await crypto.subtle.importKey(`raw`,r,{name:`HMAC`,hash:i},!1,[`sign`]),o=await crypto.subtle.sign(`HMAC`,a,n.encode(e));return Array.from(new Uint8Array(o)).map(e=>e.toString(16).padStart(2,`0`)).join(``)}getReceiveContext(e){if(!e)return;let t=this.serverAuthenticatedPeers.get(e);if(t===void 0)return;let n=this.resolvePeer?.(t);if(this.resolvePeer!==void 0&&n===null)return;let r=n??{kind:`workflow-execution`,id:t};return{transportName:``,peer:{...r,id:r.id??t,authenticated:!0}}}isSocketAuthenticated(e){if(!this.serverAuthenticatedSockets.has(e))return!1;if(!this.resolveSecret)return!0;let t=this.serverAuthenticatedPeers.get(e);return t===void 0?!0:this.resolveSecret(t)===null?(this.cleanupSocket(e),!1):!0}constantTimeEqual(e,t){if(e.length!==t.length)return!1;let n=new Uint8Array(e.length/2),r=new Uint8Array(t.length/2);for(let i=0;i<n.length;i++)n[i]=parseInt(e.slice(i*2,i*2+2),16),r[i]=parseInt(t.slice(i*2,i*2+2),16);let i=0;for(let e=0;e<n.length;e++)i|=n[e]^r[e];return i===0}sendAuthResultBestEffort(e,t){try{e(t)}catch{}}cleanupSocket(e){let t=this.serverPendingResponses.get(e);t&&(clearTimeout(t.timeoutHandle),this.serverPendingResponses.delete(e),t.reject(Error(`Socket disconnected during HMAC authentication`))),this.serverAuthenticatedPeers.delete(e),this.serverAuthenticatedSockets.delete(e)}cleanup(){this.pendingChallenge&&=(clearTimeout(this.pendingChallenge.timeoutHandle),void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),void 0),this.queuedChallengeNonce=void 0,this.queuedResult=void 0,this.clientAuthComplete=!1;for(let e of this.serverPendingResponses.values())clearTimeout(e.timeoutHandle);this.serverPendingResponses.clear(),this.serverAuthenticatedPeers.clear(),this.serverAuthenticatedSockets.clear()}};const T=new Map;function Oe(e,t,n={}){if(e.trim().length===0)throw Error(`registerHmacIdentitySecret requires a non-empty identityId`);if(t.length===0)throw Error(`registerHmacIdentitySecret requires a non-empty secret`);let r={secret:t,peerKind:n.peerKind?.trim()||`workflow-execution`};T.set(e,r);let i=!0;return()=>{i&&(i=!1,T.get(e)===r&&T.delete(e))}}function ke(e){return T.get(e)?.secret??null}function Ae(e){let t=T.get(e);return t?{kind:t.peerKind,id:e,authenticated:!0}:null}function je(){T.clear()}function E(e){let t=Array.from(e,e=>String.fromCharCode(e)).join(``);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``)}function D(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=(4-t.length%4)%4;t+=`=`.repeat(n);let r=atob(t),i=new Uint8Array(r.length);for(let e=0;e<r.length;e++)i[e]=r.charCodeAt(e);return i}function O(e){return new TextEncoder().encode(e)}function k(e){return new TextDecoder().decode(e)}async function A(e){let t=await crypto.subtle.exportKey(`spki`,e);return E(new Uint8Array(t))}async function j(e){let t=await crypto.subtle.exportKey(`raw`,e);return E(new Uint8Array(t))}async function M(e,t,n=[]){let r=D(e);return crypto.subtle.importKey(`spki`,r,t,!0,n)}async function N(e,t,n=[]){let r=D(e);return crypto.subtle.importKey(`raw`,r,t,!0,n)}async function P(e){let t=await crypto.subtle.exportKey(`pkcs8`,e),n=E(new Uint8Array(t)).replace(/-/g,`+`).replace(/_/g,`/`),r=(4-n.length%4)%4;return n+=`=`.repeat(r),`-----BEGIN PRIVATE KEY-----\n${n.match(/.{1,64}/g)?.join(`
+`)??n}\n-----END PRIVATE KEY-----`}async function F(e,t,n){let r=D(e.replace(/-----BEGIN PRIVATE KEY-----/,``).replace(/-----END PRIVATE KEY-----/,``).replace(/\s/g,``).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``));return crypto.subtle.importKey(`pkcs8`,r,t,!0,n)}const I={name:`ECDH`,namedCurve:`P-256`};async function L(e=!0){return crypto.subtle.generateKey(I,e,[`deriveKey`,`deriveBits`])}async function R(e){return A(e)}async function Me(e){return j(e)}async function Ne(e){return N(e,I)}async function z(e,t=[]){return M(e,I,t)}async function Pe(e){return P(e)}async function Fe(e){return F(e,I,[`deriveKey`,`deriveBits`])}async function B(e,t){return crypto.subtle.deriveBits({name:`ECDH`,public:t},e,256)}async function V(e,t){let n=crypto.getRandomValues(new Uint8Array(12)),r=await crypto.subtle.encrypt({name:`AES-GCM`,iv:n},e,t);return{ciphertext:new Uint8Array(r),nonce:n}}async function H(e,t,n){let r=await crypto.subtle.decrypt({name:`AES-GCM`,iv:n},e,t);return new Uint8Array(r)}async function Ie(e){return crypto.subtle.importKey(`raw`,e,{name:`AES-GCM`},!1,[`encrypt`,`decrypt`])}async function U(e,t,n){let r=await crypto.subtle.importKey(`raw`,e,{name:`HKDF`},!1,[`deriveKey`]);return crypto.subtle.deriveKey({name:`HKDF`,hash:`SHA-256`,salt:t,info:O(n)},r,{name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`])}const W={name:`ECDSA`,namedCurve:`P-256`};async function Le(e=!0){return crypto.subtle.generateKey(W,e,[`sign`,`verify`])}async function G(e,t){let n=await crypto.subtle.sign({name:`ECDSA`,hash:{name:`SHA-256`}},e,t);return new Uint8Array(n)}async function K(e,t,n){return crypto.subtle.verify({name:`ECDSA`,hash:{name:`SHA-256`}},e,t,n)}async function Re(e){return A(e)}async function ze(e){return M(e,W,[`verify`])}async function Be(e){return j(e)}async function Ve(e){return N(e,W,[`verify`])}async function He(e){return P(e)}async function Ue(e){return F(e,W,[`sign`])}var We=e({decodeText:()=>k,decrypt:()=>H,deriveSessionKey:()=>U,deriveSharedSecret:()=>B,encodeText:()=>O,encrypt:()=>V,exportPrivateKeyPEM:()=>Pe,exportPublicKey:()=>R,exportPublicKeyRaw:()=>Me,exportSigningPrivateKeyPEM:()=>He,exportSigningPublicKey:()=>Re,exportSigningPublicKeyRaw:()=>Be,fromBase64Url:()=>D,generateECDHKeyPair:()=>L,generateSigningKeyPair:()=>Le,importAESKey:()=>Ie,importPrivateKeyPEM:()=>Fe,importPublicKey:()=>z,importPublicKeyRaw:()=>Ne,importSigningPrivateKeyPEM:()=>Ue,importSigningPublicKey:()=>ze,importSigningPublicKeyRaw:()=>Ve,sign:()=>G,toBase64Url:()=>E,verify:()=>K});function Ge(e){let t=e.match(/.