@makaio/framework 1.0.0-dev-1788721567504 → 1.0.0-dev-1788832451167

package/dist/node/transports/index.mjs

@@ -1,2 +1,2 @@
-import{r as e}from"../../chunk-DTipWd-i.mjs";import{isRecord as t}from"@makaio/framework/utils";import{ConnectionLostError as n,CorrelationTracker as r,DEFAULT_REQUEST_TIMEOUT_MS as i,NoHandlerError as a,TimeoutError as o,buildSubscribeMessage as s,buildUnsubscribeMessage as c,deserializeTransportError as l,getSubjectFromBusMessage as u,handleCorrelationResponse as d,isNoHandlerErrorForSubject as f,matchesSubscription as p,shouldReceiveMessage as m,trackMessageCorrelation as ee}from"@makaio/framework/bus";const te={baseMs:1e3,maxMs:1e4};function ne(e,t,n){let r=Math.max(t,100),i=Math.max(n,r);return Math.min(r*2**e,i)}function re(e,t){return new Promise(n=>{if(t.aborted){n();return}let r=()=>{clearTimeout(i),t.removeEventListener(`abort`,r),n()},i=setTimeout(()=>{t.removeEventListener(`abort`,r),n()},e);t.addEventListener(`abort`,r)})}const h={intervalMs:3e4,timeoutMs:1e4},ie={encode:async e=>JSON.stringify(e),decode:async e=>e};function ae(e){return e===!1?!1:{baseMs:e?.baseMs??te.baseMs,maxMs:e?.maxMs??te.maxMs}}function oe(e){if(e===!1)return!1;let t=e?.intervalMs??h.intervalMs,n=e?.timeoutMs??h.timeoutMs;if(!Number.isFinite(t)||t<=0)throw RangeError(`heartbeat.intervalMs must be a finite number > 0 (got ${String(t)})`);if(!Number.isFinite(n)||n<=0)throw RangeError(`heartbeat.timeoutMs must be a finite number > 0 (got ${String(n)})`);return{intervalMs:t,timeoutMs:n}}function g(e,t=`unknown error`){return`message`in e?String(e.message):t}async function _(e,t,n){let r=await t.encode(e);n.send(r)}function se(e,t){return e.readyState===1?Promise.resolve():e.readyState>=2?Promise.reject(Error(`WebSocket closed before opening`)):new Promise((n,r)=>{let i=()=>{c!==void 0&&clearTimeout(c),e.removeEventListener(`open`,a),e.removeEventListener(`error`,o),e.removeEventListener(`close`,s)},a=()=>{i(),n()},o=e=>{i(),r(Error(`WebSocket connection failed — ${g(e)}`))},s=()=>{i(),r(Error(`WebSocket closed before opening`))},c=t===void 0?void 0:setTimeout(()=>{i(),r(Error(`WebSocket open timed out after ${t}ms`))},t);e.addEventListener(`open`,a),e.addEventListener(`error`,o),e.addEventListener(`close`,s)})}async function ce(e,t,n){let r=await Promise.allSettled(Array.from(t).map(t=>t(e,n.receiveContext)));for(let e of r)e.status===`rejected`&&n.debug&&console.error(`[WebSocketClientTransport:${n.name}] Handler error:`,e.reason);return r.every(e=>e.status===`fulfilled`)}function le(e,t){return{...t?.getReceiveContext?.(),transportName:e}}async function ue(e,t){let{name:n,debug:r,auth:i,codec:a,messageTransform:o,correlations:s}=t,c=JSON.parse(e.toString());if(typeof c!=`object`||!c||typeof c.type!=`string`)return r&&console.error(`[WebSocketClientTransport:${n}] Invalid message structure:`,c),null;let l=c;if(i?.handleAuthMessage(l)||l.type===`heartbeat`)return null;let u=await a.decode(l);return o&&(u=await o(u)),u.type===`heartbeat`?null:u.type===`subscribe-sync-complete`?(t.onSyncComplete(),null):u.type===`subscription-ack`?(typeof u.ackId==`string`&&t.onSubscriptionAck(u.ackId),null):d(u,s)?null:u}async function de(e,t){let{name:n,debug:r,auth:i,handlers:a}=t,o=null;try{o=await ue(e,t)}catch(e){r&&console.error(`[WebSocketClientTransport:${n}] Failed to parse message:`,e);return}if(o===null)return;let s=le(n,i),c=o;ce(c,a,{debug:r,name:n,receiveContext:s}).then(async e=>{e&&(c.type===`subscribe`||c.type===`unsubscribe`)&&typeof c.ackId==`string`&&await t.sendSubscriptionAck(c.ackId)}).catch(e=>{r&&console.error(`[WebSocketClientTransport:${n}] Handler dispatch error:`,e)})}function fe(e){let t=e;return typeof t.ping==`function`&&typeof t.terminate==`function`&&typeof t.on==`function`&&typeof t.off==`function`}function v(e){e.unref?.()}function pe(e,t,n){if(!fe(e))return()=>{};let r=!1,i=Date.now(),a=null,o=null,s=()=>{if(r)return;let e=Date.now()-i,n=Math.max(0,t.intervalMs-e);a=setTimeout(l,n),v(a)},c=()=>{o=null,f(),n.debug&&console.warn(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Heartbeat deadline expired (no message/pong within ${t.timeoutMs}ms) — terminating socket`),e.terminate()},l=()=>{if(a=null,!r&&o===null){if(Date.now()-i<t.intervalMs){s();return}e.readyState===1&&(e.ping(),o=setTimeout(c,t.timeoutMs),v(o))}},u=()=>{i=Date.now(),o!==null&&(clearTimeout(o),o=null),a===null&&s()},d=()=>{f()},f=()=>{r||(r=!0,a!==null&&(clearTimeout(a),a=null),o!==null&&(clearTimeout(o),o=null),e.removeEventListener(`message`,u),e.removeEventListener(`close`,d),e.off(`pong`,u))};return e.addEventListener(`message`,u),e.on(`pong`,u),e.addEventListener(`close`,d),s(),f}async function y(e){await Promise.allSettled(e.inFlightMessages),e.correlations.rejectAll(new n(e.name))}function me(e,t){let n=n=>{let r=de(n.data,{name:t.name,debug:t.debug,auth:t.auth,codec:t.codec,messageTransform:t.messageTransform,correlations:t.correlations,handlers:t.handlers,onSyncComplete:()=>{t.resolveReady()},onSubscriptionAck:e=>{t.resolveSubscriptionAck(e)},sendSubscriptionAck:async n=>{e.readyState===1&&await _({type:`subscription-ack`,ackId:n},t.codec,e)}}).finally(()=>{t.inFlightMessages.delete(r)});t.inFlightMessages.add(r)};t.setMessageListener(n),e.addEventListener(`message`,n)}function b(e,t){let n=t.getMessageListener();n!==null&&(e.removeEventListener(`message`,n),t.setMessageListener(null));let r=t.getCloseListener();r!==null&&(e.removeEventListener(`close`,r),t.setCloseListener(null))}async function x(e){e.inFlightMessages.size>0?await y(e):e.correlations.rejectAll(new n(e.name)),e.inFlightMessages.clear(),e.resolveReady(),e.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: reconnecting before subscription ack`)),e.resetReadyPromise();let t=e.getSocket();t!==null&&b(t,e);let r=await e.wsFactory(e.url);e.setSocket(r),e.setAuthComplete(!1);try{me(r,e),await se(r,e.connectTimeoutMs),e.auth&&await e.auth.authenticateClient(e=>{if(r.readyState!==1)throw Error(`WebSocketClientTransport: cannot send auth message — socket not open`);r.send(JSON.stringify(e))}),e.setAuthComplete(!0),e.debug&&console.info(`[WebSocketClientTransport:${e.name}] Connected to ${e.url}`),e.localSubscriptions.size>0&&(await _(s(e.localSubscriptions),e.codec,r),e.debug&&console.info(`[WebSocketClientTransport:${e.name}] Replayed ${e.localSubscriptions.size} subscription(s)`)),e.heartbeat!==!1&&pe(r,e.heartbeat,e),e.notifyConnected()}catch(t){let n=e.getSocket()===r;throw n&&e.auth?.cleanup(),b(r,e),n&&e.setSocket(null),e.setAuthComplete(!1),n&&(r.readyState===0||r.readyState===1)&&(r.addEventListener(`error`,()=>{}),r.close()),t}}function he(e,t){return new Promise(n=>{if(e.readyState===3||t.aborted){n();return}let r=()=>{t.removeEventListener(`abort`,i),n()},i=()=>{e.removeEventListener(`close`,r),n()};e.addEventListener(`close`,r),t.addEventListener(`abort`,i)})}async function ge(e,t,n,r,i){i(!0);try{for(;!e.aborted;){let i=n.getSocket(),a=i!==null;if(i!==null&&i.readyState!==3&&await he(i,e),e.aborted)break;a&&(await y(n),n.debug&&console.info(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Connection lost, starting reconnect loop (maxMs=${t.maxMs})`),n.notifyDisconnected());let o=0;for(;!e.aborted;){let i=ne(o,t.baseMs,t.maxMs);n.debug&&console.info(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Reconnecting in ${i}ms (attempt ${o+1})`);let a=new AbortController;if(r(a),await re(i,AbortSignal.any([e,a.signal])),r(null),e.aborted)break;try{await x(n),o=0;let t=n.getSocket();if(t!==null){let r=async()=>{await y(n),n.auth?.cleanup(),n.setAuthComplete(!1),n.debug&&console.info(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Connection closed`),n.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: disconnected before subscription ack`))};n.setCloseListener(r),t.addEventListener(`close`,r),await he(t,e)}break}catch(e){if(n.debug){let t=e instanceof Error?e.message:String(e);console.warn(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Connect attempt ${o+1} failed: ${t}`)}o++}}}}finally{i(!1)}}function _e(e,t,n){let r=async()=>{b(e,t),t.auth?.cleanup(),t.setAuthComplete(!1),t.setSocket(null),n(),t.resolveReady(),t.notifyDisconnected(),await y(t),t.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: disconnected before subscription ack`))};t.setCloseListener(r),e.addEventListener(`close`,r)}async function ve(e,t,n,r,i){let a=i.localSubscriptions.get(e),o=a?.filter,c=t??o,l=r??a?.deliveryClass??`relayable`;if(i.localSubscriptions.set(e,{filter:c,priorities:n,deliveryClass:l}),i.socket!==null&&i.socket.readyState===1){let t=i.beginSubscriptionAck?.(),r=s(new Map([[e,{filter:c,priorities:n,deliveryClass:l}]]),t?.ackId);try{await _(r,i.codec,i.socket),await t?.promise}catch(e){throw t?.reject(e),e}}i.debug&&console.info(`[WebSocketClientTransport:${i.name}] Subscribed to ${e}${c?` with filter`:``}`)}async function ye(e,t){let n=t.localSubscriptions.get(e);if(t.localSubscriptions.delete(e),t.socket!==null&&t.socket.readyState===1){let r=t.beginSubscriptionAck?.(),i=c({[e]:n?.priorities??[]},r?.ackId);try{await _(i,t.codec,t.socket),await r?.promise}catch(e){throw r?.reject(e),e}}t.debug&&console.info(`[WebSocketClientTransport:${t.name}] Unsubscribed from ${e}`)}var S=class{name;url;auth;codec;messageTransform;autoReconnectConfig;heartbeatConfig;connectTimeoutMs;wsFactory;debug;onConnectedCallback;onDisconnectedCallback;socket=null;authComplete=!1;correlations=new r;handlers=new Set;localSubscriptions=new Map;pendingSubscriptionAcks=new Map;subscriptionAckSeq=0;messageListener=null;closeListener=null;reconnectAbort=null;inFlightMessages=new Set;backoffWakeAbort=null;reconnectLoopRunning=!1;readyResolve=null;ready;onNewReadySession=void 0;onConnected=void 0;onDisconnected=void 0;constructor(e){this.url=e.url,this.name=e.name??`ws-client`,this.auth=e.auth,this.codec=e.codec??ie,this.messageTransform=e.messageTransform,this.debug=e.debug??!1,this.autoReconnectConfig=ae(e.autoReconnect),this.heartbeatConfig=oe(e.heartbeat),this.connectTimeoutMs=e.connectTimeoutMs??3e4,this.wsFactory=e.createWebSocket??this.defaultWsFactory,this.onConnectedCallback=e.onConnected,this.onDisconnectedCallback=e.onDisconnected,this.ready=new Promise(e=>{this.readyResolve=e})}async connect(){if(this.reconnectAbort!==null)throw Error(`WebSocketClientTransport: already connected`);let e=new AbortController;this.reconnectAbort=e;try{await x(this.connectionDeps())}catch(e){throw this.reconnectAbort=null,e}this.autoReconnectConfig===!1?this.socket!==null&&this.wireNoReconnectClose(this.socket):this.startReconnectLoop(e.signal)}async disconnect(){let e=this.reconnectAbort;if(this.reconnectAbort=null,e?.abort(),this.readyResolve?.(),this.readyResolve=null,this.socket!==null){b(this.socket,this.connectionDeps());let e=this.socket;this.socket=null,this.authComplete=!1,(e.readyState===0||e.readyState===1)&&e.close()}this.correlations.cleanup(),this.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: disconnected before subscription ack`)),this.auth?.cleanup(),this.handlers.clear(),this.debug&&console.info(`[WebSocketClientTransport:${this.name}] Disconnected`)}async send(e,t){if(this.socket===null||this.socket.readyState!==1)throw Error(`WebSocketClientTransport: not connected`);let n=await this.codec.encode(e);return this.socket.send(n),ee(e,this.correlations,t??i)}onReceive(e){return this.handlers.add(e),()=>{this.handlers.delete(e)}}async subscribe(e,t,n=[],r){await ve(e,t,n,r,this.subscriptionDeps())}async unsubscribe(e){await ye(e,this.subscriptionDeps())}getSubscriptions(){return new Set(this.localSubscriptions.keys())}cancelRequest(e,t){this.correlations.cancel(e,t)}isReady(){return this.socket!==null&&this.socket.readyState===1&&this.authComplete}async reconnect(){if(!this.isReady()){if(this.backoffWakeAbort!==null){this.backoffWakeAbort.abort(),this.backoffWakeAbort=null;return}if(this.autoReconnectConfig!==!1){if(this.reconnectLoopRunning){let e=this.socket;e!==null&&e.readyState===0&&e.close();return}return}try{await x(this.connectionDeps()),this.socket!==null&&(this.reconnectAbort=new AbortController,this.wireNoReconnectClose(this.socket))}catch{}}}startReconnectLoop(e){return ge(e,this.autoReconnectConfig,this.connectionDeps(),e=>{this.backoffWakeAbort=e},e=>{this.reconnectLoopRunning=e})}subscriptionDeps(){return{name:this.name,debug:this.debug,codec:this.codec,socket:this.socket,localSubscriptions:this.localSubscriptions,beginSubscriptionAck:()=>this.beginSubscriptionAck()}}beginSubscriptionAck(){let e=`${this.name}:sub:${++this.subscriptionAckSeq}`,t,n,r=new Promise((e,r)=>{t=e,n=r});r.catch(()=>void 0);let i=t=>{this.pendingSubscriptionAcks.has(e)&&(this.pendingSubscriptionAcks.delete(e),t())};return this.pendingSubscriptionAcks.set(e,{resolve:()=>i(t),reject:e=>i(()=>n(e))}),{ackId:e,promise:r,reject:t=>this.rejectSubscriptionAck(e,t)}}resolveSubscriptionAck(e){this.pendingSubscriptionAcks.get(e)?.resolve()}rejectSubscriptionAck(e,t){this.pendingSubscriptionAcks.get(e)?.reject(t)}rejectPendingSubscriptionAcks(e){for(let t of this.pendingSubscriptionAcks.keys())this.rejectSubscriptionAck(t,e)}connectionDeps(){return{name:this.name,debug:this.debug,auth:this.auth,codec:this.codec,messageTransform:this.messageTransform,correlations:this.correlations,handlers:this.handlers,localSubscriptions:this.localSubscriptions,wsFactory:this.wsFactory,url:this.url,connectTimeoutMs:this.connectTimeoutMs,heartbeat:this.heartbeatConfig,getSocket:()=>this.socket,setSocket:e=>{this.socket=e},setAuthComplete:e=>{this.authComplete=e},getMessageListener:()=>this.messageListener,setMessageListener:e=>{this.messageListener=e},getCloseListener:()=>this.closeListener,setCloseListener:e=>{this.closeListener=e},resolveReady:()=>{this.readyResolve?.