{1,2}/g);return new Uint8Array(t?.map(e=>parseInt(e,16))??[])}function q(e){return Array.from(e).map(e=>e.toString(16).padStart(2,`0`)).join(``)}async function J(e,t){let n=await L(!0),r=await R(n.publicKey);return{ephemeralKeyPair:n,ephemeralPublicKey:r,signature:q(await G(e,O(r+t)))}}function Ke(){return q(crypto.getRandomValues(new Uint8Array(16)))}async function Y(e,t,n,r){let i=O(t+r);return K(e,Ge(n),i)}async function X(e,t,n,r){return U(await B(e,await z(t)),Ge(n),r)}async function qe(e,t,n,r){if(e===t)throw Error(`deriveRelaySaltHex: identityId must differ from peerId`);let[i,a]=e<t?[e,t]:[t,e],[o,s]=e<t?[n,r]:[r,n],c=O(`${i}${a}${o}${s}`),l=new Uint8Array(c).buffer,u=await crypto.subtle.digest(`SHA-256`,l);return q(new Uint8Array(u))}var Je=class{signingKeyPair;identityId;peerId;getPeerSigningKey;timeout;pendingKeyExchange;pendingResult;clientSession;clientEphemeralKeyPair;serverPendingKeyExchange=new Map;serverSessions=new Map;serverEphemeralKeyPairs=new Map;constructor(e){this.signingKeyPair=e.signingKeyPair,this.identityId=e.identityId,this.peerId=e.peerId,this.getPeerSigningKey=e.getPeerSigningKey,this.timeout=e.timeout??1e4}async authenticateClient(e){if(!this.peerId)throw Error(`E2E authentication failed: peerId is required for client authentication`);let{ephemeralKeyPair:t,ephemeralPublicKey:n,signature:r}=await J(this.signingKeyPair.privateKey,this.identityId);this.clientEphemeralKeyPair=t;try{let i=this.waitForKeyExchangeResponse(),a=this.waitForAuthResult();e({type:`e2e-key-exchange`,deviceId:this.identityId,ephemeralPublicKey:n,signature:r});let o=await i,s=await this.getPeerSigningKey(this.peerId);if(!s)throw Error(`E2E authentication failed: Unknown server`);if(!await Y(s,o.ephemeralPublicKey,o.signature,this.peerId))throw Error(`E2E authentication failed: Invalid server signature`);let c=await X(t.privateKey,o.ephemeralPublicKey,o.salt,`makaio-e2e-session-v1`);this.clientSession={sessionKey:c,peerId:this.peerId};let l=await a;if(!l.success)throw Error(`E2E authentication failed: ${l.error??`Unknown error`}`)}catch(e){throw this.pendingKeyExchange&&=(clearTimeout(this.pendingKeyExchange.timeoutHandle),void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),void 0),this.clientSession=void 0,this.clientEphemeralKeyPair=void 0,e}}async authenticateServer(e,t){try{let n=await this.waitForClientKeyExchange(e),r=await this.getPeerSigningKey(n.deviceId);if(!r)throw t({type:`e2e-auth-result`,success:!1,error:`Unknown device`}),Error(`E2E authentication failed: Unknown device ${n.deviceId}`);if(!await Y(r,n.ephemeralPublicKey,n.signature,n.deviceId))throw t({type:`e2e-auth-result`,success:!1,error:`Invalid signature`}),Error(`E2E authentication failed: Invalid client signature`);let{ephemeralKeyPair:i,ephemeralPublicKey:a,signature:o}=await J(this.signingKeyPair.privateKey,this.identityId),s=Ke();this.serverEphemeralKeyPairs.set(e,i),t({type:`e2e-key-exchange-response`,ephemeralPublicKey:a,signature:o,salt:s});let c=await X(i.privateKey,n.ephemeralPublicKey,s,`makaio-e2e-session-v1`);this.serverSessions.set(e,{sessionKey:c,peerId:n.deviceId}),t({type:`e2e-auth-result`,success:!0})}catch(n){throw this.serverPendingKeyExchange.delete(e),this.serverEphemeralKeyPairs.delete(e),t({type:`e2e-auth-result`,success:!1,error:n instanceof Error?n.message:`Authentication failed`}),n}finally{this.serverPendingKeyExchange.delete(e)}}handleAuthMessage(e,t){if(typeof e!=`object`||!e||!(`type`in e)||typeof e.type!=`string`)return!1;let n=e;if(n.type===`e2e-key-exchange-response`)return this.pendingKeyExchange&&=(clearTimeout(this.pendingKeyExchange.timeoutHandle),this.pendingKeyExchange.resolve({ephemeralPublicKey:n.ephemeralPublicKey,signature:n.signature,salt:n.salt}),void 0),!0;if(n.type===`e2e-auth-result`)return this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.resolve({success:n.success,error:n.error}),void 0),!0;if(n.type===`e2e-key-exchange`&&t){let e=this.serverPendingKeyExchange.get(t);return e&&(clearTimeout(e.timeoutHandle),e.resolve({deviceId:n.deviceId,ephemeralPublicKey:n.ephemeralPublicKey,signature:n.signature})),!0}return!1}async waitForKeyExchangeResponse(){return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingKeyExchange=void 0,t(Error(`E2E key exchange timeout`))},this.timeout);this.pendingKeyExchange={resolve:e,reject:t,timeoutHandle:n}})}async waitForAuthResult(){return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingResult=void 0,t(Error(`E2E authentication result timeout`))},this.timeout);this.pendingResult={resolve:e,reject:t,timeoutHandle:n}})}async waitForClientKeyExchange(e){return new Promise((t,n)=>{let r={resolve:t,reject:n,timeoutHandle:setTimeout(()=>{this.serverPendingKeyExchange.delete(e),n(Error(`E2E key exchange timeout`))},this.timeout)};this.serverPendingKeyExchange.set(e,r)})}getSessionKey(e){return e?this.serverSessions.get(e)?.sessionKey??null:this.clientSession?.sessionKey??null}getPeerId(e){return e?this.serverSessions.get(e)?.peerId??null:this.clientSession?.peerId??null}getReceiveContext(e){let t=this.getPeerId(e);if(t!