(),this.readyResolve=null},resetReadyPromise:()=>{this.ready=new Promise(e=>{this.readyResolve=e}),this.onNewReadySession?.(this.ready)},resolveSubscriptionAck:e=>{this.resolveSubscriptionAck(e)},rejectPendingSubscriptionAcks:e=>{this.rejectPendingSubscriptionAcks(e)},notifyConnected:()=>{this.onConnectedCallback?.(),this.onConnected?.()},notifyDisconnected:()=>{this.onDisconnectedCallback?.(),this.onDisconnected?.()},inFlightMessages:this.inFlightMessages}}defaultWsFactory=async e=>new(await(import(`ws`))).WebSocket(e,{handshakeTimeout:this.connectTimeoutMs});wireNoReconnectClose(e){_e(e,this.connectionDeps(),()=>{this.reconnectAbort=null})}};function C(e){e.timer!==void 0&&clearTimeout(e.timer)}var be=class{pendingBroadcasts=new Map;timeout;debug;constructor(e={}){this.timeout=e.timeout??5e3,this.debug=e.debug??!1}startClientBroadcast(e,t,n,r,i){let a=t.correlationId,o=i??this.timeout,s={kind:`client`,sender:e,results:[],pendingClients:new Set(n),nodeResultsReceived:!1,timer:o===0?void 0:setTimeout(()=>{this.debug&&console.warn(`[BroadcastAggregator] Broadcast ${a} timed out`),this.finalizeBroadcast(a)},o)};this.pendingBroadcasts.set(a,s);let c=JSON.stringify(t);for(let e of n)r(e,c);this.debug&&console.info(`[BroadcastAggregator] Broadcast ${a} forwarded to ${n.length} clients`)}startServerBroadcast(e,t,n,r){let i=e.correlationId,a=r??this.timeout;return t.length===0?(this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${i} - no target clients`),Promise.resolve([])):new Promise(r=>{let o={kind:`server`,results:[],pendingClients:new Set(t),timer:a===0?void 0:setTimeout(()=>{this.debug&&console.warn(`[BroadcastAggregator] Server broadcast ${i} timed out`),this.finalizeServerBroadcast(i)},a),resolve:r};this.pendingBroadcasts.set(i,o);let s=JSON.stringify(e);for(let e of t)n(e,s);this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${i} sent to ${t.length} clients`)})}handleResponse(e,t){let n=this.pendingBroadcasts.get(t.correlationId);return n?(t.results&&n.results.push(...t.results),n.pendingClients.delete(e),this.debug&&console.info(`[BroadcastAggregator] Broadcast ${t.correlationId} got response, ${n.pendingClients.size} pending`),this.checkBroadcastComplete(t.correlationId,n),!0):!1}handleNodeResults(e,t,n){let r=this.pendingBroadcasts.get(e);return!r||r.kind!==`client`?!1:(r.results.push(...t),r.nodeResultsReceived=!0,r.nodeError=n,this.debug&&console.info(`[BroadcastAggregator] Broadcast ${e} node results aggregated${n?` (with error)`:``}`),this.checkBroadcastComplete(e,r),!0)}handleClientDisconnect(e){for(let[t,n]of this.pendingBroadcasts)n.kind===`client`&&n.sender===e?(C(n),this.pendingBroadcasts.delete(t)):n.pendingClients.has(e)&&(n.pendingClients.delete(e),this.checkBroadcastComplete(t,n))}cleanup(){for(let e of this.pendingBroadcasts.values())C(e),e.kind===`server`&&e.resolve(e.results);this.pendingBroadcasts.clear()}checkBroadcastComplete(e,t){if(!(t.pendingClients.size>0))if(t.kind===`client`){if(!t.nodeResultsReceived)return;this.finalizeBroadcast(e)}else this.finalizeServerBroadcast(e)}finalizeBroadcast(e){let t=this.pendingBroadcasts.get(e);if(!t||t.kind!==`client`)return;C(t),this.pendingBroadcasts.delete(e);let n=t.nodeError?{type:`broadcast-response`,correlationId:e,error:t.nodeError}:{type:`broadcast-response`,correlationId:e,results:t.results};t.sender.readyState===1&&t.sender.send(JSON.stringify(n)),this.debug&&console.info(`[BroadcastAggregator] Broadcast ${e} finalized with ${t.results.length} results`)}finalizeServerBroadcast(e){let t=this.pendingBroadcasts.get(e);!t||t.kind!==`server`||(C(t),this.pendingBroadcasts.delete(e),t.resolve(t.results),this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${e} finalized with ${t.results.length} results`))}},xe=class{clients=new Set;authenticatingClients=new Set;clientSubscriptions=new Map;clientSubscriptionState=new Map;clientFilters=new Map;requestOrigins=new Map;debug;subjectRestrictionResolver;socketAuthChecker;constructor(e={}){this.debug=e.debug??!1,this.subjectRestrictionResolver=e.subjectRestrictionResolver,this.socketAuthChecker=e.socketAuthChecker}addAuthenticating(e){this.authenticatingClients.add(e)}removeAuthenticating(e){this.authenticatingClients.delete(e)}isAuthenticating(e){return this.authenticatingClients.has(e)}addClient(e){this.clients.add(e)}removeClient(e){let t=new Set(this.clientSubscriptionState.get(e)?.keys()??[]);this.clients.delete(e),this.authenticatingClients.delete(e),this.clientSubscriptions.delete(e),this.clientSubscriptionState.delete(e),this.clientFilters.delete(e);for(let[t,n]of this.requestOrigins)n.socket===e&&this.clearRequestOrigin(t,n);return this.debug&&console.info(`[ClientRegistry] Client removed (${this.clients.size} remaining)`),this.buildAggregateUpdates(t)}get size(){return this.clients.size}getAllSockets(){return new Set([...this.clients,...this.authenticatingClients])}handleSubscribeMessage(e,t){let n=this.clientSubscriptions.get(e);n||(n=new Set,this.clientSubscriptions.set(e,n));let r=this.clientFilters.get(e),i=this.clientSubscriptionState.get(e);i||(i=new Map,this.clientSubscriptionState.set(e,i));for(let[a,o]of Object.entries(t.subjects)){n.add(a),i.set(a,{priorities:o,deliveryClass:t.deliveryClasses?.[a]===`relayable`?`relayable`:`first-hop-only`});let s=t.filters?.[a];s===void 0?r?.delete(a):(r||(r=new Map,this.clientFilters.set(e,r)),r.set(a,s))}if(this.debug){let e=Object.keys(t.subjects).length,n=t.filters?Object.keys(t.filters).length:0;console.info(`[ClientRegistry] Client subscribed to ${e} subjects, ${n} filters`)}return this.buildAggregateUpdates(new Set(Object.keys(t.subjects)))}handleUnsubscribeMessage(e,t){let n=this.clientSubscriptions.get(e),r=this.clientFilters.get(e);for(let i of Object.keys(t))n?.delete(i),this.clientSubscriptionState.get(e)?.delete(i),r?.delete(i);return this.debug&&console.info(`[ClientRegistry] Client unsubscribed from ${Object.keys(t).length} subjects`),this.buildAggregateUpdates(new Set(Object.keys(t)))}getReadyClients(){let e=[];for(let t of this.clients)t.readyState===1&&e.push(t);return e}trackRequestOrigin(e,t){let{correlationId:n}=t;if(this.requestOrigins.has(n))return;let r=this.getRequestRemainingLifetime(t);if(r===0)return;let i={socket:e,expiration:void 0};r!==void 0&&(i.expiration=setTimeout(()=>{this.requestOrigins.get(n)===i&&this.requestOrigins.delete(n)},r)),this.requestOrigins.set(n,i)}getRequestOrigin(e){return this.requestOrigins.get(e)?.socket}consumeResponseClient(e){let t=this.requestOrigins.get(e);if(t)return this.clearRequestOrigin(e,t),this.isReadyAndAuthenticated(t.socket)?t.socket:void 0}cancelRequestOrigin(e){let t=this.requestOrigins.get(e);t&&this.clearRequestOrigin(e,t)}getInterestedClients(e,t,n){let r=[];for(let i of this.clients)i===n||!this.isReadyAndAuthenticated(i)||this.clientWantsMessage(i,e,t)&&this.isSubjectAllowedForClient(i,e)&&r.push(i);return r}getInterestedRequestClients(e,t,n){return this.getInterestedClients(e,t,n).filter(t=>{let n=this.clientSubscriptionState.get(t);return n?[...n].some(([t,n])=>n.priorities.length>0&&p(e,t)):!1})}forwardEventToClients(e,t,n){let r=u(t)??void 0,i=`payload`in t?t.payload:void 0,a=JSON.stringify(t),o=this.getInterestedClients(r,i,e);for(let e of o)n(e,a)}clientWantsMessage(e,t,n){return m(t,n,this.clientSubscriptions.get(e)??new Set,this.clientFilters.get(e)??new Map)}isReadyAndAuthenticated(e){return e.readyState===1?!this.socketAuthChecker||this.socketAuthChecker(e)?!0:(e.close(1008,`Authentication expired`),!1):!1}getRequestRemainingLifetime(e){if(e.deadline!==void 0)return Math.max(0,e.deadline-Date.now());let t=e.timeout??i;return t>0?t:void 0}clearRequestOrigin(e,t){t.expiration!==void 0&&clearTimeout(t.expiration),this.requestOrigins.delete(e)}isSubjectAllowedForClient(e,t){if(!this.subjectRestrictionResolver||t===void 0)return!0;let n=this.subjectRestrictionResolver(e);return n===null?!0:n.has(t)}buildAggregateUpdates(e){let t={},n={},r={};for(let i of e){let e=new Set,a=!1,o=`relayable`;for(let t of this.clientSubscriptionState.values()){let n=t.get(i);if(n){a=!0;for(let t of n.priorities)e.add(t);n.deliveryClass===`first-hop-only`&&(o=`first-hop-only`)}}a?(t[i]=[...e].sort((e,t)=>t-e),n[i]=o):r[i]=[]}let i=[];return Object.keys(t).length>0&&i.push({type:`subscribe`,subjects:t,deliveryClasses:n}),Object.keys(r).length>0&&i.push({type:`unsubscribe`,subjects:r}),i}};const w=new Map;function Se(e,t,n){if(e.trim().length===0)throw Error(`registerHmacIdentitySecret requires a non-empty identityId`);if(t.length===0)throw Error(`registerHmacIdentitySecret requires a non-empty secret`);let r=n.peerKind.trim();if(r.length===0)throw Error(`registerHmacIdentitySecret requires a non-empty peerKind`);let i={secret:t,peerKind:r,...n.claims===void 0?{}:{claims:n.claims},...n.allowedSubjects===void 0?{}:{allowedSubjects:new Set(n.allowedSubjects)}};w.set(e,i);let a=!0;return()=>{a&&(a=!1,w.get(e)===i&&w.delete(e))}}function Ce(e,t,n={}){if(t.length===0)throw Error(`rotateHmacIdentitySecret requires a non-empty secret`);let r=w.get(e);if(!r)throw Error(`Cannot rotate HMAC identity secret: no registration exists for '${e}'`);let i={secret:t,peerKind:r.peerKind,...n.claims===void 0?r.claims===void 0?{}:{claims:r.claims}:{claims:n.claims},...r.allowedSubjects===void 0?{}:{allowedSubjects:r.allowedSubjects}};w.set(e,i);let a=!0;return()=>{a&&(a=!1,w.get(e)===i&&w.delete(e))}}function we(e){return w.get(e)?.secret??null}function Te(e){let t=w.get(e);return t?{kind:t.peerKind,id:e,authenticated:!0,...t.claims===void 0?{}:{claims:t.claims}}:null}function T(e){return w.get(e)?.allowedSubjects??null}function Ee(){w.clear()}function De(e){return e.type===`request`||e.type===`event`||e.type===`broadcast`}function Oe(e){return t(e)&&Object.values(e).every(e=>Array.isArray(e)&&e.every(e=>typeof e==`number`&&Number.isFinite(e)))}function ke(e){return e.endsWith(`*`)}function Ae(e,t,n,r){let i={};for(let[a,o]of Object.entries(e))ke(a)?t.has(a)?i[a]=o:n&&console.debug(`[ServerTransport] Dropping wildcard subscription '${a}': not in allowedSubjects for peer '${r}'`):t.has(a)?i[a]=o:n&&console.debug(`[ServerTransport] Dropping subscription subject '${a}': not allowed for peer '${r}'`);return Object.keys(i).length>0?i:null}async function E(e,t,n){let r=await Promise.allSettled(Array.from(t).map(t=>t(e,n.receiveContext)));for(let e of r)if(e.status===`rejected`&&n.debug){let t=n.logContext?` ${n.logContext}`:``;console.error(`[ServerTransport] Handler error${t}:`,e.reason)}return r.every(e=>e.status===`fulfilled`)}async function D(e,t,n){let r=!0;for(let i of e)await E(i,t,n)||(r=!1);return r}function je(e,t,n){let{correlations:r,broadcastAggregator:i,debug:a}=t;if(e.type===`heartbeat`)return!0;if(e.type===`response`){let t=e;return typeof t.correlationId==`string`?(t.error?r.reject(t.correlationId,l(t.error)):r.resolve(t.correlationId,t.result),!0):(a&&console.warn(`[ServerTransport] Malformed response message: missing correlationId`),!0)}if(e.type===`broadcast-response`){let t=e;return typeof t.correlationId==`string`?(i.handleResponse(n,t),!0):(a&&console.warn(`[ServerTransport] Malformed broadcast-response: missing correlationId`),!0)}return!1}function Me(e){let t=e?.peer?.id;if(t===void 0)return null;let n=T(t);return n===null?null:{peerId:t,allowedSubjects:n}}function Ne(e,t,n,r){if(r===null||!De(e))return!1;let i=`${e.namespace}.${e.subject}`;return r.allowedSubjects.has(i)?!1:(e.type===`request`&&n.sendSafely(t,JSON.stringify({type:`response`,correlationId:e.correlationId,error:{message:`Subject '${i}' is not allowed for peer '${r.peerId}'`}})),n.debug&&console.warn(`[ServerTransport] Dropping ${e.type} to '${i}': not allowed for peer '${r.peerId}'`),!0)}function Pe(e,t,n){if(!Oe(e.subjects))return n&&console.warn(`[ServerTransport] Malformed ${e.type} message: missing subjects record`),null;if(t===null)return e.subjects;let r=Ae(e.subjects,t.allowedSubjects,n,t.peerId);return r===null&&n&&console.debug(`[ServerTransport] Dropping ${e.type} message: all subjects filtered for peer '${t.peerId}'`),r}async function Fe(e,t,n,r,i){if(e.type!==`subscribe`&&e.type!==`unsubscribe`)return!1;let a=e,o=Pe(a,i,n.debug);return o===null||await D(a.type===`subscribe`?n.registry.handleSubscribeMessage(t,{...a,subjects:o}):n.registry.handleUnsubscribeMessage(t,o),n.handlers,{debug:n.debug,receiveContext:r,logContext:`dispatching ${a.type}`})&&typeof a.ackId==`string`&&n.sendSafely(t,JSON.stringify({type:`subscription-ack`,ackId:a.ackId})),!0}async function Ie(e,t,n,r){if(e.type!==`broadcast`)return!1;let i=e;if(typeof i.correlationId!=`string`||typeof i.subject!=`string`)return n.debug&&console.warn(`[ServerTransport] Malformed broadcast message: missing correlationId or subject`),!0;let a=n.registry.getInterestedClients(i.subject,i.payload,t),o=n.normalizeBroadcastTimeout(i.timeout);return n.broadcastAggregator.startClientBroadcast(t,i,a,n.sendSafely,o),await E(e,n.handlers,{debug:n.debug,receiveContext:r}),!0}async function Le(e,t,n){if(je(e,n,t))return;let r=n.auth?.getReceiveContext?.(t),i=Me(r);if(!Ne(e,t,n,i)){if(e.type===`subscribe`||e.type===`unsubscribe`){await Fe(e,t,n,r,i);return}if(e.type===`broadcast`){await Ie(e,t,n,r);return}e.type===`event`&&n.registry.forwardEventToClients(t,e,n.sendSafely),e.type===`request`&&n.registry.trackRequestOrigin(t,e),await E(e,n.handlers,{debug:n.debug,receiveContext:r})}}function Re(e,t){let{auth:n,registry:r,debug:i}=t;return async a=>{let o;try{o=JSON.parse(a.toString())}catch(e){i&&console.error(`[ServerTransport] Failed to parse message:`,e);return}let s=o&&typeof o==`object`?o:void 0;if(!s||typeof s.type!=`string`){i&&console.error(`[ServerTransport] Invalid message structure:`,o);return}let c=o;try{if(n?.handleAuthMessage(c,e))return;if(n&&r.isAuthenticating(e)){i&&console.warn(`[ServerTransport] Ignoring message from unauthenticated client`);return}if(n?.isSocketAuthenticated?.(e)===!1){i&&console.warn(`[ServerTransport] Closing socket with expired authentication`),n.cleanupSocket(e),e.close(1008,`Authentication expired`);return}await Le(c,e,t)}catch(e){i&&console.error(`[ServerTransport] Failed to process message:`,e)}}}function ze(e){return typeof e!=`number`||!Number.isFinite(e)||e<=0?5e3:Math.min(e,6e4)}async function Be(e,t){let{registry:n,correlations:r,broadcastAggregator:i,handlers:a,auth:o,serverSubscriptions:c,sendSafely:l,debug:u}=t;o&&n.addAuthenticating(e);let d=Re(e,{registry:n,correlations:r,broadcastAggregator:i,handlers:a,auth:o,normalizeBroadcastTimeout:ze,sendSafely:l,debug:u}),f=e=>{d(e.data)},p=()=>{o?.cleanupSocket(e);let t=n.removeClient(e);e.removeEventListener(`message`,f),e.removeEventListener(`close`,p),e.removeEventListener(`error`,m),i.handleClientDisconnect(e),D(t,a,{debug:u,logContext:`dispatching disconnected client subscriptions`}),u&&console.info(`[ServerTransport] Client disconnected (${n.size} remaining)`)},m=e=>{u&&console.error(`[ServerTransport] Client socket error:`,e)};e.addEventListener(`message`,f),e.addEventListener(`close`,p),e.addEventListener(`error`,m);try{if(o&&(await o.authenticateServer(e,t=>{if(e.readyState!==1)throw Error(`Cannot send auth message: socket not ready (state: ${e.readyState})`);e.send(JSON.stringify(t))}),n.removeAuthenticating(e)),e.readyState!==1)return;if(n.addClient(e),c.size>0){let t=s(c);l(e,JSON.stringify(t))}l(e,JSON.stringify({type:`subscribe-sync-complete`})),u&&console.info(`[ServerTransport] Client connected (${n.size} total)`)}catch(t){u&&console.error(`[ServerTransport] Client authentication failed:`,t),e.close(1008,`Authentication failed`)}}async function Ve(e,t,n){let{registry:r,correlations:i}=n,s=`${e.namespace}.${e.subject}`,c=r.getRequestOrigin(e.correlationId),l=r.getInterestedRequestClients(s,e.payload,c);if(l.length===0)throw new a(s);for(let[n,r]of l.entries()){let a=`${e.correlationId}:attempt-${n+1}`,c={...e,correlationId:a};try{r.send(JSON.stringify(c))}catch{continue}try{return await i.track(a,t)}catch(e){if(f(e,s)||e instanceof o)continue;throw e}}throw new a(s)}var O=class{name;wss;auth;debug;handlers=new Set;registry;serverSubscriptions=new Map;broadcastAggregator;correlations=new r;connectionListener=null;constructor(e){let{websocket:t,name:n=`websocket`,auth:r,debug:i=!1}=e;this.wss=t,this.name=n,this.auth=r,this.debug=i,this.registry=new xe({debug:i,subjectRestrictionResolver:r?e=>{let t=(r.getReceiveContext?.(e))?.peer?.id;return t===void 0?null:T(t)}:void 0,socketAuthChecker:r?e=>r.isSocketAuthenticated?.(e)??!0:void 0}),this.broadcastAggregator=new be({debug:i})}sendToClientSafely(e,t){try{e.send(t)}catch(e){this.debug&&console.warn(`[ServerTransport] Failed to send message to client:`,e)}}async connect(){if(this.connectionListener!==null)throw Error(`ServerTransport.connect() called while already connected`);this.connectionListener=e=>{Be(e,{registry:this.registry,correlations:this.correlations,broadcastAggregator:this.broadcastAggregator,handlers:this.handlers,auth:this.auth,serverSubscriptions:this.serverSubscriptions,sendSafely:(e,t)=>this.sendToClientSafely(e,t),debug:this.debug})},this.wss.on(`connection`,this.connectionListener),this.debug&&console.info(`[ServerTransport] Listening for connections`)}async disconnect(){this.connectionListener&&=(this.wss.off(`connection`,this.connectionListener),null);let e=this.registry.getAllSockets();for(let t of e)t.close();await new Promise((e,t)=>{this.wss.close(n=>n?t(n):e())}),this.correlations.cleanup(),this.broadcastAggregator.cleanup(),this.auth?.cleanup(),this.handlers.clear(),this.serverSubscriptions.clear(),this.debug&&console.info(`[ServerTransport] Disconnected`)}async send(e,t){if(e.type===`response`){let t=this.registry.consumeResponseClient(e.correlationId);return t?(this.sendToClientSafely(t,JSON.stringify(e)),!0):!1}if(e.type===`broadcast`){let n=u(e)??void 0,r=`payload`in e?e.payload:void 0,i=this.registry.getInterestedClients(n,r);return this.broadcastAggregator.startServerBroadcast(e,i,(e,t)=>{this.sendToClientSafely(e,t)},t)}if(e.type===`request`)return Ve(e,t??i,{registry:this.registry,correlations:this.correlations});if(this.registry.size===0){if(this.debug){let t=u(e);console.debug(`[ServerTransport] No clients to receive ${e.type}${t?`: ${t}`:``}`)}return!1}let n=u(e)??void 0,r=`payload`in e?e.payload:void 0,a=JSON.stringify(e),o=this.registry.getInterestedClients(n,r);for(let e of o)this.sendToClientSafely(e,a);let s=o.length>0;if(!s&&(n&&this.debug&&console.warn(`[ServerTransport] No interested clients for subject: ${n}`),!n))throw Error(`No connected clients available to receive message`);return s}onReceive(e){return this.handlers.add(e),()=>{this.handlers.delete(e)}}cancelRequest(e,t){this.correlations.cancel(e,t),this.registry.cancelRequestOrigin(e)}onBroadcastResults(e,t,n){this.broadcastAggregator.handleNodeResults(e,t,n)}async subscribe(e,t,n=[],r){let i=this.serverSubscriptions.get(e),a=i?.filter,o=t??a,c=r??i?.deliveryClass??`relayable`;if(this.serverSubscriptions.set(e,{filter:o,priorities:n,deliveryClass:c}),this.registry.size>0){let t=s(new Map([[e,{filter:o,priorities:n,deliveryClass:c}]])),r=JSON.stringify(t);for(let e of this.registry.getReadyClients())this.sendToClientSafely(e,r)}}getConnectionCount(){return this.registry.getReadyClients().length}async unsubscribe(e){if(this.serverSubscriptions.delete(e),this.registry.size>0){let t=c({[e]:[]}),n=JSON.stringify(t);for(let e of this.registry.getReadyClients())this.sendToClientSafely(e,n)}}};function He(e,t){let n=new Event(`close`);return Object.defineProperties(n,{code:{value:e??1e3,enumerable:!0},reason:{value:t??``,enumerable:!0}}),n}function Ue(e){if(typeof e!=`object`||!e)throw TypeError(`WebSocket transport options must be an object`);let t=e;if(t.mode!==`client`&&t.mode!==`server`)throw TypeError(`WebSocket transport mode must be "client" or "server"`);if(t.mode===`client`){if(!We(t.websocket))throw TypeError(`WebSocket transport client mode requires a websocket with addEventListener/removeEventListener`);return}if(!Ge(t.websocket))throw TypeError(`WebSocket transport server mode requires a websocket with on/off listener methods`)}function We(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.send==`function`&&typeof t.close==`function`&&typeof t.addEventListener==`function`&&typeof t.removeEventListener==`function`}function Ge(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.on==`function`&&typeof t.off==`function`&&typeof t.close==`function`}var Ke=class{secret;algorithm;challengeTimeout;identityId;resolveSecret;resolvePeer;pendingChallenge;pendingResult;queuedChallengeNonce;queuedResult;clientAuthComplete=!1;serverPendingResponses=new Map;serverAuthenticatedSockets=new Set;serverAuthenticatedPeers=new Map;serverAuthenticatedSecrets=new Map;constructor(e){this.secret=e.secret,this.algorithm=e.algorithm??`sha256`,this.challengeTimeout=e.challengeTimeout??5e3,this.identityId=e.identityId,this.resolveSecret=e.resolveSecret,this.resolvePeer=e.resolvePeer}async authenticateServer(e,t){let n=crypto.getRandomValues(new Uint8Array(32)),r=Array.from(n).map(e=>e.toString(16).padStart(2,`0`)).join(``),i=await this.computeHmac(r);t({type:`auth-challenge`,nonce:r});let a=!1;try{let{signature:n,identityId:o}=await this.waitForAuthResponseWithIdentity(e),s;if(this.resolveSecret&&o!==void 0){let i=this.resolveSecret(o);if(i===null)throw this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!1,error:`Unknown identity`}),a=!0,Error(`HMAC authentication failed: Unknown identity '${o}'`);s=await this.computeHmacWithSecret(r,i),this.constantTimeEqual(n,s)&&(this.serverAuthenticatedPeers.set(e,o),this.serverAuthenticatedSecrets.set(e,i))}else s=i;if(!this.constantTimeEqual(n,s))throw this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!1,error:`Invalid signature`}),a=!0,Error(`HMAC authentication failed: Invalid signature`);this.serverAuthenticatedSockets.add(e),this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!0}),a=!0}catch(n){let r=this.serverPendingResponses.has(e);throw this.serverPendingResponses.delete(e),!a&&r&&this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!1,error:n instanceof Error?n.message:`Authentication failed`}),n}finally{this.serverPendingResponses.delete(e)}}async authenticateClient(e){this.clientAuthComplete=!1;let t=await this.waitForAuthChallenge();e({type:`auth-response`,signature:await this.computeHmac(t),...this.identityId!==void 0&&{identityId:this.identityId}});let n=await this.waitForAuthResult();if(!n.success)throw Error(`HMAC authentication failed: ${n.error??`Unknown error`}`);this.clientAuthComplete=!0}handleAuthMessage(e,t){if(typeof e!=`object`||!e||!(`type`in e)||typeof e.type!=`string`)return!1;let n=e;if(n.type===`auth-challenge`)return typeof n.nonce!=`string`||this.clientAuthComplete||(this.pendingChallenge?(clearTimeout(this.pendingChallenge.timeoutHandle),this.pendingChallenge.resolve(n.nonce),this.pendingChallenge=void 0):this.queuedChallengeNonce=n.nonce),!0;if(n.type===`auth-result`){if(typeof n.success!=`boolean`||this.clientAuthComplete)return!0;let e={success:n.success,error:n.error};return this.pendingResult?(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.resolve(e),this.pendingResult=void 0):this.queuedResult=e,!0}if(n.type===`auth-response`){if(t){let e=this.serverPendingResponses.get(t);e&&(clearTimeout(e.timeoutHandle),e.resolve({signature:n.signature,identityId:n.identityId}))}return!0}return!1}async waitForAuthChallenge(){if(this.queuedChallengeNonce!==void 0){let e=this.queuedChallengeNonce;return this.queuedChallengeNonce=void 0,e}return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingChallenge=void 0,t(Error(`Authentication challenge timeout`))},this.challengeTimeout);this.pendingChallenge={resolve:e,reject:t,timeoutHandle:n}})}async waitForAuthResponseWithIdentity(e){return new Promise((t,n)=>{let r={resolve:t,reject:n,timeoutHandle:setTimeout(()=>{n(Error(`Authentication response timeout`))},this.challengeTimeout)};this.serverPendingResponses.set(e,r)})}async waitForAuthResult(){if(this.queuedResult!==void 0){let e=this.queuedResult;return this.queuedResult=void 0,e}return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingResult=void 0,t(Error(`Authentication result timeout`))},this.challengeTimeout);this.pendingResult={resolve:e,reject:t,timeoutHandle:n}})}async computeHmac(e){return this.computeHmacWithSecret(e,this.secret)}async computeHmacWithSecret(e,t){let n=new TextEncoder,r=n.encode(t),i=this.algorithm.replace(/^sha/,`SHA-`),a=await crypto.subtle.importKey(`raw`,r,{name:`HMAC`,hash:i},!1,[`sign`]),o=await crypto.subtle.sign(`HMAC`,a,n.encode(e));return Array.from(new Uint8Array(o)).map(e=>e.toString(16).padStart(2,`0`)).join(``)}getReceiveContext(e){if(!e)return;let t=this.serverAuthenticatedPeers.get(e);if(t===void 0)return;let n=this.resolvePeer?.(t);if(n!=null)return{transportName:``,peer:{...n,id:n.id??t,authenticated:!0}}}isSocketAuthenticated(e){if(!this.serverAuthenticatedSockets.has(e))return!1;if(!this.resolveSecret)return!0;let t=this.serverAuthenticatedPeers.get(e);if(t===void 0)return!0;let n=this.resolveSecret(t);if(n===null)return this.cleanupSocket(e),!1;let r=this.serverAuthenticatedSecrets.get(e);return r!==void 0&&n!==r?(this.cleanupSocket(e),!1):!0}constantTimeEqual(e,t){if(e.length!==t.length)return!1;let n=new Uint8Array(e.length/2),r=new Uint8Array(t.length/2);for(let i=0;i<n.length;i++)n[i]=parseInt(e.slice(i*2,i*2+2),16),r[i]=parseInt(t.slice(i*2,i*2+2),16);let i=0;for(let e=0;e<n.length;e++)i|=n[e]^r[e];return i===0}sendAuthResultBestEffort(e,t){try{e(t)}catch{}}cleanupSocket(e){let t=this.serverPendingResponses.get(e);t&&(clearTimeout(t.timeoutHandle),this.serverPendingResponses.delete(e),t.reject(Error(`Socket disconnected during HMAC authentication`))),this.serverAuthenticatedPeers.delete(e),this.serverAuthenticatedSecrets.delete(e),this.serverAuthenticatedSockets.delete(e)}cleanup(){this.pendingChallenge&&=(clearTimeout(this.pendingChallenge.timeoutHandle),void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),void 0),this.queuedChallengeNonce=void 0,this.queuedResult=void 0,this.clientAuthComplete=!1;for(let e of this.serverPendingResponses.values())clearTimeout(e.timeoutHandle);this.serverPendingResponses.clear(),this.serverAuthenticatedPeers.clear(),this.serverAuthenticatedSecrets.clear(),this.serverAuthenticatedSockets.clear()}};function k(e){let t=Array.from(e,e=>String.fromCharCode(e)).join(``);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``)}function A(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=(4-t.length%4)%4;t+=`=`.repeat(n);let r=atob(t),i=new Uint8Array(r.length);for(let e=0;e<r.length;e++)i[e]=r.charCodeAt(e);return i}function j(e){return new TextEncoder().encode(e)}function M(e){return new TextDecoder().decode(e)}async function N(e){let t=await crypto.subtle.exportKey(`spki`,e);return k(new Uint8Array(t))}async function P(e){let t=await crypto.subtle.exportKey(`raw`,e);return k(new Uint8Array(t))}async function F(e,t,n=[]){let r=A(e);return crypto.subtle.importKey(`spki`,r,t,!0,n)}async function I(e,t,n=[]){let r=A(e);return crypto.subtle.importKey(`raw`,r,t,!0,n)}async function L(e){let t=await crypto.subtle.exportKey(`pkcs8`,e),n=k(new Uint8Array(t)).replace(/-/g,`+`).replace(/_/g,`/`),r=(4-n.length%4)%4;return n+=`=`.repeat(r),`-----BEGIN PRIVATE KEY-----\n${n.match(/.{1,64}/g)?.join(`