==null)return{transportName:``,peer:{kind:`e2e`,id:t,authenticated:!0,encrypted:!0}}}cleanupSocket(e){let t=this.serverPendingKeyExchange.get(e);t&&(clearTimeout(t.timeoutHandle),this.serverPendingKeyExchange.delete(e)),this.serverSessions.delete(e),this.serverEphemeralKeyPairs.delete(e)}cleanup(){this.pendingKeyExchange&&=(clearTimeout(this.pendingKeyExchange.timeoutHandle),void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),void 0),this.clientSession=void 0,this.clientEphemeralKeyPair=void 0;for(let e of this.serverPendingKeyExchange.values())clearTimeout(e.timeoutHandle);this.serverPendingKeyExchange.clear(),this.serverSessions.clear(),this.serverEphemeralKeyPairs.clear()}};const Z=`E2E relay auth session aborted by reconnect`;var Ye=class{signingKeyPair;identityId;getPeerSigningKey;timeout;mode;blocking;pendingPeer;sessionKey;peerId;localEphemeral;localExchangeMessage;sentLocalExchange=!1;earlyPeer;sendAuthMessage;authGeneration=0;processingExchange=!1;constructor(e){this.signingKeyPair=e.signingKeyPair,this.identityId=e.identityId,this.getPeerSigningKey=e.getPeerSigningKey,this.timeout=e.timeout??1e4,this.mode=e.mode??`initiator`,this.blocking=e.blocking??!0}async authenticateClient(e){let t=this.sendAuthMessage===void 0?this.earlyPeer:void 0;this.cleanup();let n=this.authGeneration;if(this.earlyPeer=t,this.sendAuthMessage=e,this.mode===`initiator`){if(await this.ensureLocalExchangeMessage(),n!==this.authGeneration)throw Error(Z);this.sendLocalExchange()}if(!this.blocking){if(this.earlyPeer){let e=this.earlyPeer;this.earlyPeer=void 0,this.dispatchPeerExchange(e,n)}return}let r=await this.waitForPeerExchange();if(await this.processPeerExchange(r,n),n!==this.authGeneration||!this.sessionKey)throw Error(Z)}async authenticateServer(e,t){throw Error(`E2ERelayAuth does not support server authentication`)}handleAuthMessage(e){let t=e;return!t||t.type!==`e2e-relay-key-exchange`?!1:t.identityId===this.identityId?!0:this.pendingPeer?(this.pendingPeer.resolve(t),this.pendingPeer=void 0,!0):(this.earlyPeer=t,!this.blocking&&this.sendAuthMessage&&!this.sessionKey&&!this.processingExchange&&this.dispatchPeerExchange(t,this.authGeneration),!0)}cleanupSocket(e){}cleanup(){this.authGeneration++,this.pendingPeer&&=(this.pendingPeer.reject(Error(Z)),void 0),this.earlyPeer&&=void 0,this.sessionKey=void 0,this.peerId=void 0,this.localEphemeral=void 0,this.localExchangeMessage=void 0,this.sentLocalExchange=!1,this.processingExchange=!1,this.sendAuthMessage=void 0}dispatchPeerExchange(e,t){this.processingExchange=!0,this.processPeerExchange(e,t).catch(e=>{e instanceof Error&&e.message===Z||console.error(`[E2ERelayAuth] Peer exchange failed:`,e)}).finally(()=>{t===this.authGeneration&&(this.processingExchange=!1,this.retryQueuedPeerExchange(t))})}getSessionKey(){return this.sessionKey??null}getPeerId(){return this.peerId??null}getReceiveContext(){let e=this.getPeerId();if(e!==null)return{transportName:``,peer:{kind:`e2e`,id:e,authenticated:!0,encrypted:!0}}}async waitForPeerExchange(){if(this.earlyPeer){let e=this.earlyPeer;return this.earlyPeer=void 0,e}return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingPeer=void 0,t(Error(`E2E relay key exchange timeout`))},this.timeout),r=()=>{clearTimeout(n),this.pendingPeer=void 0};this.pendingPeer={resolve:t=>{r(),e(t)},reject:e=>{r(),t(e)},timeoutHandle:n}})}async ensureLocalExchangeMessage(){if(this.localExchangeMessage&&this.localEphemeral)return this.localExchangeMessage;let{ephemeralKeyPair:e,ephemeralPublicKey:t,signature:n}=await J(this.signingKeyPair.privateKey,this.identityId);return this.localEphemeral=e,this.localExchangeMessage={type:`e2e-relay-key-exchange`,identityId:this.identityId,ephemeralPublicKey:t,signature:n},this.localExchangeMessage}sendLocalExchange(e=!1){!this.sendAuthMessage||!this.localExchangeMessage||!e&&this.sentLocalExchange||(this.sendAuthMessage(this.localExchangeMessage),this.sentLocalExchange=!0)}retryQueuedPeerExchange(e){if(this.blocking||!this.sendAuthMessage||this.sessionKey||this.processingExchange||e!==this.authGeneration)return;let t=this.earlyPeer;t&&(this.earlyPeer=void 0,this.dispatchPeerExchange(t,e))}async processPeerExchange(e,t){if(!this.sendAuthMessage){this.earlyPeer=e;return}let n=await this.ensureLocalExchangeMessage();if(t!