-`)??n}\n-----END PRIVATE KEY-----`}async function R(e,t,n){let r=A(e.replace(/-----BEGIN PRIVATE KEY-----/,``).replace(/-----END PRIVATE KEY-----/,``).replace(/\s/g,``).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``));return crypto.subtle.importKey(`pkcs8`,r,t,!0,n)}const z={name:`ECDH`,namedCurve:`P-256`};async function B(e=!0){return crypto.subtle.generateKey(z,e,[`deriveKey`,`deriveBits`])}async function V(e){return N(e)}async function qe(e){return P(e)}async function Je(e){return I(e,z)}async function H(e,t=[]){return F(e,z,t)}async function Ye(e){return L(e)}async function Xe(e){return R(e,z,[`deriveKey`,`deriveBits`])}async function U(e,t){return crypto.subtle.deriveBits({name:`ECDH`,public:t},e,256)}async function W(e,t){let n=crypto.getRandomValues(new Uint8Array(12)),r=await crypto.subtle.encrypt({name:`AES-GCM`,iv:n},e,t);return{ciphertext:new Uint8Array(r),nonce:n}}async function G(e,t,n){let r=await crypto.subtle.decrypt({name:`AES-GCM`,iv:n},e,t);return new Uint8Array(r)}async function Ze(e){return crypto.subtle.importKey(`raw`,e,{name:`AES-GCM`},!1,[`encrypt`,`decrypt`])}async function Qe(e,t,n){let r=await crypto.subtle.importKey(`raw`,e,{name:`HKDF`},!1,[`deriveKey`]);return crypto.subtle.deriveKey({name:`HKDF`,hash:`SHA-256`,salt:t,info:j(n)},r,{name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`])}const K={name:`ECDSA`,namedCurve:`P-256`};async function $e(e=!0){return crypto.subtle.generateKey(K,e,[`sign`,`verify`])}async function et(e,t){let n=await crypto.subtle.sign({name:`ECDSA`,hash:{name:`SHA-256`}},e,t);return new Uint8Array(n)}async function tt(e,t,n){return crypto.subtle.verify({name:`ECDSA`,hash:{name:`SHA-256`}},e,t,n)}async function nt(e){return N(e)}async function rt(e){return F(e,K,[`verify`])}async function it(e){return P(e)}async function at(e){return I(e,K,[`verify`])}async function ot(e){return L(e)}async function st(e){return R(e,K,[`sign`])}var ct=e({decodeText:()=>M,decrypt:()=>G,deriveSessionKey:()=>Qe,deriveSharedSecret:()=>U,encodeText:()=>j,encrypt:()=>W,exportPrivateKeyPEM:()=>Ye,exportPublicKey:()=>V,exportPublicKeyRaw:()=>qe,exportSigningPrivateKeyPEM:()=>ot,exportSigningPublicKey:()=>nt,exportSigningPublicKeyRaw:()=>it,fromBase64Url:()=>A,generateECDHKeyPair:()=>B,generateSigningKeyPair:()=>$e,importAESKey:()=>Ze,importPrivateKeyPEM:()=>Xe,importPublicKey:()=>H,importPublicKeyRaw:()=>Je,importSigningPrivateKeyPEM:()=>st,importSigningPublicKey:()=>rt,importSigningPublicKeyRaw:()=>at,sign:()=>et,toBase64Url:()=>k,verify:()=>tt});function lt(e){let t=e.match(/.{1,2}/g);return new Uint8Array(t?.map(e=>parseInt(e,16))??[])}function q(e){return Array.from(e).map(e=>e.toString(16).padStart(2,`0`)).join(``)}async function J(e,t){let n=await B(!0),r=await V(n.publicKey);return{ephemeralKeyPair:n,ephemeralPublicKey:r,signature:q(await et(e,j(r+t)))}}function ut(){return q(crypto.getRandomValues(new Uint8Array(16)))}async function Y(e,t,n,r){let i=j(t+r);return tt(e,lt(n),i)}async function X(e,t,n,r){return Qe(await U(e,await H(t)),lt(n),r)}async function dt(e,t,n,r){if(e===t)throw Error(`deriveRelaySaltHex: identityId must differ from peerId`);let[i,a]=e<t?[e,t]:[t,e],[o,s]=e<t?[n,r]:[r,n],c=j(`${i}${a}${o}${s}`),l=new Uint8Array(c).buffer,u=await crypto.subtle.digest(`SHA-256`,l);return q(new Uint8Array(u))}var ft=class{signingKeyPair;identityId;peerId;getPeerSigningKey;timeout;pendingKeyExchange;pendingResult;clientSession;clientEphemeralKeyPair;serverPendingKeyExchange=new Map;serverSessions=new Map;serverEphemeralKeyPairs=new Map;constructor(e){this.signingKeyPair=e.signingKeyPair,this.identityId=e.identityId,this.peerId=e.peerId,this.getPeerSigningKey=e.getPeerSigningKey,this.timeout=e.timeout??1e4}async authenticateClient(e){if(!this.peerId)throw Error(`E2E authentication failed: peerId is required for client authentication`);let{ephemeralKeyPair:t,ephemeralPublicKey:n,signature:r}=await J(this.signingKeyPair.privateKey,this.identityId);this.clientEphemeralKeyPair=t;try{let i=this.waitForKeyExchangeResponse(),a=this.waitForAuthResult();e({type:`e2e-key-exchange`,deviceId:this.identityId,ephemeralPublicKey:n,signature:r});let o=await i,s=await this.getPeerSigningKey(this.peerId);if(!s)throw Error(`E2E authentication failed: Unknown server`);if(!await Y(s,o.ephemeralPublicKey,o.signature,this.peerId))throw Error(`E2E authentication failed: Invalid server signature`);let c=await X(t.privateKey,o.ephemeralPublicKey,o.salt,`makaio-e2e-session-v1`);this.clientSession={sessionKey:c,peerId:this.peerId};let l=await a;if(!l.success)throw Error(`E2E authentication failed: ${l.error??`Unknown error`}`)}catch(e){throw this.pendingKeyExchange&&=(clearTimeout(this.pendingKeyExchange.timeoutHandle),void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),void 0),this.clientSession=void 0,this.clientEphemeralKeyPair=void 0,e}}async authenticateServer(e,t){try{let n=await this.waitForClientKeyExchange(e),r=await this.getPeerSigningKey(n.deviceId);if(!r)throw t({type:`e2e-auth-result`,success:!1,error:`Unknown device`}),Error(`E2E authentication failed: Unknown device ${n.deviceId}`);if(!await Y(r,n.ephemeralPublicKey,n.signature,n.deviceId))throw t({type:`e2e-auth-result`,success:!1,error:`Invalid signature`}),Error(`E2E authentication failed: Invalid client signature`);let{ephemeralKeyPair:i,ephemeralPublicKey:a,signature:o}=await J(this.signingKeyPair.privateKey,this.identityId),s=ut();this.serverEphemeralKeyPairs.set(e,i),t({type:`e2e-key-exchange-response`,ephemeralPublicKey:a,signature:o,salt:s});let c=await X(i.privateKey,n.ephemeralPublicKey,s,`makaio-e2e-session-v1`);this.serverSessions.set(e,{sessionKey:c,peerId:n.deviceId}),t({type:`e2e-auth-result`,success:!0})}catch(n){throw this.serverPendingKeyExchange.delete(e),this.serverEphemeralKeyPairs.delete(e),t({type:`e2e-auth-result`,success:!1,error:n instanceof Error?n.message:`Authentication failed`}),n}finally{this.serverPendingKeyExchange.delete(e)}}handleAuthMessage(e,t){if(typeof e!=`object`||!e||!(`type`in e)||typeof e.type!=`string`)return!1;let n=e;if(n.type===`e2e-key-exchange-response`)return this.pendingKeyExchange&&=(clearTimeout(this.pendingKeyExchange.timeoutHandle),this.pendingKeyExchange.resolve({ephemeralPublicKey:n.ephemeralPublicKey,signature:n.signature,salt:n.salt}),void 0),!0;if(n.type===`e2e-auth-result`)return!n.success&&this.pendingKeyExchange&&(clearTimeout(this.pendingKeyExchange.timeoutHandle),this.pendingKeyExchange.reject(Error(`E2E authentication failed: ${n.error??`Unknown error`}`)),this.pendingKeyExchange=void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.resolve({success:n.success,error:n.error}),void 0),!0;if(n.type===`e2e-key-exchange`&&t){let e=this.serverPendingKeyExchange.get(t);return e&&(clearTimeout(e.timeoutHandle),e.resolve({deviceId:n.deviceId,ephemeralPublicKey:n.ephemeralPublicKey,signature:n.signature})),!0}return!1}async waitForKeyExchangeResponse(){return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingKeyExchange=void 0,t(Error(`E2E key exchange timeout`))},this.timeout);this.pendingKeyExchange={resolve:e,reject:t,timeoutHandle:n}})}async waitForAuthResult(){return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingResult=void 0,t(Error(`E2E authentication result timeout`))},this.timeout);this.pendingResult={resolve:e,reject:t,timeoutHandle:n}})}async waitForClientKeyExchange(e){return new Promise((t,n)=>{let r={resolve:t,reject:n,timeoutHandle:setTimeout(()=>{this.serverPendingKeyExchange.delete(e),n(Error(`E2E key exchange timeout`))},this.timeout)};this.serverPendingKeyExchange.set(e,r)})}getSessionKey(e){return e?this.serverSessions.get(e)?.sessionKey??null:this.clientSession?.sessionKey??null}getPeerId(e){return e?this.serverSessions.get(e)?.peerId??null:this.clientSession?.peerId??null}getReceiveContext(e){let t=this.getPeerId(e);if(t!==null)return{transportName:``,peer:{kind:`e2e`,id:t,authenticated:!0,encrypted:!0}}}cleanupSocket(e){let t=this.serverPendingKeyExchange.get(e);t&&(clearTimeout(t.timeoutHandle),this.serverPendingKeyExchange.delete(e)),this.serverSessions.delete(e),this.serverEphemeralKeyPairs.delete(e)}cleanup(){this.pendingKeyExchange&&=(clearTimeout(this.pendingKeyExchange.timeoutHandle),void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),void 0),this.clientSession=void 0,this.clientEphemeralKeyPair=void 0;for(let e of this.serverPendingKeyExchange.values())clearTimeout(e.timeoutHandle);this.serverPendingKeyExchange.clear(),this.serverSessions.clear(),this.serverEphemeralKeyPairs.clear()}};const Z=`E2E relay auth session aborted by reconnect`;var pt=class{signingKeyPair;identityId;getPeerSigningKey;timeout;mode;blocking;pendingPeer;sessionKey;peerId;localEphemeral;localExchangeMessage;sentLocalExchange=!1;earlyPeer;sendAuthMessage;authGeneration=0;processingExchange=!1;constructor(e){this.signingKeyPair=e.signingKeyPair,this.identityId=e.identityId,this.getPeerSigningKey=e.getPeerSigningKey,this.timeout=e.timeout??1e4,this.mode=e.mode??`initiator`,this.blocking=e.blocking??!0}async authenticateClient(e){let t=this.sendAuthMessage===void 0?this.earlyPeer:void 0;this.cleanup();let n=this.authGeneration;if(this.earlyPeer=t,this.sendAuthMessage=e,this.mode===`initiator`){if(await this.ensureLocalExchangeMessage(),n!==this.authGeneration)throw Error(Z);this.sendLocalExchange()}if(!this.blocking){if(this.earlyPeer){let e=this.earlyPeer;this.earlyPeer=void 0,this.dispatchPeerExchange(e,n)}return}let r=await this.waitForPeerExchange();if(await this.processPeerExchange(r,n),n!==this.authGeneration||!this.sessionKey)throw Error(Z)}async authenticateServer(e,t){throw Error(`E2ERelayAuth does not support server authentication`)}handleAuthMessage(e){let t=e;return!t||t.type!==`e2e-relay-key-exchange`?!1:t.identityId===this.identityId?!0:this.pendingPeer?(this.pendingPeer.resolve(t),this.pendingPeer=void 0,!0):(this.earlyPeer=t,!this.blocking&&this.sendAuthMessage&&!this.sessionKey&&!this.processingExchange&&this.dispatchPeerExchange(t,this.authGeneration),!0)}cleanupSocket(e){}cleanup(){this.authGeneration++,this.pendingPeer&&=(this.pendingPeer.reject(Error(Z)),void 0),this.earlyPeer&&=void 0,this.sessionKey=void 0,this.peerId=void 0,this.localEphemeral=void 0,this.localExchangeMessage=void 0,this.sentLocalExchange=!1,this.processingExchange=!1,this.sendAuthMessage=void 0}dispatchPeerExchange(e,t){this.processingExchange=!0,this.processPeerExchange(e,t).catch(e=>{e instanceof Error&&e.message===Z||console.error(`[E2ERelayAuth] Peer exchange failed:`,e)}).finally(()=>{t===this.authGeneration&&(this.processingExchange=!1,this.retryQueuedPeerExchange(t))})}getSessionKey(){return this.sessionKey??null}getPeerId(){return this.peerId??null}getReceiveContext(){let e=this.getPeerId();if(e!==null)return{transportName:``,peer:{kind:`e2e`,id:e,authenticated:!0,encrypted:!0}}}async waitForPeerExchange(){if(this.earlyPeer){let e=this.earlyPeer;return this.earlyPeer=void 0,e}return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingPeer=void 0,t(Error(`E2E relay key exchange timeout`))},this.timeout),r=()=>{clearTimeout(n),this.pendingPeer=void 0};this.pendingPeer={resolve:t=>{r(),e(t)},reject:e=>{r(),t(e)},timeoutHandle:n}})}async ensureLocalExchangeMessage(){if(this.localExchangeMessage&&this.localEphemeral)return this.localExchangeMessage;let{ephemeralKeyPair:e,ephemeralPublicKey:t,signature:n}=await J(this.signingKeyPair.privateKey,this.identityId);return this.localEphemeral=e,this.localExchangeMessage={type:`e2e-relay-key-exchange`,identityId:this.identityId,ephemeralPublicKey:t,signature:n},this.localExchangeMessage}sendLocalExchange(e=!1){!this.sendAuthMessage||!this.localExchangeMessage||!e&&this.sentLocalExchange||(this.sendAuthMessage(this.localExchangeMessage),this.sentLocalExchange=!0)}retryQueuedPeerExchange(e){if(this.blocking||!this.sendAuthMessage||this.sessionKey||this.processingExchange||e!==this.authGeneration)return;let t=this.earlyPeer;t&&(this.earlyPeer=void 0,this.dispatchPeerExchange(t,e))}async processPeerExchange(e,t){if(!this.sendAuthMessage){this.earlyPeer=e;return}let n=await this.ensureLocalExchangeMessage();if(t!==this.authGeneration)return;let r=await this.getPeerSigningKey(e.identityId);if(!r)throw Error(`E2E relay authentication failed: Unknown peer ${e.identityId}`);if(!await Y(r,e.ephemeralPublicKey,e.signature,e.identityId))throw Error(`E2E relay authentication failed: Invalid peer signature`);let i=await dt(this.identityId,e.identityId,n.ephemeralPublicKey,e.ephemeralPublicKey);if(!this.localEphemeral)throw Error(`E2E relay authentication failed: Local ephemeral key missing`);let a=await X(this.localEphemeral.privateKey,e.ephemeralPublicKey,i,`makaio-e2e-relay-v1`);t===this.authGeneration&&(this.sessionKey=a,this.peerId=e.identityId,this.mode===`initiator`?this.sendLocalExchange(!0):this.sendLocalExchange())}},mt=class{hmac;e2e;socketStrategy=new Map;pendingServerAuth=new Map;hmacCancelled=new Map;constructor(e){this.hmac=e.hmac,this.e2e=e.e2e}setE2EAuth(e){this.e2e=e}async authenticateClient(e){let t=this.hmac??this.e2e;if(!t)throw Error(`DispatchingAuth: no auth strategy configured`);return t.authenticateClient(e)}async authenticateServer(e,t){let n=this.resolveSingleStrategy();if(n)return n.authenticateServer(e,t);if(!this.hmac||!this.e2e)throw Error(`DispatchingAuth: no auth strategy configured`);let r={cancelled:!1};this.hmacCancelled.set(e,r);let i=this.hmac.authenticateServer(e,e=>{r.cancelled||t(e)});return new Promise((n,a)=>{this.pendingServerAuth.set(e,{resolve:n,reject:a,send:t}),i.then(n).catch(e=>{r.cancelled||a(e instanceof Error?e:Error(String(e)))})})}handleAuthMessage(e,t){if(!t)return(this.hmac??this.e2e)?.handleAuthMessage(e)??!1;let n=this.socketStrategy.get(t);if(n)return n.handleAuthMessage(e,t);let r=this.resolveStrategy(e),i=this.pendingServerAuth.get(t);return r?(this.socketStrategy.set(t,r),this.pendingServerAuth.delete(t),r===this.hmac?this.hmacCancelled.delete(t):(this.cancelHmac(t),i&&r.authenticateServer(t,i.send).then(i.resolve).catch(e=>{i.reject(e instanceof Error?e:Error(String(e)))})),r.handleAuthMessage(e,t)):(this.cancelHmac(t),i&&(this.pendingServerAuth.delete(t),i.reject(Error(`DispatchingAuth: unrecognised auth message type "${this.peekType(e)}" — no matching strategy`))),!1)}cleanupSocket(e){let t=this.socketStrategy.get(e);t&&(t.cleanupSocket(e),this.socketStrategy.delete(e)),this.cancelHmac(e);let n=this.pendingServerAuth.get(e);n&&(this.pendingServerAuth.delete(e),n.reject(Error(`DispatchingAuth: socket disconnected before auth type was determined`)))}cleanup(){this.hmac?.cleanup(),this.e2e?.cleanup(),this.socketStrategy.clear();for(let e of this.pendingServerAuth.values())e.reject(Error(`DispatchingAuth: cleanup called before authentication completed`));this.pendingServerAuth.clear(),this.hmacCancelled.clear()}peekType(e){if(typeof e!=`object`||!e||!(`type`in e))return;let{type:t}=e;return typeof t==`string`?t:void 0}resolveSingleStrategy(){if(this.hmac&&!this.e2e)return this.hmac;if(this.e2e&&!this.hmac)return this.e2e}resolveStrategy(e){let t=this.peekType(e);if(t){if(t===`e2e-key-exchange`&&this.e2e)return this.e2e;if(t===`auth-response`&&this.hmac)return this.hmac}}cancelHmac(e){let t=this.hmacCancelled.get(e);t&&(t.cancelled=!0,this.hmacCancelled.delete(e),this.hmac?.cleanupSocket(e))}};function ht(e){return`payload`in e}async function gt(e,t,n){if(e.type!==`response`||e.result===void 0||e.error!==void 0)return;let{ciphertext:r,nonce:i}=await W(n,j(JSON.stringify(e.result)));t.result=k(r),t.e2e={nonce:k(i),v:1}}async function _t(e,t,n){if(e.type!==`broadcast-response`||e.results===void 0||e.error!==void 0)return;let{ciphertext:r,nonce:i}=await W(n,j(JSON.stringify(e.results)));t.results=k(r),t.e2e={nonce:k(i),v:1}}async function vt(e,t,n){if(!ht(e)||e.payload===void 0)return;let{ciphertext:r,nonce:i}=await W(n,j(JSON.stringify(e.payload)));t.payload=k(r),t.e2e={nonce:k(i),v:1}}async function yt(e,t,n){if(e.type!==`response`&&e.type!==`broadcast-response`||e.error===void 0)return;let{ciphertext:r,nonce:i}=await W(n,j(JSON.stringify(e.error)));t.error=k(r),t.e2e={nonce:k(i),v:1}}async function bt(e,t,n,r){if(!ht(e)||typeof e.payload!=`string`)return;let i=M(await G(n,A(e.payload),r));t.payload=JSON.parse(i)}async function xt(e,t,n,r){if(e.type!==`response`||typeof e.result!=`string`)return;let i=M(await G(n,A(e.result),r));t.result=JSON.parse(i)}async function St(e,t,n,r){if(e.type!==`broadcast-response`||typeof e.results!=`string`)return;let i=M(await G(n,A(e.results),r));t.results=JSON.parse(i)}async function Ct(e,t,n,r){if(e.type!==`response`&&e.type!==`broadcast-response`||typeof e.error!=`string`)return;let i=M(await G(n,A(e.error),r));t.error=JSON.parse(i)}async function wt(e,t){let n={...e};return await vt(e,n,t),await gt(e,n,t),await _t(e,n,t),await yt(e,n,t),n}async function Tt(e,t){if(!e.e2e)return e;let n={...e};delete n.e2e;let r=A(e.e2e.nonce);return await bt(e,n,t,r),await xt(e,n,t,r),await St(e,n,t,r),await Ct(e,n,t,r),n}function Et(e){return e.type===`subscription-ack`&&typeof e.ackId==`string`}function Dt(e){let{e2eAuth:t,websocket:n,...r}=e,i=new S({...r,url:`<pre-connected>`,createWebSocket:()=>n,auth:t,autoReconnect:!1,heartbeat:r.heartbeat??!1,messageTransform:async e=>{let n=t.getSessionKey();if(!n||Et(e))return e;let r=e;if(!r.e2e)throw Error(`Received plaintext message on E2E-encrypted channel — possible injection`);return Tt(r,n)}});async function a(e,n){let r=t.getSessionKey();if(!r)throw Error(`E2E session key not available - authentication may have failed`);let a=await wt(e,r);return i.send(a,n)}return{name:i.name,connect:i.connect.bind(i),disconnect:i.disconnect.bind(i),send:a,cancelRequest:i.cancelRequest.bind(i),onReceive:i.onReceive.bind(i),subscribe:i.subscribe.bind(i),unsubscribe:i.unsubscribe.bind(i),getSubscriptions:i.getSubscriptions.bind(i)}}function Ot(e){return Dt(e)}function kt(e){if(!e||typeof e!=`object`)return!1;let t=e;if(t.type!==`e2e-relay-envelope`||typeof t.payload!=`string`)return!1;let n=t.e2e;return!!n&&typeof n.nonce==`string`&&typeof n.v==`number`}async function At(e,t){let{ciphertext:n,nonce:r}=await W(t,j(JSON.stringify(e)));return{type:`e2e-relay-envelope`,payload:k(n),e2e:{nonce:k(r),v:1}}}async function jt(e,t){let n=A(e.e2e.nonce),r=M(await G(t,A(e.payload),n));return JSON.parse(r)}function Mt(e){let t=()=>{if(!e.isFrozen())throw Error(`RelayControlRegistry must be frozen before processing relay control messages`)};function n(t){return typeof t.namespace!=`string`||typeof t.subject!=`string`||!e.isControlEvent(t.namespace,t.subject)||typeof t.messageId!=`string`?!1:t.payload!==void 0}function r(t){return typeof t.namespace!=`string`||typeof t.subject!=`string`||!e.isControlRequest(t.namespace,t.subject)||typeof t.messageId!=`string`||typeof t.correlationId!=`string`?!1:t.payload!==void 0}function i(e){if(t(),!e||typeof e!=`object`)return!1;let i=e;return i.type===`event`?n(i):i.type===`request`?r(i):!1}function a(e){if(t(),!e||typeof e!=`object`)return!1;let n=e;return n.type!==`relay-control`||n.v!==1||!n.payload||typeof n.payload!=`object`?!1:i(n.payload)}function o(e){if(t(),!i(e))throw Error(`Invalid relay control message`);return{type:`relay-control`,v:1,payload:e}}return{createRelayControlEnvelope:o,isRelayControlEnvelopeMessage:a,isRelayControlBusMessage:i}}function Q(e){let t=Date.now()-3e5;for(let[n,r]of e)r>=t||e.delete(n);for(;e.size>2048;){let t=e.keys().next().value;if(!t)break;e.delete(t)}}const Nt=e=>{if(!e||typeof e!=`object`)return!1;let t=e;return t.type===`response`&&typeof t.correlationId==`string`},Pt=e=>e.type===`subscribe`||e.type===`unsubscribe`,Ft=e=>{if(!e||typeof e!=`object`)return!1;let t=e;return t.type===`subscription-ack`&&typeof t.ackId==`string`};function $(e,t,n,r){if(!r.isFrozen())throw Error(`E2ERelay transport requires a frozen relay control registry`);let{createRelayControlEnvelope:i,isRelayControlEnvelopeMessage:a,isRelayControlBusMessage:o}=Mt(r),s=e=>{n.delete(e),n.set(e,Date.now()),Q(n)};return{encode:async t=>{if(o(t))return t.type===`request`&&s(t.correlationId),JSON.stringify(i(t));if(Q(n),t.type===`response`&&n.has(t.correlationId))return n.delete(t.correlationId),JSON.stringify(t);let r=e.getSessionKey();if(!r&&Pt(t)||!r&&Ft(t))return JSON.stringify(t);if(!r)throw Error(`E2E relay session not established`);let a=await At(t,r);return JSON.stringify(a)},decode:async r=>{let i=e.getSessionKey();if(a(r)){let e=r.payload;return t&&console.info(`[E2ERelayTransport] Decoded relay control envelope:`,e.type,e.namespace,e.subject),e.type===`request`&&s(e.correlationId),e}if(Q(n),Nt(r)&&n.has(r.correlationId))return n.delete(r.correlationId),r;if(!i&&Ft(r))return r;if(!i)throw Error(`E2E relay session not established`);if(!kt(r))throw Error(`Received plaintext message on relay E2E channel — possible injection`);return jt(r,i)}}}function It(e,t,n=!1){let r=new Map;return{codec:$(e,n,r,t),reset:()=>r.clear()}}function Lt(e){let{e2eAuth:t,registry:n,websocket:r,...i}=e,a=e.debug??!1,o=new Map,s=$(t,a,o,n);a&&console.info(`[E2ERelayTransport] Creating inner transport...`);let c=new S({...i,url:`<pre-connected>`,createWebSocket:()=>r,auth:t,codec:s,autoReconnect:!1,heartbeat:i.heartbeat??!1});return a&&console.info(`[E2ERelayTransport] Inner transport created`),{name:c.name,connect:async()=>{if(!n.isFrozen())throw Error(`E2ERelayClientTransport: registry must be frozen before connect()`);o.clear();try{await c.connect()}catch(e){throw o.clear(),e}},disconnect:async()=>{o.clear();try{await c.disconnect()}finally{o.clear()}},send:c.send.bind(c),cancelRequest:c.cancelRequest.bind(c),onReceive:(...e)=>(a&&console.info(`[E2ERelayTransport] onReceive called, delegating to inner transport`),c.onReceive(...e)),subscribe:c.subscribe.bind(c),unsubscribe:c.unsubscribe.bind(c),getSubscriptions:c.getSubscriptions.bind(c),isReady:()=>!!t.getSessionKey()&&c.isReady()}}function Rt(){let e=!1,t=new Map,n=new Map,r=()=>{if(e)throw Error(`RelayControlRegistry is frozen and cannot be modified`)};return{registerEventSubjects(e,n){r();let i=t.get(e)??new Set;for(let e of n)i.add(e);t.set(e,i)},registerRequestNamespace(e,t){if(r(),t.length===0)throw Error(`RelayControlRegistry request namespace "${e}" requires at least one subject`);let i=n.get(e)??new Set;for(let e of t)i.add(e);n.set(e,i)},freeze(){e=!0},isFrozen(){return e},isControlEvent(e,n){return t.get(e)?.has(n)??!1},isControlRequest(e,t){return n.get(e)?.has(t)??!1}}}function zt(e){if(Ue(e),e.mode===`client`){if(e.connectionOptions!==void 0)throw Error(`createWebSocketTransport(client) does not support connectionOptions when wrapping a pre-created WebSocket. Use WebSocketClientTransport for reconnect or dial-time socket options.`);let t=e.websocket;return new S({url:`<pre-connected>`,createWebSocket:()=>t,auth:e.auth,debug:e.debug,autoReconnect:!1,heartbeat:!1})}else return new O({websocket:e.websocket,auth:e.auth,debug:e.debug})}export{mt as DispatchingAuth,ft as E2EAuth,pt as E2ERelayAuth,Ke as HmacAuth,O as ServerTransport,S as WebSocketClientTransport,Ee as clearHmacIdentitySecretsForTesting,Ot as createE2EClientTransport,Lt as createE2ERelayClientTransport,It as createE2ERelayCodec,Mt as createRelayControlHelpers,Rt as createRelayControlRegistry,He as createWebSocketCloseEvent,zt as createWebSocketTransport,ct as crypto,g as extractSocketErrorMessage,Se as registerHmacIdentitySecret,T as resolveHmacIdentityAllowedSubjects,Te as resolveHmacIdentityPeer,we as resolveHmacIdentitySecret,Ce as rotateHmacIdentitySecret};
+import{r as e}from"../../chunk-DTipWd-i.mjs";import{isRecord as t}from"@makaio/framework/utils";import{ConnectionLostError as n,CorrelationTracker as r,DEFAULT_REQUEST_TIMEOUT_MS as i,NoHandlerError as a,TimeoutError as o,buildSubscribeMessage as s,buildUnsubscribeMessage as c,deserializeTransportError as l,getSubjectFromBusMessage as u,handleCorrelationResponse as d,isNoHandlerErrorForSubject as f,matchesSubscription as p,shouldReceiveMessage as m,trackMessageCorrelation as h}from"@makaio/framework/bus";const g={baseMs:1e3,maxMs:1e4};function ee(e,t,n){let r=Math.max(t,100),i=Math.max(n,r);return Math.min(r*2**e,i)}function te(e,t){return new Promise(n=>{if(t.aborted){n();return}let r=()=>{clearTimeout(i),t.removeEventListener(`abort`,r),n()},i=setTimeout(()=>{t.removeEventListener(`abort`,r),n()},e);t.addEventListener(`abort`,r)})}const _={intervalMs:3e4,timeoutMs:1e4},ne={encode:async e=>JSON.stringify(e),decode:async e=>e};function re(e){return e===!1?!1:{baseMs:e?.baseMs??g.baseMs,maxMs:e?.maxMs??g.maxMs}}function ie(e){if(e===!1)return!1;let t=e?.intervalMs??_.intervalMs,n=e?.timeoutMs??_.timeoutMs;if(!Number.isFinite(t)||t<=0)throw RangeError(`heartbeat.intervalMs must be a finite number > 0 (got ${String(t)})`);if(!Number.isFinite(n)||n<=0)throw RangeError(`heartbeat.timeoutMs must be a finite number > 0 (got ${String(n)})`);return{intervalMs:t,timeoutMs:n}}var v=class extends Error{code;constructor(e,t,n){super(t,n),this.code=e,this.name=`WebSocketConnectionError`}};function y(e){let t=typeof e==`object`&&!!e&&`code`in e&&e.code===1008;return new v(t?`WS_POLICY_REJECTED`:`WS_CONNECTION_UNAVAILABLE`,t?`WebSocket connection rejected by peer policy`:`WebSocket closed before connection completed`)}function b(e,t=`unknown error`){return`message`in e?String(e.message):t}async function x(e,t,n){let r=await t.encode(e);n.send(r)}function ae(e,t,n){return n?.aborted?Promise.reject(n.reason):e.readyState===1?Promise.resolve():e.readyState>=2?Promise.reject(y()):new Promise((r,i)=>{let a=()=>{u!==void 0&&clearTimeout(u),e.removeEventListener(`open`,o),e.removeEventListener(`error`,s),e.removeEventListener(`close`,c),n?.removeEventListener(`abort`,l)},o=()=>{a(),r()},s=e=>{a(),i(new v(`WS_CONNECTION_UNAVAILABLE`,`WebSocket connection failed — ${b(e)}`,{cause:e}))},c=e=>{a(),i(y(e))},l=()=>{a(),i(n?.reason)},u=t===void 0?void 0:setTimeout(()=>{a(),i(new v(`WS_CONNECTION_TIMEOUT`,`WebSocket open timed out after ${t}ms`))},t);e.addEventListener(`open`,o),e.addEventListener(`error`,s),e.addEventListener(`close`,c),n?.addEventListener(`abort`,l)})}function S(e){if(e.readyState!