==this.authGeneration)return;let r=await this.getPeerSigningKey(e.identityId);if(!r)throw Error(`E2E relay authentication failed: Unknown peer ${e.identityId}`);if(!await Y(r,e.ephemeralPublicKey,e.signature,e.identityId))throw Error(`E2E relay authentication failed: Invalid peer signature`);let i=await qe(this.identityId,e.identityId,n.ephemeralPublicKey,e.ephemeralPublicKey);if(!this.localEphemeral)throw Error(`E2E relay authentication failed: Local ephemeral key missing`);let a=await X(this.localEphemeral.privateKey,e.ephemeralPublicKey,i,`makaio-e2e-relay-v1`);t===this.authGeneration&&(this.sessionKey=a,this.peerId=e.identityId,this.mode===`initiator`?this.sendLocalExchange(!0):this.sendLocalExchange())}},Xe=class{hmac;e2e;socketStrategy=new Map;pendingServerAuth=new Map;hmacCancelled=new Map;constructor(e){this.hmac=e.hmac,this.e2e=e.e2e}setE2EAuth(e){this.e2e=e}async authenticateClient(e){let t=this.hmac??this.e2e;if(!t)throw Error(`DispatchingAuth: no auth strategy configured`);return t.authenticateClient(e)}async authenticateServer(e,t){let n=this.resolveSingleStrategy();if(n)return n.authenticateServer(e,t);if(!this.hmac||!this.e2e)throw Error(`DispatchingAuth: no auth strategy configured`);let r={cancelled:!1};this.hmacCancelled.set(e,r);let i=this.hmac.authenticateServer(e,e=>{r.cancelled||t(e)});return new Promise((n,a)=>{this.pendingServerAuth.set(e,{resolve:n,reject:a,send:t}),i.then(n).catch(e=>{r.cancelled||a(e instanceof Error?e:Error(String(e)))})})}handleAuthMessage(e,t){if(!t)return(this.hmac??this.e2e)?.handleAuthMessage(e)??!1;let n=this.socketStrategy.get(t);if(n)return n.handleAuthMessage(e,t);let r=this.resolveStrategy(e),i=this.pendingServerAuth.get(t);return r?(this.socketStrategy.set(t,r),this.pendingServerAuth.delete(t),r===this.hmac?this.hmacCancelled.delete(t):(this.cancelHmac(t),i&&r.authenticateServer(t,i.send).then(i.resolve).catch(e=>{i.reject(e instanceof Error?e:Error(String(e)))})),r.handleAuthMessage(e,t)):(this.cancelHmac(t),i&&(this.pendingServerAuth.delete(t),i.reject(Error(`DispatchingAuth: unrecognised auth message type "${this.peekType(e)}" — no matching strategy`))),!1)}cleanupSocket(e){let t=this.socketStrategy.get(e);t&&(t.cleanupSocket(e),this.socketStrategy.delete(e)),this.cancelHmac(e);let n=this.pendingServerAuth.get(e);n&&(this.pendingServerAuth.delete(e),n.reject(Error(`DispatchingAuth: socket disconnected before auth type was determined`)))}cleanup(){this.hmac?.cleanup(),this.e2e?.cleanup(),this.socketStrategy.clear();for(let e of this.pendingServerAuth.values())e.reject(Error(`DispatchingAuth: cleanup called before authentication completed`));this.pendingServerAuth.clear(),this.hmacCancelled.clear()}peekType(e){if(typeof e!=`object`||!e||!(`type`in e))return;let{type:t}=e;return typeof t==`string`?t:void 0}resolveSingleStrategy(){if(this.hmac&&!this.e2e)return this.hmac;if(this.e2e&&!this.hmac)return this.e2e}resolveStrategy(e){let t=this.peekType(e);if(t){if(t===`e2e-key-exchange`&&this.e2e)return this.e2e;if(t===`auth-response`&&this.hmac)return this.hmac}}cancelHmac(e){let t=this.hmacCancelled.get(e);t&&(t.cancelled=!0,this.hmacCancelled.delete(e),this.hmac?.cleanupSocket(e))}};function Ze(e){return`payload`in e}async function Qe(e,t,n){if(e.type!==`response`||e.result===void 0||e.error!==void 0)return;let{ciphertext:r,nonce:i}=await V(n,O(JSON.stringify(e.result)));t.result=E(r),t.e2e={nonce:E(i),v:1}}async function $e(e,t,n){if(e.type!==`broadcast-response`||e.results===void 0||e.error!==void 0)return;let{ciphertext:r,nonce:i}=await V(n,O(JSON.stringify(e.results)));t.results=E(r),t.e2e={nonce:E(i),v:1}}async function et(e,t,n){if(!Ze(e)||e.payload===void 0)return;let{ciphertext:r,nonce:i}=await V(n,O(JSON.stringify(e.payload)));t.payload=E(r),t.e2e={nonce:E(i),v:1}}async function tt(e,t,n){if(e.type!==`response`&&e.type!==`broadcast-response`||e.error===void 0)return;let{ciphertext:r,nonce:i}=await V(n,O(JSON.stringify(e.error)));t.error=E(r),t.e2e={nonce:E(i),v:1}}async function nt(e,t,n,r){if(!Ze(e)||typeof e.payload!=`string`)return;let i=k(await H(n,D(e.payload),r));t.payload=JSON.parse(i)}async function rt(e,t,n,r){if(e.type!==`response`||typeof e.result!=`string`)return;let i=k(await H(n,D(e.result),r));t.result=JSON.parse(i)}async function it(e,t,n,r){if(e.type!==`broadcast-response`||typeof e.results!=`string`)return;let i=k(await H(n,D(e.results),r));t.results=JSON.parse(i)}async function at(e,t,n,r){if(e.type!==`response`&&e.type!==`broadcast-response`||typeof e.error!=`string`)return;let i=k(await H(n,D(e.error),r));t.error=JSON.parse(i)}async function ot(e,t){let n={...e};return await et(e,n,t),await Qe(e,n,t),await $e(e,n,t),await tt(e,n,t),n}async function st(e,t){if(!e.e2e)return e;let n={...e};delete n.e2e;let r=D(e.e2e.nonce);return await nt(e,n,t,r),await rt(e,n,t,r),await it(e,n,t,r),await at(e,n,t,r),n}function ct(e){return e.type===`subscription-ack`&&typeof e.ackId==`string`}function lt(e){let{e2eAuth:t,websocket:n,...r}=e,i=new x({...r,url:`<pre-connected>`,createWebSocket:()=>n,auth:t,autoReconnect:!1,messageTransform:async e=>{let n=t.getSessionKey();if(!n||ct(e))return e;let r=e;if(!r.e2e)throw Error(`Received plaintext message on E2E-encrypted channel — possible injection`);return st(r,n)}});async function a(e,n){let r=t.getSessionKey();if(!r)throw Error(`E2E session key not available - authentication may have failed`);let a=await ot(e,r);return i.send(a,n)}return{name:i.name,connect:i.connect.bind(i),disconnect:i.disconnect.bind(i),send:a,cancelRequest:i.cancelRequest.bind(i),onReceive:i.onReceive.bind(i),subscribe:i.subscribe.bind(i),unsubscribe:i.unsubscribe.bind(i),getSubscriptions:i.getSubscriptions.bind(i)}}function ut(e){return lt(e)}function dt(e){if(!e||typeof e!=`object`)return!1;let t=e;if(t.type!==`e2e-relay-envelope`||typeof t.payload!=`string`)return!1;let n=t.e2e;return!!n&&typeof n.nonce==`string`&&typeof n.v==`number`}async function ft(e,t){let{ciphertext:n,nonce:r}=await V(t,O(JSON.stringify(e)));return{type:`e2e-relay-envelope`,payload:E(n),e2e:{nonce:E(r),v:1}}}async function pt(e,t){let n=D(e.e2e.nonce),r=k(await H(t,D(e.payload),n));return JSON.parse(r)}function mt(e){let t=()=>{if(!e.isFrozen())throw Error(`RelayControlRegistry must be frozen before processing relay control messages`)};function n(t){return typeof t.namespace!=`string`||typeof t.subject!=`string`||!e.isControlEvent(t.namespace,t.subject)||typeof t.messageId!=`string`?!1:t.payload!==void 0}function r(t){return typeof t.namespace!=`string`||typeof t.subject!=`string`||!e.isControlRequest(t.namespace,t.subject)||typeof t.messageId!=`string`||typeof t.correlationId!=`string`?!1:t.payload!==void 0}function i(e){if(t(),!e||typeof e!=`object`)return!1;let i=e;return i.type===`event`?n(i):i.type===`request`?r(i):!1}function a(e){if(t(),!e||typeof e!=`object`)return!1;let n=e;return n.type!==`relay-control`||n.v!==1||!n.payload||typeof n.payload!=`object`?!1:i(n.payload)}function o(e){if(t(),!i(e))throw Error(`Invalid relay control message`);return{type:`relay-control`,v:1,payload:e}}return{createRelayControlEnvelope:o,isRelayControlEnvelopeMessage:a,isRelayControlBusMessage:i}}function Q(e){let t=Date.now()-3e5;for(let[n,r]of e)r>=t||e.delete(n);for(;e.size>2048;){let t=e.keys().next().value;if(!t)break;e.delete(t)}}const ht=e=>{if(!e||typeof e!=`object`)return!1;let t=e;return t.type===`response`&&typeof t.correlationId==`string`},gt=e=>e.type===`subscribe`||e.type===`unsubscribe`,_t=e=>{if(!e||typeof e!=`object`)return!1;let t=e;return t.type===`subscription-ack`&&typeof t.ackId==`string`};function $(e,t,n,r){if(!r.isFrozen())throw Error(`E2ERelay transport requires a frozen relay control registry`);let{createRelayControlEnvelope:i,isRelayControlEnvelopeMessage:a,isRelayControlBusMessage:o}=mt(r),s=e=>{n.delete(e),n.set(e,Date.now()),Q(n)};return{encode:async t=>{if(o(t))return t.type===`request`&&s(t.correlationId),JSON.stringify(i(t));if(Q(n),t.type===`response`&&n.has(t.correlationId))return n.delete(t.correlationId),JSON.stringify(t);let r=e.getSessionKey();if(!r&&gt(t)||!r&&_t(t))return JSON.stringify(t);if(!r)throw Error(`E2E relay session not established`);let a=await ft(t,r);return JSON.stringify(a)},decode:async r=>{let i=e.getSessionKey();if(a(r)){let e=r.payload;return t&&console.info(`[E2ERelayTransport] Decoded relay control envelope:`,e.type,e.namespace,e.subject),e.type===`request`&&s(e.correlationId),e}if(Q(n),ht(r)&&n.has(r.correlationId))return n.delete(r.correlationId),r;if(!i&&_t(r))return r;if(!i)throw Error(`E2E relay session not established`);if(!dt(r))throw Error(`Received plaintext message on relay E2E channel — possible injection`);return pt(r,i)}}}function vt(e,t,n=!1){let r=new Map;return{codec:$(e,n,r,t),reset:()=>r.clear()}}function yt(e){let{e2eAuth:t,registry:n,websocket:r,...i}=e,a=e.debug??!1,o=new Map,s=$(t,a,o,n);a&&console.info(`[E2ERelayTransport] Creating inner transport...`);let c=new x({...i,url:`<pre-connected>`,createWebSocket:()=>r,auth:t,codec:s,autoReconnect:!1});return a&&console.info(`[E2ERelayTransport] Inner transport created`),{name:c.name,connect:async()=>{if(!n.isFrozen())throw Error(`E2ERelayClientTransport: registry must be frozen before connect()`);o.clear();try{await c.connect()}catch(e){throw o.clear(),e}},disconnect:async()=>{o.clear();try{await c.disconnect()}finally{o.clear()}},send:c.send.bind(c),cancelRequest:c.cancelRequest.bind(c),onReceive:(...e)=>(a&&console.info(`[E2ERelayTransport] onReceive called, delegating to inner transport`),c.onReceive(...e)),subscribe:c.subscribe.bind(c),unsubscribe:c.unsubscribe.bind(c),getSubscriptions:c.getSubscriptions.bind(c),isReady:()=>!!t.getSessionKey()&&c.isReady()}}function bt(){let e=!1,t=new Map,n=new Map,r=()=>{if(e)throw Error(`RelayControlRegistry is frozen and cannot be modified`)};return{registerEventSubjects(e,n){r();let i=t.get(e)??new Set;for(let e of n)i.add(e);t.set(e,i)},registerRequestNamespace(e,t){if(r(),t.length===0)throw Error(`RelayControlRegistry request namespace "${e}" requires at least one subject`);let i=n.get(e)??new Set;for(let e of t)i.add(e);n.set(e,i)},freeze(){e=!0},isFrozen(){return e},isControlEvent(e,n){return t.get(e)?.has(n)??!1},isControlRequest(e,t){return n.get(e)?.has(t)??!1}}}function xt(e){if(we(e),e.mode===`client`){if(e.connectionOptions!==void 0)throw Error(`createWebSocketTransport(client) does not support connectionOptions when wrapping a pre-created WebSocket. Use WebSocketClientTransport for reconnect or dial-time socket options.`);let t=e.websocket;return new x({url:`<pre-connected>`,createWebSocket:()=>t,auth:e.auth,debug:e.debug,autoReconnect:!1})}else return new w({websocket:e.websocket,auth:e.auth,debug:e.debug})}export{Xe as DispatchingAuth,Je as E2EAuth,Ye as E2ERelayAuth,De as HmacAuth,w as ServerTransport,x as WebSocketClientTransport,je as clearHmacIdentitySecretsForTesting,ut as createE2EClientTransport,yt as createE2ERelayClientTransport,vt as createE2ERelayCodec,mt as createRelayControlHelpers,bt as createRelayControlRegistry,Ce as createWebSocketCloseEvent,xt as createWebSocketTransport,We as crypto,ie as extractSocketErrorMessage,Oe as registerHmacIdentitySecret,Ae as resolveHmacIdentityPeer,ke as resolveHmacIdentitySecret};