==0&&e.readyState!==1)return;let t=()=>{},n=()=>{e.removeEventListener(`error`,t),e.removeEventListener(`close`,n)};e.addEventListener(`error`,t),e.addEventListener(`close`,n);try{e.close()}catch(e){throw n(),e}}async function oe(e,t,n){let r=await Promise.allSettled(Array.from(t).map(t=>t(e,n.receiveContext)));for(let e of r)e.status===`rejected`&&n.debug&&console.error(`[WebSocketClientTransport:${n.name}] Handler error:`,e.reason);return r.every(e=>e.status===`fulfilled`)}function se(e,t){return{...t?.getReceiveContext?.(),transportName:e}}async function ce(e,t){let{name:n,debug:r,auth:i,codec:a,messageTransform:o,correlations:s}=t,c=JSON.parse(e.toString());if(typeof c!=`object`||!c||typeof c.type!=`string`)return r&&console.error(`[WebSocketClientTransport:${n}] Invalid message structure:`,c),null;let l=c;if(i?.handleAuthMessage(l)||l.type===`heartbeat`)return null;let u=await a.decode(l);return!t.isCurrentSession()||o&&(u=await o(u),!t.isCurrentSession())||u.type===`heartbeat`?null:u.type===`subscribe-sync-complete`?(t.onSyncComplete(),null):u.type===`subscription-ack`?(typeof u.ackId==`string`&&t.onSubscriptionAck(u.ackId),null):d(u,s)?null:u}async function le(e,t){let{name:n,debug:r,auth:i,handlers:a}=t,o=null;try{o=await ce(e,t)}catch(e){r&&console.error(`[WebSocketClientTransport:${n}] Failed to parse message:`,e);return}if(o===null||!t.isCurrentSession())return;let s=se(n,i),c=o;oe(c,a,{debug:r,name:n,receiveContext:s}).then(async e=>{e&&(c.type===`subscribe`||c.type===`unsubscribe`)&&typeof c.ackId==`string`&&await t.sendSubscriptionAck(c.ackId)}).catch(e=>{r&&console.error(`[WebSocketClientTransport:${n}] Handler dispatch error:`,e)})}function ue(e){let t=e;return typeof t.ping==`function`&&typeof t.terminate==`function`&&typeof t.on==`function`&&typeof t.off==`function`}function de(e){e.unref?.()}function fe(e,t,n){if(!ue(e))return()=>{};let r=!1,i=Date.now(),a=null,o=null,s=()=>{if(r)return;let e=Date.now()-i,n=Math.max(0,t.intervalMs-e);a=setTimeout(l,n),de(a)},c=()=>{o=null,f(),n.debug&&console.warn(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Heartbeat deadline expired (no message/pong within ${t.timeoutMs}ms) — terminating socket`),e.terminate()},l=()=>{if(a=null,!r&&o===null){if(Date.now()-i<t.intervalMs){s();return}e.readyState===1&&(e.ping(),o=setTimeout(c,t.timeoutMs),de(o))}},u=()=>{i=Date.now(),o!==null&&(clearTimeout(o),o=null),a===null&&s()},d=()=>{f()},f=()=>{r||(r=!0,a!==null&&(clearTimeout(a),a=null),o!==null&&(clearTimeout(o),o=null),e.removeEventListener(`message`,u),e.removeEventListener(`close`,d),e.off(`pong`,u))};return e.addEventListener(`message`,u),e.on(`pong`,u),e.addEventListener(`close`,d),s(),f}async function pe(e,t){await Promise.allSettled(e.inFlightMessages),e.getSocket()===t&&e.correlations.rejectAll(e.getSessionFailure()??new n(e.name))}function me(e,t){let n=n=>{if(t.getSocket()!==e)return;let r=le(n.data,{isCurrentSession:()=>t.getSocket()===e,name:t.name,debug:t.debug,auth:t.auth,codec:t.codec,messageTransform:t.messageTransform,correlations:t.correlations,handlers:t.handlers,onSyncComplete:()=>{t.resolveReady()},onSubscriptionAck:e=>{t.resolveSubscriptionAck(e)},sendSubscriptionAck:async n=>{t.getSocket()!==e||e.readyState!==1||await x({type:`subscription-ack`,ackId:n},t.codec,e)}}).finally(()=>{t.inFlightMessages.delete(r)});t.inFlightMessages.add(r)};t.setMessageListener(n),e.addEventListener(`message`,n)}function C(e,t){if(t.getSocket()!==e)return;let n=t.getMessageListener();n!==null&&(e.removeEventListener(`message`,n),t.setMessageListener(null));let r=t.getCloseListener();r!==null&&(e.removeEventListener(`close`,r),t.setCloseListener(null))}function he(e,t,n){let r=[n];if(t.getSocket()===e){C(e,t),t.setSocket(null,n instanceof Error?n:Error(`WebSocket connection failed`,{cause:n})),t.setAuthComplete(!1);try{t.auth?.cleanup()}catch(e){r.push(e)}}try{S(e)}catch(e){r.push(e)}return r.length===1?n:AggregateError(r,`WebSocket connection failed and cleanup was incomplete`,{cause:n})}async function ge(e,t){t.throwIfAborted();let n=new AbortController,r=()=>n.abort(new v(`WS_CONNECTION_UNAVAILABLE`,`WebSocket connection cancelled`));t.addEventListener(`abort`,r);let i=setTimeout(()=>n.abort(new v(`WS_CONNECTION_TIMEOUT`,`WebSocket connection timed out after ${e.connectTimeoutMs}ms`)),e.connectTimeoutMs),a=null,o=()=>{},s=()=>{a?.removeEventListener(`close`,c),a?.removeEventListener(`error`,l)},c=e=>n.abort(y(e)),l=e=>n.abort(new v(`WS_CONNECTION_UNAVAILABLE`,`WebSocket connection failed — ${b(e)}`,{cause:e})),u=t=>{if(o(),a===null)return t;let n=a;return s(),a=null,he(n,e,t)},d=()=>{},f=new Promise((e,t)=>{d=()=>{t(u(n.signal.reason))},n.signal.addEventListener(`abort`,d)});try{let t=_e(e,n.signal,()=>{o=e.resetReadyPromise()},t=>{a=t,e.setSocket(t),e.setAuthComplete(!1),t.addEventListener(`close`,c),t.addEventListener(`error`,l),me(t,e)});await Promise.race([t,f])}catch(e){throw u(e)}finally{clearTimeout(i),t.removeEventListener(`abort`,r),n.signal.removeEventListener(`abort`,d),s()}}async function _e(e,t,r,i){e.inFlightMessages.size>0&&await Promise.allSettled(e.inFlightMessages),t.throwIfAborted();let a=e.getSocket();e.correlations.rejectAll(e.getSessionFailure()??new n(e.name)),e.inFlightMessages.clear(),e.resolveReady(),e.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: reconnecting before subscription ack`)),r(),t.throwIfAborted(),a!==null&&C(a,e);let o=await e.wsFactory(e.url);t.aborted&&(S(o),t.throwIfAborted()),i(o),await ve(o,e,t)}async function ve(e,t,n){if(await ae(e,void 0,n),n.throwIfAborted(),t.auth&&(await t.auth.authenticateClient(t=>{if(n.throwIfAborted(),e.readyState!==1)throw y();e.send(JSON.stringify(t))}),n.throwIfAborted()),t.setAuthComplete(!0),t.localSubscriptions.size>0){let r=await t.codec.encode(s(t.localSubscriptions));n.throwIfAborted(),e.send(r)}t.heartbeat!==!1&&fe(e,t.heartbeat,t),t.debug&&console.info(`[WebSocketClientTransport:${t.name}] Connected to ${t.url}`),t.notifyConnected()}function w(e,t){return new Promise(n=>{if(e.readyState===3||t.aborted){n();return}let r=()=>{t.removeEventListener(`abort`,i),n()},i=()=>{e.removeEventListener(`close`,r),n()};e.addEventListener(`close`,r),t.addEventListener(`abort`,i)})}async function ye(e,t,r,i,a){a(!0);try{for(;!e.aborted;){let a=r.getSocket(),o=a!==null;if(a!==null&&a.readyState!==3&&await w(a,e),e.aborted)break;if(o&&a!==null){if(await pe(r,a),e.aborted)break;r.debug&&console.info(`[WebSocketClientTransport:${r.name}] ${new Date().toISOString()} Connection lost, starting reconnect loop (maxMs=${t.maxMs})`),r.notifyDisconnected()}let s=0;for(;!e.aborted;){let a=ee(s,t.baseMs,t.maxMs);r.debug&&console.info(`[WebSocketClientTransport:${r.name}] ${new Date().toISOString()} Reconnecting in ${a}ms (attempt ${s+1})`);let o=new AbortController;if(i(o),await te(a,AbortSignal.any([e,o.signal])),i(null),e.aborted)break;try{if(await ge(r,e),e.aborted)break;s=0;let t=r.getSocket();if(t!==null){let i=async()=>{await Promise.allSettled(r.inFlightMessages),!(e.aborted||r.getSocket()!==t)&&(r.correlations.rejectAll(r.getSessionFailure()??new n(r.name)),r.auth?.cleanup(),r.setAuthComplete(!1),r.debug&&console.info(`[WebSocketClientTransport:${r.name}] ${new Date().toISOString()} Connection closed`),r.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: disconnected before subscription ack`)))};r.setCloseListener(i),t.addEventListener(`close`,i),await w(t,e)}break}catch(e){if(r.debug){let t=e instanceof Error?e.message:String(e);console.warn(`[WebSocketClientTransport:${r.name}] ${new Date().toISOString()} Connect attempt ${s+1} failed: ${t}`)}s++}}}}finally{a(!1)}}function be(e,t,n){let r=async()=>{t.getSocket()===e&&(C(e,t),t.auth?.cleanup(),t.setAuthComplete(!1),n(),t.resolveReady(),t.notifyDisconnected(),await pe(t,e),t.getSocket()===e&&(t.setSocket(null),t.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: disconnected before subscription ack`))))};t.setCloseListener(r),e.addEventListener(`close`,r)}async function xe(e,t,n,r,i){let a=i.localSubscriptions.get(e),o=a?.filter,c=t??o,l=r??a?.deliveryClass??`relayable`;if(i.localSubscriptions.set(e,{filter:c,priorities:n,deliveryClass:l}),i.socket!==null&&i.socket.readyState===1){let t=i.beginSubscriptionAck?.(),r=s(new Map([[e,{filter:c,priorities:n,deliveryClass:l}]]),t?.ackId);try{await x(r,i.codec,i.socket),await t?.promise}catch(e){throw t?.reject(e),e}}i.debug&&console.info(`[WebSocketClientTransport:${i.name}] Subscribed to ${e}${c?` with filter`:``}`)}async function Se(e,t){let n=t.localSubscriptions.get(e);if(t.localSubscriptions.delete(e),t.socket!==null&&t.socket.readyState===1){let r=t.beginSubscriptionAck?.(),i=c({[e]:n?.priorities??[]},r?.ackId);try{await x(i,t.codec,t.socket),await r?.promise}catch(e){throw r?.reject(e),e}}t.debug&&console.info(`[WebSocketClientTransport:${t.name}] Unsubscribed from ${e}`)}var Ce=class{name;termination=new AbortController;ownedSocket;onClose;constructor(e,t){this.name=t,this.ownedSocket=e,this.onClose=e=>{let r=y(e);this.end(r.code===`WS_POLICY_REJECTED`?r:new n(t))},e.addEventListener(`close`,this.onClose)}get socket(){return this.ownedSocket}get signal(){return this.termination.signal}get failure(){return this.signal.reason instanceof Error?this.signal.reason:void 0}end(e){this.ownedSocket?.removeEventListener(`close`,this.onClose),this.termination.abort(e)}release(e=new n(this.name)){this.end(e),this.ownedSocket=null}writable(e,t){if(t?.throwIfAborted(),this.signal.throwIfAborted(),e!==this||this.ownedSocket===null)throw new n(this.name);let r=this.ownedSocket;if(r.readyState===2||r.readyState===3){if(t===void 0)throw Error(`WebSocket is closing; uncorrelated message was not sent`);return T(new Promise(()=>{}),AbortSignal.any([t,this.signal]))}if(r.readyState!==1)throw new n(this.name);return r}};async function T(e,t){let n=()=>{},r=new Promise((e,r)=>{n=()=>r(t.reason),t.addEventListener(`abort`,n,{once:!0}),t.aborted&&n()});try{return await Promise.race([e,r])}finally{t.removeEventListener(`abort`,n)}}async function we(e,t,r){let i=e.session;if(i===null)throw new n(e.name);if(i.signal.throwIfAborted(),t.type!==`request`&&t.type!==`broadcast`)return await E(e,i,t),h(t,e.correlations,r);let a=new AbortController,o=h(t,e.correlations,r).then(e=>(a.abort(),e),e=>{throw a.abort(e),e});return E(e,i,t,a.signal).catch(n=>{if(a.signal.aborted)return;let r=n instanceof Error?n:Error(`WebSocket send failed`,{cause:n});e.correlations.reject(t.correlationId,r)}),o}async function E(e,t,n,r){let i=t.writable(e.currentSession(),r);i instanceof Promise&&await i;let a=r===void 0?t.signal:AbortSignal.any([r,t.signal]);a.throwIfAborted();let o=await T(e.codec.encode(n),a),s=t.writable(e.currentSession(),r);s instanceof Promise?await s:s.send(o)}var D=class{name;url;auth;codec;messageTransform;autoReconnectConfig;heartbeatConfig;connectTimeoutMs;wsFactory;debug;onConnectedCallback;onDisconnectedCallback;session=null;authComplete=!1;correlations=new r;handlers=new Set;localSubscriptions=new Map;pendingSubscriptionAcks=new Map;subscriptionAckSeq=0;messageListener=null;closeListener=null;reconnectAbort=null;inFlightMessages=new Set;backoffWakeAbort=null;reconnectLoopRunning=!1;readyResolve=null;ready;onNewReadySession=void 0;onConnected=void 0;onDisconnected=void 0;get socket(){return this.session?.socket??null}constructor(e){this.url=e.url,this.name=e.name??`ws-client`,this.auth=e.auth,this.codec=e.codec??ne,this.messageTransform=e.messageTransform,this.debug=e.debug??!1,this.autoReconnectConfig=re(e.autoReconnect),this.heartbeatConfig=ie(e.heartbeat),this.connectTimeoutMs=e.connectTimeoutMs??3e4,this.wsFactory=e.createWebSocket??this.defaultWsFactory,this.onConnectedCallback=e.onConnected,this.onDisconnectedCallback=e.onDisconnected,this.ready=new Promise(e=>{this.readyResolve=e})}async connect(){if(this.reconnectAbort!==null)throw Error(`WebSocketClientTransport: already connected`);let e=new AbortController;this.reconnectAbort=e;try{await ge(this.connectionDeps(),e.signal)}catch(t){throw this.reconnectAbort===e&&(this.reconnectAbort=null),t}if(e.signal.aborted||this.reconnectAbort!==e)throw new v(`WS_CONNECTION_UNAVAILABLE`,`WebSocket connection cancelled`);this.autoReconnectConfig===!1?this.socket!==null&&this.wireNoReconnectClose(this.socket):this.startReconnectLoop(e.signal)}async disconnect(){let e=this.reconnectAbort,t=this.socket;this.reconnectAbort=null,e?.abort(new v(`WS_CONNECTION_UNAVAILABLE`,`WebSocket connection cancelled`));let r=t===null||this.socket===t;if(this.reconnectLoopRunning=!1,this.backoffWakeAbort=null,this.readyResolve?.(),this.readyResolve=null,this.socket!==null){C(this.socket,this.connectionDeps());let e=this.socket;this.session?.release(),this.authComplete=!1,S(e)}this.correlations.rejectAll(this.session?.failure??new n(this.name)),this.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: disconnected before subscription ack`)),r&&this.auth?.cleanup(),this.handlers.clear(),this.debug&&console.info(`[WebSocketClientTransport:${this.name}] Disconnected`)}async send(e,t){return we({session:this.session,currentSession:()=>this.session,name:this.name,codec:this.codec,correlations:this.correlations},e,t??i)}onReceive(e){return this.handlers.add(e),()=>{this.handlers.delete(e)}}async subscribe(e,t,n=[],r){await xe(e,t,n,r,this.subscriptionDeps())}async unsubscribe(e){await Se(e,this.subscriptionDeps())}getSubscriptions(){return new Set(this.localSubscriptions.keys())}cancelRequest(e,t){this.correlations.cancel(e,t)}isReady(){return this.socket!