package/dist/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@makaio/framework",
-  "version": "1.0.0-dev-1782480236258",
+  "version": "1.0.0-dev-1783282710723",
   "type": "module"
 }

package/dist/{schema-Bf_ZNjif.d.mts → schema-D1HrnvT7.d.mts}

@@ -258,7 +258,7 @@ declare const sessions: _$drizzle_orm_sqlite_core0.SQLiteTableWithColumns<{
       tableName: "sessions";
       dataType: "string";
       columnType: "SQLiteText";
-      data: "closed" | "discovered" | "active" | "archived";
+      data: "discovered" | "closed" | "active" | "archived";
       driverParam: string;
       notNull: true;
       hasDefault: false;
@@ -372,7 +372,7 @@ declare const sessions: _$drizzle_orm_sqlite_core0.SQLiteTableWithColumns<{
       tableName: "sessions";
       dataType: "string";
       columnType: "SQLiteText";
-      data: "branch" | "fork" | "subagent" | "compress" | "rewrite" | "coordinator" | "aside";
+      data: "fork" | "subagent" | "compress" | "branch" | "rewrite" | "coordinator" | "aside";
       driverParam: string;
       notNull: false;
       hasDefault: false;

package/dist/{schemas-C6TVJ80V2.d.mts → schemas-D-9zNyAM2.d.mts}

@@ -44,11 +44,11 @@ type SubagentTemplateSummary = z.infer<typeof SubagentTemplateSummarySchema>;
  */
 declare const SubagentTemplateCreateSchema: z.ZodObject<{
   name: z.ZodString;
+  enabled: z.ZodDefault<z.ZodBoolean>;
   adapterName: z.ZodString;
-  providerConfigId: z.ZodOptional<z.ZodString>;
   model: z.ZodOptional<z.ZodString>;
-  enabled: z.ZodDefault<z.ZodBoolean>;
   systemPrompt: z.ZodOptional<z.ZodString>;
+  providerConfigId: z.ZodOptional<z.ZodString>;
   allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
   disallowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
   allowedDirectories: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -129,11 +129,11 @@ declare const SubagentTemplateSettingsSchemas: {
   create: {
     request: z.ZodObject<{
       name: z.ZodString;
+      enabled: z.ZodDefault<z.ZodBoolean>;
       adapterName: z.ZodString;
-      providerConfigId: z.ZodOptional<z.ZodString>;
       model: z.ZodOptional<z.ZodString>;
-      enabled: z.ZodDefault<z.ZodBoolean>;
       systemPrompt: z.ZodOptional<z.ZodString>;
+      providerConfigId: z.ZodOptional<z.ZodString>;
       allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
       disallowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
       allowedDirectories: z.ZodOptional<z.ZodArray<z.ZodString>>;

package/dist/{schemas-D512XweP.d.mts → schemas-DMCGXlKa.d.mts}

@@ -104,8 +104,8 @@ type ProjectedField = z.infer<typeof ProjectedFieldSchema>;
 declare const ArtifactProjectionPolicySchema: z.ZodObject<{
   mode: z.ZodEnum<{
     none: "none";
-    surface: "surface";
     comment: "comment";
+    surface: "surface";
   }>;
   defaultRole: z.ZodOptional<z.ZodEnum<{
     artifact: "artifact";

package/dist/scoped-bus-CZId-Df8.mjs

@@ -0,0 +1 @@
+import{s as e}from"./bus-rgUFuO2a.mjs";export{e as createScopedBus};

package/dist/services/adapter-subsystem/index.d.mts

@@ -1,3 +1,3 @@
-import { S as ProviderConfigFileRecordSchema, _ as BindingRecord, a as CanonicalProviderConfigPatchSchema, b as EffectiveAdapterSchema, c as CreateCanonicalProviderConfigInputSchema, d as ProviderConfigFileSet, f as AdapterFileConfig, g as AdapterSubsystemSchemas, h as AdapterReadinessSchema, i as CanonicalProviderConfigPatch, l as AdapterFileConfigSet, m as AdapterReadiness, n as CanonicalProviderConfigCredentialRefsPayload, o as CreateCanonicalProviderConfigInput, p as AdapterFileConfigSchema, r as CanonicalProviderConfigCredentialRefsSchema, s as CreateCanonicalProviderConfigInputPayload, t as CanonicalProviderConfigCredentialRefs, u as IAdapterConfigRepository, v as BindingRecordSchema, x as ProviderConfigFileRecord, y as EffectiveAdapter } from "../../index-Cyi7y_aG.mjs";
-import { n as AdapterSubsystemSubjects, t as AdapterSubsystemNamespace } from "../../namespace-CGxFYDlK.mjs";
+import { S as ProviderConfigFileRecordSchema, _ as BindingRecord, a as CanonicalProviderConfigPatchSchema, b as EffectiveAdapterSchema, c as CreateCanonicalProviderConfigInputSchema, d as ProviderConfigFileSet, f as AdapterFileConfig, g as AdapterSubsystemSchemas, h as AdapterReadinessSchema, i as CanonicalProviderConfigPatch, l as AdapterFileConfigSet, m as AdapterReadiness, n as CanonicalProviderConfigCredentialRefsPayload, o as CreateCanonicalProviderConfigInput, p as AdapterFileConfigSchema, r as CanonicalProviderConfigCredentialRefsSchema, s as CreateCanonicalProviderConfigInputPayload, t as CanonicalProviderConfigCredentialRefs, u as IAdapterConfigRepository, v as BindingRecordSchema, x as ProviderConfigFileRecord, y as EffectiveAdapter } from "../../index-D6aAzr32.mjs";
+import { n as AdapterSubsystemSubjects, t as AdapterSubsystemNamespace } from "../../namespace-B4cV_pk3.mjs";
 export { AdapterFileConfig, AdapterFileConfigSchema, AdapterFileConfigSet, AdapterReadiness, AdapterReadinessSchema, AdapterSubsystemNamespace, AdapterSubsystemSchemas, AdapterSubsystemSubjects, BindingRecord, BindingRecordSchema, CanonicalProviderConfigCredentialRefs, CanonicalProviderConfigCredentialRefsPayload, CanonicalProviderConfigCredentialRefsSchema, CanonicalProviderConfigPatch, CanonicalProviderConfigPatchSchema, CreateCanonicalProviderConfigInput, CreateCanonicalProviderConfigInputPayload, CreateCanonicalProviderConfigInputSchema, EffectiveAdapter, EffectiveAdapterSchema, IAdapterConfigRepository, ProviderConfigFileRecord, ProviderConfigFileRecordSchema, ProviderConfigFileSet };

package/dist/services/adapter-subsystem/namespace.d.mts

@@ -1,2 +1,2 @@
-import { n as AdapterSubsystemSubjects, t as AdapterSubsystemNamespace } from "../../namespace-CGxFYDlK.mjs";
+import { n as AdapterSubsystemSubjects, t as AdapterSubsystemNamespace } from "../../namespace-B4cV_pk3.mjs";
 export { AdapterSubsystemNamespace, AdapterSubsystemSubjects };

package/dist/services/context-rules/index.d.mts

@@ -160,9 +160,9 @@ declare const ResolvedContextRulesSchema: z.ZodObject<{
 declare const ContextRuleChangedEventSchema: z.ZodObject<{
   ruleId: z.ZodString;
   changeType: z.ZodEnum<{
-    updated: "updated";
-    deleted: "deleted";
     created: "created";
+    deleted: "deleted";
+    updated: "updated";
   }>;
   previous: z.ZodNullable<z.ZodObject<{
     scope: z.ZodEnum<{
@@ -313,9 +313,9 @@ declare const ContextRulesServiceNamespace: _$_makaio_core0.BusNamespaceDefiniti
   changed: _$zod.ZodObject<{
     ruleId: _$zod.ZodString;
     changeType: _$zod.ZodEnum<{
-      updated: "updated";
-      deleted: "deleted";
       created: "created";
+      deleted: "deleted";
+      updated: "updated";
     }>;
     previous: _$zod.ZodNullable<_$zod.ZodObject<{
       scope: _$zod.ZodEnum<{
@@ -383,9 +383,9 @@ declare const ContextRulesServiceSubjects: _$_makaio_core0.BusSubjects<_$_makaio
   changed: _$zod.ZodObject<{
     ruleId: _$zod.ZodString;
     changeType: _$zod.ZodEnum<{
-      updated: "updated";
-      deleted: "deleted";
       created: "created";
+      deleted: "deleted";
+      updated: "updated";
     }>;
     previous: _$zod.ZodNullable<_$zod.ZodObject<{
       scope: _$zod.ZodEnum<{

package/dist/services/execution-target/index.d.mts

@@ -1,4 +1,4 @@
 import { a as ExecutionTargetInputSchema, c as ExecutionTargetResolveRequest, d as ExecutionTargetSchemas, f as ExecutionTargetType, i as ExecutionTargetInput, l as ExecutionTargetResolveRequestSchema, m as LocalExecutionTargetSchema, n as ContainerLocalExecutionTargetSchema, o as ExecutionTargetListQuery, p as ExecutionTargetTypeSchema, r as ExecutionTarget, s as ExecutionTargetListQuerySchema, t as ContainerIsolatedExecutionTargetSchema, u as ExecutionTargetSchema } from "../../schemas-D4zaFE2p.mjs";
 import { n as ExecutionTargetSubjects, t as ExecutionTargetNamespace } from "../../namespace-65uwTpbg.mjs";
-import { A as StatusResponseSchema, C as SpawnRequest, D as StatusRequest, E as SpawnResponseSchema, M as StopRequestSchema, N as StopResponse, O as StatusRequestSchema, P as StopResponseSchema, S as ContainerStoppedSchema, T as SpawnResponse, _ as ContainerStarted, a as ContainerBootstrapConfig, b as ContainerStateSchema, c as ContainerCreatedSchema, d as ContainerIsolatedSpawnRequest, f as ContainerIsolatedSpawnRequestSchema, g as ContainerRuntimeSchema, h as ContainerRuntime, i as DockerSubjects, j as StopRequest, k as StatusResponse, l as ContainerDestroyed, m as ContainerLocalSpawnRequestSchema, n as ContainerSpawnSubjects, o as ContainerBootstrapConfigSchema, p as ContainerLocalSpawnRequest, r as DockerNamespace, s as ContainerCreated, t as ContainerSpawnNamespace, u as ContainerDestroyedSchema, v as ContainerStartedSchema, w as SpawnRequestSchema, x as ContainerStopped, y as ContainerState } from "../../index-mU2lnU7O.mjs";
+import { A as StatusResponseSchema, C as SpawnRequest, D as StatusRequest, E as SpawnResponseSchema, M as StopRequestSchema, N as StopResponse, O as StatusRequestSchema, P as StopResponseSchema, S as ContainerStoppedSchema, T as SpawnResponse, _ as ContainerStarted, a as ContainerBootstrapConfig, b as ContainerStateSchema, c as ContainerCreatedSchema, d as ContainerIsolatedSpawnRequest, f as ContainerIsolatedSpawnRequestSchema, g as ContainerRuntimeSchema, h as ContainerRuntime, i as DockerSubjects, j as StopRequest, k as StatusResponse, l as ContainerDestroyed, m as ContainerLocalSpawnRequestSchema, n as ContainerSpawnSubjects, o as ContainerBootstrapConfigSchema, p as ContainerLocalSpawnRequest, r as DockerNamespace, s as ContainerCreated, t as ContainerSpawnNamespace, u as ContainerDestroyedSchema, v as ContainerStartedSchema, w as SpawnRequestSchema, x as ContainerStopped, y as ContainerState } from "../../index-CqCe7Phc.mjs";
 export { ContainerBootstrapConfig, ContainerBootstrapConfigSchema, ContainerCreated, ContainerCreatedSchema, ContainerDestroyed, ContainerDestroyedSchema, ContainerIsolatedExecutionTargetSchema, ContainerIsolatedSpawnRequest, ContainerIsolatedSpawnRequestSchema, ContainerLocalExecutionTargetSchema, ContainerLocalSpawnRequest, ContainerLocalSpawnRequestSchema, ContainerRuntime, ContainerRuntimeSchema, ContainerSpawnNamespace, ContainerSpawnSubjects, ContainerStarted, ContainerStartedSchema, ContainerState, ContainerStateSchema, ContainerStopped, ContainerStoppedSchema, DockerNamespace, DockerSubjects, ExecutionTarget, ExecutionTargetInput, ExecutionTargetInputSchema, ExecutionTargetListQuery, ExecutionTargetListQuerySchema, ExecutionTargetNamespace, ExecutionTargetResolveRequest, ExecutionTargetResolveRequestSchema, ExecutionTargetSchema, ExecutionTargetSchemas, ExecutionTargetSubjects, ExecutionTargetType, ExecutionTargetTypeSchema, LocalExecutionTargetSchema, SpawnRequest, SpawnRequestSchema, SpawnResponse, SpawnResponseSchema, StatusRequest, StatusRequestSchema, StatusResponse, StatusResponseSchema, StopRequest, StopRequestSchema, StopResponse, StopResponseSchema };