==null&&this.socket.readyState===1&&this.authComplete}async reconnect(){if(!this.isReady()){if(this.backoffWakeAbort!==null){this.backoffWakeAbort.abort(),this.backoffWakeAbort=null;return}if(this.autoReconnectConfig!==!1){if(this.reconnectLoopRunning){let e=this.socket;e!==null&&e.readyState===0&&e.close();return}return}try{this.reconnectAbort===null&&await this.connect()}catch{}}}startReconnectLoop(e){return ye(e,this.autoReconnectConfig,this.connectionDeps(),t=>{e.aborted||(this.backoffWakeAbort=t)},t=>{this.reconnectAbort?.signal===e&&(this.reconnectLoopRunning=t)})}subscriptionDeps(){return{name:this.name,debug:this.debug,codec:this.codec,socket:this.socket,localSubscriptions:this.localSubscriptions,beginSubscriptionAck:()=>this.beginSubscriptionAck()}}beginSubscriptionAck(){let e=`${this.name}:sub:${++this.subscriptionAckSeq}`,t,n,r=new Promise((e,r)=>{t=e,n=r});r.catch(()=>void 0);let i=t=>{this.pendingSubscriptionAcks.has(e)&&(this.pendingSubscriptionAcks.delete(e),t())};return this.pendingSubscriptionAcks.set(e,{resolve:()=>i(t),reject:e=>i(()=>n(e))}),{ackId:e,promise:r,reject:t=>this.rejectSubscriptionAck(e,t)}}resolveSubscriptionAck(e){this.pendingSubscriptionAcks.get(e)?.resolve()}rejectSubscriptionAck(e,t){this.pendingSubscriptionAcks.get(e)?.reject(t)}rejectPendingSubscriptionAcks(e){for(let t of this.pendingSubscriptionAcks.keys())this.rejectSubscriptionAck(t,e)}connectionDeps(){return{name:this.name,debug:this.debug,auth:this.auth,codec:this.codec,messageTransform:this.messageTransform,correlations:this.correlations,handlers:this.handlers,localSubscriptions:this.localSubscriptions,wsFactory:this.wsFactory,url:this.url,connectTimeoutMs:this.connectTimeoutMs,heartbeat:this.heartbeatConfig,getSocket:()=>this.socket,setSocket:(e,t)=>{this.session?.release(t),e!==null&&(this.session=new Ce(e,this.name))},getSessionFailure:()=>this.session?.failure,setAuthComplete:e=>{this.authComplete=e},getMessageListener:()=>this.messageListener,setMessageListener:e=>{this.messageListener=e},getCloseListener:()=>this.closeListener,setCloseListener:e=>{this.closeListener=e},resolveReady:()=>{this.readyResolve?.(),this.readyResolve=null},resetReadyPromise:()=>{let e;this.ready=new Promise(t=>{this.readyResolve=t,e=t});let t=()=>{e(),this.readyResolve===e&&(this.readyResolve=null)};try{this.onNewReadySession?.(this.ready)}catch(e){throw t(),e}return t},resolveSubscriptionAck:e=>{this.resolveSubscriptionAck(e)},rejectPendingSubscriptionAcks:e=>{this.rejectPendingSubscriptionAcks(e)},notifyConnected:()=>{let e=this.socket;this.onConnectedCallback?.(),e!==null&&this.socket===e&&this.isReady()&&this.onConnected?.()},notifyDisconnected:()=>{this.onDisconnectedCallback?.(),this.onDisconnected?.()},inFlightMessages:this.inFlightMessages}}defaultWsFactory=async e=>new(await(import(`ws`))).WebSocket(e);wireNoReconnectClose(e){be(e,this.connectionDeps(),()=>{this.reconnectAbort=null})}};function O(e){e.timer!==void 0&&clearTimeout(e.timer)}var Te=class{pendingBroadcasts=new Map;timeout;debug;constructor(e={}){this.timeout=e.timeout??5e3,this.debug=e.debug??!1}startClientBroadcast(e,t,n,r,i){let a=t.correlationId,o=i??this.timeout,s={kind:`client`,sender:e,results:[],pendingClients:new Set(n),nodeResultsReceived:!1,timer:o===0?void 0:setTimeout(()=>{this.debug&&console.warn(`[BroadcastAggregator] Broadcast ${a} timed out`),this.finalizeBroadcast(a)},o)};this.pendingBroadcasts.set(a,s);let c=JSON.stringify(t);for(let e of n)r(e,c);this.debug&&console.info(`[BroadcastAggregator] Broadcast ${a} forwarded to ${n.length} clients`)}startServerBroadcast(e,t,n,r){let i=e.correlationId,a=r??this.timeout;return t.length===0?(this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${i} - no target clients`),Promise.resolve([])):new Promise(r=>{let o={kind:`server`,results:[],pendingClients:new Set(t),timer:a===0?void 0:setTimeout(()=>{this.debug&&console.warn(`[BroadcastAggregator] Server broadcast ${i} timed out`),this.finalizeServerBroadcast(i)},a),resolve:r};this.pendingBroadcasts.set(i,o);let s=JSON.stringify(e);for(let e of t)n(e,s);this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${i} sent to ${t.length} clients`)})}handleResponse(e,t){let n=this.pendingBroadcasts.get(t.correlationId);return n?(t.results&&n.results.push(...t.results),n.pendingClients.delete(e),this.debug&&console.info(`[BroadcastAggregator] Broadcast ${t.correlationId} got response, ${n.pendingClients.size} pending`),this.checkBroadcastComplete(t.correlationId,n),!0):!1}handleNodeResults(e,t,n){let r=this.pendingBroadcasts.get(e);return!r||r.kind!==`client`?!1:(r.results.push(...t),r.nodeResultsReceived=!0,r.nodeError=n,this.debug&&console.info(`[BroadcastAggregator] Broadcast ${e} node results aggregated${n?` (with error)`:``}`),this.checkBroadcastComplete(e,r),!0)}handleClientDisconnect(e){for(let[t,n]of this.pendingBroadcasts)n.kind===`client`&&n.sender===e?(O(n),this.pendingBroadcasts.delete(t)):n.pendingClients.has(e)&&(n.pendingClients.delete(e),this.checkBroadcastComplete(t,n))}cleanup(){for(let e of this.pendingBroadcasts.values())O(e),e.kind===`server`&&e.resolve(e.results);this.pendingBroadcasts.clear()}checkBroadcastComplete(e,t){if(!(t.pendingClients.size>0))if(t.kind===`client`){if(!t.nodeResultsReceived)return;this.finalizeBroadcast(e)}else this.finalizeServerBroadcast(e)}finalizeBroadcast(e){let t=this.pendingBroadcasts.get(e);if(!t||t.kind!==`client`)return;O(t),this.pendingBroadcasts.delete(e);let n=t.nodeError?{type:`broadcast-response`,correlationId:e,error:t.nodeError}:{type:`broadcast-response`,correlationId:e,results:t.results};t.sender.readyState===1&&t.sender.send(JSON.stringify(n)),this.debug&&console.info(`[BroadcastAggregator] Broadcast ${e} finalized with ${t.results.length} results`)}finalizeServerBroadcast(e){let t=this.pendingBroadcasts.get(e);!t||t.kind!==`server`||(O(t),this.pendingBroadcasts.delete(e),t.resolve(t.results),this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${e} finalized with ${t.results.length} results`))}},Ee=class{clients=new Set;authenticatingClients=new Set;clientSubscriptions=new Map;clientSubscriptionState=new Map;clientFilters=new Map;requestOrigins=new Map;debug;subjectRestrictionResolver;socketAuthChecker;constructor(e={}){this.debug=e.debug??!1,this.subjectRestrictionResolver=e.subjectRestrictionResolver,this.socketAuthChecker=e.socketAuthChecker}addAuthenticating(e){this.authenticatingClients.add(e)}removeAuthenticating(e){this.authenticatingClients.delete(e)}isAuthenticating(e){return this.authenticatingClients.has(e)}addClient(e){this.clients.add(e)}removeClient(e){let t=new Set(this.clientSubscriptionState.get(e)?.keys()??[]);this.clients.delete(e),this.authenticatingClients.delete(e),this.clientSubscriptions.delete(e),this.clientSubscriptionState.delete(e),this.clientFilters.delete(e);for(let[t,n]of this.requestOrigins)n.socket===e&&this.clearRequestOrigin(t,n);return this.debug&&console.info(`[ClientRegistry] Client removed (${this.clients.size} remaining)`),this.buildAggregateUpdates(t)}get size(){return this.clients.size}getAllSockets(){return new Set([...this.clients,...this.authenticatingClients])}handleSubscribeMessage(e,t){let n=this.clientSubscriptions.get(e);n||(n=new Set,this.clientSubscriptions.set(e,n));let r=this.clientFilters.get(e),i=this.clientSubscriptionState.get(e);i||(i=new Map,this.clientSubscriptionState.set(e,i));for(let[a,o]of Object.entries(t.subjects)){n.add(a),i.set(a,{priorities:o,deliveryClass:t.deliveryClasses?.[a]===`relayable`?`relayable`:`first-hop-only`});let s=t.filters?.[a];s===void 0?r?.delete(a):(r||(r=new Map,this.clientFilters.set(e,r)),r.set(a,s))}if(this.debug){let e=Object.keys(t.subjects).length,n=t.filters?Object.keys(t.filters).length:0;console.info(`[ClientRegistry] Client subscribed to ${e} subjects, ${n} filters`)}return this.buildAggregateUpdates(new Set(Object.keys(t.subjects)))}handleUnsubscribeMessage(e,t){let n=this.clientSubscriptions.get(e),r=this.clientFilters.get(e);for(let i of Object.keys(t))n?.delete(i),this.clientSubscriptionState.get(e)?.delete(i),r?.delete(i);return this.debug&&console.info(`[ClientRegistry] Client unsubscribed from ${Object.keys(t).length} subjects`),this.buildAggregateUpdates(new Set(Object.keys(t)))}getReadyClients(){let e=[];for(let t of this.clients)t.readyState===1&&e.push(t);return e}trackRequestOrigin(e,t){let{correlationId:n}=t;if(this.requestOrigins.has(n))return;let r=this.getRequestRemainingLifetime(t);if(r===0)return;let i={socket:e,expiration:void 0};r!==void 0&&(i.expiration=setTimeout(()=>{this.requestOrigins.get(n)===i&&this.requestOrigins.delete(n)},r)),this.requestOrigins.set(n,i)}getRequestOrigin(e){return this.requestOrigins.get(e)?.socket}consumeResponseClient(e){let t=this.requestOrigins.get(e);if(t)return this.clearRequestOrigin(e,t),this.isReadyAndAuthenticated(t.socket)?t.socket:void 0}cancelRequestOrigin(e){let t=this.requestOrigins.get(e);t&&this.clearRequestOrigin(e,t)}getInterestedClients(e,t,n){let r=[];for(let i of this.clients)i===n||!this.isReadyAndAuthenticated(i)||this.clientWantsMessage(i,e,t)&&this.isSubjectAllowedForClient(i,e)&&r.push(i);return r}getInterestedRequestClients(e,t,n){return this.getInterestedClients(e,t,n).filter(t=>{let n=this.clientSubscriptionState.get(t);return n?[...n].some(([t,n])=>n.priorities.length>0&&p(e,t)):!1})}forwardEventToClients(e,t,n){let r=u(t)??void 0,i=`payload`in t?t.payload:void 0,a=JSON.stringify(t),o=this.getInterestedClients(r,i,e);for(let e of o)n(e,a)}clientWantsMessage(e,t,n){return m(t,n,this.clientSubscriptions.get(e)??new Set,this.clientFilters.get(e)??new Map)}isReadyAndAuthenticated(e){return e.readyState===1?!this.socketAuthChecker||this.socketAuthChecker(e)?!0:(e.close(1008,`Authentication expired`),!1):!1}getRequestRemainingLifetime(e){if(e.deadline!==void 0)return Math.max(0,e.deadline-Date.now());let t=e.timeout??i;return t>0?t:void 0}clearRequestOrigin(e,t){t.expiration!==void 0&&clearTimeout(t.expiration),this.requestOrigins.delete(e)}isSubjectAllowedForClient(e,t){if(!this.subjectRestrictionResolver||t===void 0)return!0;let n=this.subjectRestrictionResolver(e);return n===null?!0:n.has(t)}buildAggregateUpdates(e){let t={},n={},r={};for(let i of e){let e=new Set,a=!1,o=`relayable`;for(let t of this.clientSubscriptionState.values()){let n=t.get(i);if(n){a=!0;for(let t of n.priorities)e.add(t);n.deliveryClass===`first-hop-only`&&(o=`first-hop-only`)}}a?(t[i]=[...e].sort((e,t)=>t-e),n[i]=o):r[i]=[]}let i=[];return Object.keys(t).length>0&&i.push({type:`subscribe`,subjects:t,deliveryClasses:n}),Object.keys(r).length>0&&i.push({type:`unsubscribe`,subjects:r}),i}};const k=new Map;function De(e,t,n){if(e.trim().length===0)throw Error(`registerHmacIdentitySecret requires a non-empty identityId`);if(t.length===0)throw Error(`registerHmacIdentitySecret requires a non-empty secret`);let r=n.peerKind.trim();if(r.length===0)throw Error(`registerHmacIdentitySecret requires a non-empty peerKind`);let i={secret:t,peerKind:r,...n.claims===void 0?{}:{claims:n.claims},...n.allowedSubjects===void 0?{}:{allowedSubjects:new Set(n.allowedSubjects)}};k.set(e,i);let a=!0;return()=>{a&&(a=!1,k.get(e)===i&&k.delete(e))}}function Oe(e,t,n={}){if(t.length===0)throw Error(`rotateHmacIdentitySecret requires a non-empty secret`);let r=k.get(e);if(!r)throw Error(`Cannot rotate HMAC identity secret: no registration exists for '${e}'`);let i={secret:t,peerKind:r.peerKind,...n.claims===void 0?r.claims===void 0?{}:{claims:r.claims}:{claims:n.claims},...r.allowedSubjects===void 0?{}:{allowedSubjects:r.allowedSubjects}};k.set(e,i);let a=!0;return()=>{a&&(a=!1,k.get(e)===i&&k.delete(e))}}function ke(e){return k.get(e)?.secret??null}function Ae(e){let t=k.get(e);return t?{kind:t.peerKind,id:e,authenticated:!0,...t.claims===void 0?{}:{claims:t.claims}}:null}function A(e){return k.get(e)?.allowedSubjects??null}function je(){k.clear()}function Me(e){return e.type===`request`||e.type===`event`||e.type===`broadcast`}function Ne(e){return t(e)&&Object.values(e).every(e=>Array.isArray(e)&&e.every(e=>typeof e==`number`&&Number.isFinite(e)))}function Pe(e){return e.endsWith(`*`)}function Fe(e,t,n,r){let i={};for(let[a,o]of Object.entries(e))Pe(a)?t.has(a)?i[a]=o:n&&console.debug(`[ServerTransport] Dropping wildcard subscription '${a}': not in allowedSubjects for peer '${r}'`):t.has(a)?i[a]=o:n&&console.debug(`[ServerTransport] Dropping subscription subject '${a}': not allowed for peer '${r}'`);return Object.keys(i).length>0?i:null}async function j(e,t,n){let r=await Promise.allSettled(Array.from(t).map(t=>t(e,n.receiveContext)));for(let e of r)if(e.status===`rejected`&&n.debug){let t=n.logContext?` ${n.logContext}`:``;console.error(`[ServerTransport] Handler error${t}:`,e.reason)}return r.every(e=>e.status===`fulfilled`)}async function M(e,t,n){let r=!0;for(let i of e)await j(i,t,n)||(r=!1);return r}function Ie(e,t,n){let{correlations:r,broadcastAggregator:i,debug:a}=t;if(e.type===`heartbeat`)return!0;if(e.type===`response`){let t=e;return typeof t.correlationId==`string`?(t.error?r.reject(t.correlationId,l(t.error)):r.resolve(t.correlationId,t.result),!0):(a&&console.warn(`[ServerTransport] Malformed response message: missing correlationId`),!0)}if(e.type===`broadcast-response`){let t=e;return typeof t.correlationId==`string`?