package/dist/services/filesystem/namespace.d.mts

@@ -10,18 +10,18 @@ declare const FsNamespace: _$_makaio_core0.BusNamespaceDefinition<"fs", {
   changed: _$zod.ZodObject<{
     path: _$zod.ZodString;
     kind: _$zod.ZodEnum<{
-      change: "change";
       create: "create";
       delete: "delete";
+      change: "change";
     }>;
   }, _$zod_v4_core0.$strip>;
   batch: _$zod.ZodObject<{
     changes: _$zod.ZodArray<_$zod.ZodObject<{
       path: _$zod.ZodString;
       kind: _$zod.ZodEnum<{
-        change: "change";
         create: "create";
         delete: "delete";
+        change: "change";
       }>;
     }, _$zod_v4_core0.$strip>>;
   }, _$zod_v4_core0.$strip>;
@@ -153,18 +153,18 @@ declare const FsSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.FlatSubjec
   changed: _$zod.ZodObject<{
     path: _$zod.ZodString;
     kind: _$zod.ZodEnum<{
-      change: "change";
       create: "create";
       delete: "delete";
+      change: "change";
     }>;
   }, _$zod_v4_core0.$strip>;
   batch: _$zod.ZodObject<{
     changes: _$zod.ZodArray<_$zod.ZodObject<{
       path: _$zod.ZodString;
       kind: _$zod.ZodEnum<{
-        change: "change";
         create: "create";
         delete: "delete";
+        change: "change";
       }>;
     }, _$zod_v4_core0.$strip>>;
   }, _$zod_v4_core0.$strip>;
@@ -294,18 +294,18 @@ declare const FileSystemSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.Fl
   changed: _$zod.ZodObject<{
     path: _$zod.ZodString;
     kind: _$zod.ZodEnum<{
-      change: "change";
       create: "create";
       delete: "delete";
+      change: "change";
     }>;
   }, _$zod_v4_core0.$strip>;
   batch: _$zod.ZodObject<{
     changes: _$zod.ZodArray<_$zod.ZodObject<{
       path: _$zod.ZodString;
       kind: _$zod.ZodEnum<{
-        change: "change";
         create: "create";
         delete: "delete";
+        change: "change";
       }>;
     }, _$zod_v4_core0.$strip>>;
   }, _$zod_v4_core0.$strip>;

package/dist/services/filesystem/schemas.d.mts

@@ -5,9 +5,9 @@ import { z } from "zod";
  * File change kind.
  */
 declare const FsChangeKindSchema: z.ZodEnum<{
-  change: "change";
   create: "create";
   delete: "delete";
+  change: "change";
 }>;
 type FsChangeKind = z.infer<typeof FsChangeKindSchema>;
 /**
@@ -16,9 +16,9 @@ type FsChangeKind = z.infer<typeof FsChangeKindSchema>;
 declare const FsChangedSchema: z.ZodObject<{
   path: z.ZodString;
   kind: z.ZodEnum<{
-    change: "change";
     create: "create";
     delete: "delete";
+    change: "change";
   }>;
 }, z.core.$strip>;
 type FsChanged = z.infer<typeof FsChangedSchema>;
@@ -29,9 +29,9 @@ declare const FsBatchSchema: z.ZodObject<{
   changes: z.ZodArray<z.ZodObject<{
     path: z.ZodString;
     kind: z.ZodEnum<{
-      change: "change";
       create: "create";
       delete: "delete";
+      change: "change";
     }>;
   }, z.core.$strip>>;
 }, z.core.$strip>;

package/dist/services/git/namespace.d.mts

@@ -321,8 +321,8 @@ declare const GitNamespace: _$_makaio_core0.BusNamespaceDefinition<"git", {
     path: _$zod.ZodString;
     branch: _$zod.ZodString;
     event: _$zod.ZodEnum<{
-      removed: "removed";
       added: "added";
+      removed: "removed";
     }>;
     timestamp: _$zod.ZodString;
   }, _$zod_v4_core0.$strip>; /** Add a repo to watch */
@@ -420,8 +420,8 @@ declare const GitNamespace: _$_makaio_core0.BusNamespaceDefinition<"git", {
       repoPath: _$zod.ZodOptional<_$zod.ZodString>;
       source: _$zod.ZodString;
       approach: _$zod.ZodOptional<_$zod.ZodEnum<{
-        squash: "squash";
         merge: "merge";
+        squash: "squash";
         "fast-forward-only": "fast-forward-only";
       }>>;
       message: _$zod.ZodOptional<_$zod.ZodString>;
@@ -899,8 +899,8 @@ declare const GitSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.FlatSubje
     path: _$zod.ZodString;
     branch: _$zod.ZodString;
     event: _$zod.ZodEnum<{
-      removed: "removed";
       added: "added";
+      removed: "removed";
     }>;
     timestamp: _$zod.ZodString;
   }, _$zod_v4_core0.$strip>; /** Add a repo to watch */
@@ -998,8 +998,8 @@ declare const GitSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.FlatSubje
       repoPath: _$zod.ZodOptional<_$zod.ZodString>;
       source: _$zod.ZodString;
       approach: _$zod.ZodOptional<_$zod.ZodEnum<{
-        squash: "squash";
         merge: "merge";
+        squash: "squash";
         "fast-forward-only": "fast-forward-only";
       }>>;
       message: _$zod.ZodOptional<_$zod.ZodString>;

package/dist/services/git/schemas.d.mts

@@ -420,8 +420,8 @@ declare const GitWorktreeEventSchema: z.ZodObject<{
   path: z.ZodString;
   branch: z.ZodString;
   event: z.ZodEnum<{
-    removed: "removed";
     added: "added";
+    removed: "removed";
   }>;
   timestamp: z.ZodString;
 }, z.core.$strip>;
@@ -543,8 +543,8 @@ type GitCreateCommitResponse = z.infer<typeof GitCreateCommitResponseSchema>;
  * - 'fast-forward-only': Only allow fast-forward merges
  */
 declare const GitMergeApproachSchema: z.ZodEnum<{
-  squash: "squash";
   merge: "merge";
+  squash: "squash";
   "fast-forward-only": "fast-forward-only";
 }>;
 type GitMergeApproach = z.infer<typeof GitMergeApproachSchema>;
@@ -553,8 +553,8 @@ declare const GitMergeRequestSchema: z.ZodObject<{
   repoPath: z.ZodOptional<z.ZodString>;
   source: z.ZodString;
   approach: z.ZodOptional<z.ZodEnum<{
-    squash: "squash";
     merge: "merge";
+    squash: "squash";
     "fast-forward-only": "fast-forward-only";
   }>>;
   message: z.ZodOptional<z.ZodString>;