(i.handleResponse(n,t),!0):(a&&console.warn(`[ServerTransport] Malformed broadcast-response: missing correlationId`),!0)}return!1}function Le(e){let t=e?.peer?.id;if(t===void 0)return null;let n=A(t);return n===null?null:{peerId:t,allowedSubjects:n}}function Re(e,t,n,r){if(r===null||!Me(e))return!1;let i=`${e.namespace}.${e.subject}`;return r.allowedSubjects.has(i)?!1:(e.type===`request`&&n.sendSafely(t,JSON.stringify({type:`response`,correlationId:e.correlationId,error:{message:`Subject '${i}' is not allowed for peer '${r.peerId}'`}})),n.debug&&console.warn(`[ServerTransport] Dropping ${e.type} to '${i}': not allowed for peer '${r.peerId}'`),!0)}function ze(e,t,n){if(!Ne(e.subjects))return n&&console.warn(`[ServerTransport] Malformed ${e.type} message: missing subjects record`),null;if(t===null)return e.subjects;let r=Fe(e.subjects,t.allowedSubjects,n,t.peerId);return r===null&&n&&console.debug(`[ServerTransport] Dropping ${e.type} message: all subjects filtered for peer '${t.peerId}'`),r}async function Be(e,t,n,r,i){if(e.type!==`subscribe`&&e.type!==`unsubscribe`)return!1;let a=e,o=ze(a,i,n.debug);return o===null||await M(a.type===`subscribe`?n.registry.handleSubscribeMessage(t,{...a,subjects:o}):n.registry.handleUnsubscribeMessage(t,o),n.handlers,{debug:n.debug,receiveContext:r,logContext:`dispatching ${a.type}`})&&typeof a.ackId==`string`&&n.sendSafely(t,JSON.stringify({type:`subscription-ack`,ackId:a.ackId})),!0}async function Ve(e,t,n,r){if(e.type!==`broadcast`)return!1;let i=e;if(typeof i.correlationId!=`string`||typeof i.subject!=`string`)return n.debug&&console.warn(`[ServerTransport] Malformed broadcast message: missing correlationId or subject`),!0;let a=n.registry.getInterestedClients(i.subject,i.payload,t),o=n.normalizeBroadcastTimeout(i.timeout);return n.broadcastAggregator.startClientBroadcast(t,i,a,n.sendSafely,o),await j(e,n.handlers,{debug:n.debug,receiveContext:r}),!0}async function He(e,t,n){if(Ie(e,n,t))return;let r=n.auth?.getReceiveContext?.(t),i=Le(r);if(!Re(e,t,n,i)){if(e.type===`subscribe`||e.type===`unsubscribe`){await Be(e,t,n,r,i);return}if(e.type===`broadcast`){await Ve(e,t,n,r);return}e.type===`event`&&n.registry.forwardEventToClients(t,e,n.sendSafely),e.type===`request`&&n.registry.trackRequestOrigin(t,e),await j(e,n.handlers,{debug:n.debug,receiveContext:r})}}function Ue(e,t){let{auth:n,registry:r,debug:i}=t;return async a=>{let o;try{o=JSON.parse(a.toString())}catch(e){i&&console.error(`[ServerTransport] Failed to parse message:`,e);return}let s=o&&typeof o==`object`?o:void 0;if(!s||typeof s.type!=`string`){i&&console.error(`[ServerTransport] Invalid message structure:`,o);return}let c=o;try{if(n?.handleAuthMessage(c,e))return;if(n&&r.isAuthenticating(e)){i&&console.warn(`[ServerTransport] Ignoring message from unauthenticated client`);return}if(n?.isSocketAuthenticated?.(e)===!1){i&&console.warn(`[ServerTransport] Closing socket with expired authentication`),n.cleanupSocket(e),e.close(1008,`Authentication expired`);return}await He(c,e,t)}catch(e){i&&console.error(`[ServerTransport] Failed to process message:`,e)}}}function We(e){return typeof e!=`number`||!Number.isFinite(e)||e<=0?5e3:Math.min(e,6e4)}async function Ge(e,t){let{registry:n,correlations:r,broadcastAggregator:i,handlers:a,auth:o,serverSubscriptions:c,sendSafely:l,debug:u}=t;o&&n.addAuthenticating(e);let d=Ue(e,{registry:n,correlations:r,broadcastAggregator:i,handlers:a,auth:o,normalizeBroadcastTimeout:We,sendSafely:l,debug:u}),f=e=>{d(e.data)},p=()=>{o?.cleanupSocket(e);let t=n.removeClient(e);e.removeEventListener(`message`,f),e.removeEventListener(`close`,p),e.removeEventListener(`error`,m),i.handleClientDisconnect(e),M(t,a,{debug:u,logContext:`dispatching disconnected client subscriptions`}),u&&console.info(`[ServerTransport] Client disconnected (${n.size} remaining)`)},m=e=>{u&&console.error(`[ServerTransport] Client socket error:`,e)};e.addEventListener(`message`,f),e.addEventListener(`close`,p),e.addEventListener(`error`,m);try{if(o&&(await o.authenticateServer(e,t=>{if(e.readyState!==1)throw Error(`Cannot send auth message: socket not ready (state: ${e.readyState})`);e.send(JSON.stringify(t))}),n.removeAuthenticating(e)),e.readyState!==1)return;if(n.addClient(e),c.size>0){let t=s(c);l(e,JSON.stringify(t))}l(e,JSON.stringify({type:`subscribe-sync-complete`})),u&&console.info(`[ServerTransport] Client connected (${n.size} total)`)}catch(t){if(u&&console.error(`[ServerTransport] Client connection setup failed:`,t),e.readyState>=2)return;let n=t instanceof v&&(t.code===`WS_AUTHENTICATION_REJECTED`||t.code===`WS_POLICY_REJECTED`);e.close(n?1008:1011,n?`Authentication failed`:`Connection setup failed`)}}async function Ke(e,t,n){let{registry:r,correlations:i}=n,s=`${e.namespace}.${e.subject}`,c=r.getRequestOrigin(e.correlationId),l=r.getInterestedRequestClients(s,e.payload,c);if(l.length===0)throw new a(s);for(let[n,r]of l.entries()){let a=`${e.correlationId}:attempt-${n+1}`,c={...e,correlationId:a};try{r.send(JSON.stringify(c))}catch{continue}try{return await i.track(a,t)}catch(e){if(f(e,s)||e instanceof o)continue;throw e}}throw new a(s)}var N=class{name;wss;auth;debug;handlers=new Set;registry;serverSubscriptions=new Map;broadcastAggregator;correlations=new r;connectionListener=null;constructor(e){let{websocket:t,name:n=`websocket`,auth:r,debug:i=!1}=e;this.wss=t,this.name=n,this.auth=r,this.debug=i,this.registry=new Ee({debug:i,subjectRestrictionResolver:r?e=>{let t=(r.getReceiveContext?.(e))?.peer?.id;return t===void 0?null:A(t)}:void 0,socketAuthChecker:r?e=>r.isSocketAuthenticated?.(e)??!0:void 0}),this.broadcastAggregator=new Te({debug:i})}sendToClientSafely(e,t){try{e.send(t)}catch(e){this.debug&&console.warn(`[ServerTransport] Failed to send message to client:`,e)}}async connect(){if(this.connectionListener!==null)throw Error(`ServerTransport.connect() called while already connected`);this.connectionListener=e=>{Ge(e,{registry:this.registry,correlations:this.correlations,broadcastAggregator:this.broadcastAggregator,handlers:this.handlers,auth:this.auth,serverSubscriptions:this.serverSubscriptions,sendSafely:(e,t)=>this.sendToClientSafely(e,t),debug:this.debug})},this.wss.on(`connection`,this.connectionListener),this.debug&&console.info(`[ServerTransport] Listening for connections`)}async disconnect(){this.connectionListener&&=(this.wss.off(`connection`,this.connectionListener),null);let e=this.registry.getAllSockets();for(let t of e)t.close();await new Promise((e,t)=>{this.wss.close(n=>n?t(n):e())}),this.correlations.cleanup(),this.broadcastAggregator.cleanup(),this.auth?.cleanup(),this.handlers.clear(),this.serverSubscriptions.clear(),this.debug&&console.info(`[ServerTransport] Disconnected`)}async send(e,t){if(e.type===`response`){let t=this.registry.consumeResponseClient(e.correlationId);return t?(this.sendToClientSafely(t,JSON.stringify(e)),!0):!1}if(e.type===`broadcast`){let n=u(e)??void 0,r=`payload`in e?e.payload:void 0,i=this.registry.getInterestedClients(n,r);return this.broadcastAggregator.startServerBroadcast(e,i,(e,t)=>{this.sendToClientSafely(e,t)},t)}if(e.type===`request`)return Ke(e,t??i,{registry:this.registry,correlations:this.correlations});if(this.registry.size===0){if(this.debug){let t=u(e);console.debug(`[ServerTransport] No clients to receive ${e.type}${t?`: ${t}`:``}`)}return!1}let n=u(e)??void 0,r=`payload`in e?e.payload:void 0,a=JSON.stringify(e),o=this.registry.getInterestedClients(n,r);for(let e of o)this.sendToClientSafely(e,a);let s=o.length>0;if(!s&&(n&&this.debug&&console.warn(`[ServerTransport] No interested clients for subject: ${n}`),!n))throw Error(`No connected clients available to receive message`);return s}onReceive(e){return this.handlers.add(e),()=>{this.handlers.delete(e)}}cancelRequest(e,t){this.correlations.cancel(e,t),this.registry.cancelRequestOrigin(e)}onBroadcastResults(e,t,n){this.broadcastAggregator.handleNodeResults(e,t,n)}async subscribe(e,t,n=[],r){let i=this.serverSubscriptions.get(e),a=i?.filter,o=t??a,c=r??i?.deliveryClass??`relayable`;if(this.serverSubscriptions.set(e,{filter:o,priorities:n,deliveryClass:c}),this.registry.size>0){let t=s(new Map([[e,{filter:o,priorities:n,deliveryClass:c}]])),r=JSON.stringify(t);for(let e of this.registry.getReadyClients())this.sendToClientSafely(e,r)}}getConnectionCount(){return this.registry.getReadyClients().length}async unsubscribe(e){if(this.serverSubscriptions.delete(e),this.registry.size>0){let t=c({[e]:[]}),n=JSON.stringify(t);for(let e of this.registry.getReadyClients())this.sendToClientSafely(e,n)}}};function qe(e,t){let n=new Event(`close`);return Object.defineProperties(n,{code:{value:e??1e3,enumerable:!0},reason:{value:t??``,enumerable:!0}}),n}function Je(e){if(typeof e!=`object`||!e)throw TypeError(`WebSocket transport options must be an object`);let t=e;if(t.mode!==`client`&&t.mode!==`server`)throw TypeError(`WebSocket transport mode must be "client" or "server"`);if(t.mode===`client`){if(!Ye(t.websocket))throw TypeError(`WebSocket transport client mode requires a websocket with addEventListener/removeEventListener`);return}if(!Xe(t.websocket))throw TypeError(`WebSocket transport server mode requires a websocket with on/off listener methods`)}function Ye(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.send==`function`&&typeof t.close==`function`&&typeof t.addEventListener==`function`&&typeof t.removeEventListener==`function`}function Xe(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.on==`function`&&typeof t.off==`function`&&typeof t.close==`function`}var Ze=class{secret;algorithm;challengeTimeout;identityId;resolveSecret;resolvePeer;pendingChallenge;pendingResult;queuedChallengeNonce;queuedResult;clientAuthComplete=!1;serverPendingResponses=new Map;serverAuthenticatedSockets=new Set;serverAuthenticatedPeers=new Map;serverAuthenticatedSecrets=new Map;constructor(e){this.secret=e.secret,this.algorithm=e.algorithm??`sha256`,this.challengeTimeout=e.challengeTimeout??5e3,this.identityId=e.identityId,this.resolveSecret=e.resolveSecret,this.resolvePeer=e.resolvePeer}async authenticateServer(e,t){let n=crypto.getRandomValues(new Uint8Array(32)),r=Array.from(n).map(e=>e.toString(16).padStart(2,`0`)).join(``),i=this.waitForAuthResponseWithIdentity(e),a=this.serverPendingResponses.get(e);i.catch(()=>void 0);try{t({type:`auth-challenge`,nonce:r});let{signature:n,identityId:o}=await i;this.assertServerOwner(e,a);let s;if(this.resolveSecret&&o!==void 0){let i=this.resolveSecret(o);if(i===null)throw this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!1,error:`Unknown identity`}),new v(`WS_AUTHENTICATION_REJECTED`,`HMAC authentication failed: Unknown identity '${o}'`);s=await this.computeHmacWithSecret(r,i),this.assertServerOwner(e,a),this.constantTimeEqual(n,s)&&(this.serverAuthenticatedPeers.set(e,o),this.serverAuthenticatedSecrets.set(e,i))}else s=await this.computeHmac(r),this.assertServerOwner(e,a);if(!this.constantTimeEqual(n,s))throw this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!1,error:`Invalid signature`}),new v(`WS_AUTHENTICATION_REJECTED`,`HMAC authentication failed: Invalid signature`);try{t({type:`auth-result`,success:!0}),this.assertServerOwner(e,a)}catch(t){throw this.serverPendingResponses.get(e)===a&&this.cleanupSocket(e),t}this.serverAuthenticatedSockets.add(e)}finally{clearTimeout(a.timeoutHandle),this.serverPendingResponses.get(e)===a&&this.serverPendingResponses.delete(e)}}async authenticateClient(e){this.clientAuthComplete=!1;let t=this.waitForAuthChallenge(),n=this.pendingChallenge;try{let r=await t;this.assertClientOwner(n);let i=await this.computeHmac(r);this.assertClientOwner(n),e({type:`auth-response`,signature:i,...this.identityId!==void 0&&{identityId:this.identityId}}),this.assertClientOwner(n);let a=await this.waitForAuthResult();if(this.assertClientOwner(n),!a.success)throw new v(`WS_AUTHENTICATION_REJECTED`,`HMAC authentication failed: ${a.error??`Unknown error`}`);this.clientAuthComplete=!0}finally{clearTimeout(n.timeoutHandle),this.pendingChallenge===n&&(this.pendingChallenge=void 0)}}assertClientOwner(e){if(this.pendingChallenge!==e)throw new v(`WS_CONNECTION_UNAVAILABLE`,`Socket disconnected during HMAC authentication`)}assertServerOwner(e,t){if(this.serverPendingResponses.get(e)!==t)throw new v(`WS_CONNECTION_UNAVAILABLE`,`Socket disconnected during HMAC authentication`)}handleAuthMessage(e,t){if(typeof e!=`object`||!e||!(`type`in e)||typeof e.type!=`string`)return!1;let n=e;if(n.type===`auth-challenge`)return typeof n.nonce!=`string`||this.clientAuthComplete||(this.pendingChallenge?(clearTimeout(this.pendingChallenge.timeoutHandle),this.pendingChallenge.resolve(n.nonce)):this.queuedChallengeNonce=n.nonce),!0;if(n.type===`auth-result`){if(typeof n.success!=`boolean`||this.clientAuthComplete)return!0;let e={success:n.success,error:typeof n.error==`string`?n.error:void 0};return this.pendingResult?(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.resolve(e),this.pendingResult=void 0):this.queuedResult=e,!0}if(n.type===`auth-response`){if(t){let e=this.serverPendingResponses.get(t);if(e){if(clearTimeout(e.timeoutHandle),n.identityId!==void 0&&typeof n.identityId!=`string`)return e.reject(new v(`WS_AUTHENTICATION_REJECTED`,`Malformed HMAC identity`)),!0;e.resolve({signature:n.signature,identityId:n.identityId})}}return!0}return!1}async waitForAuthChallenge(){return new Promise((e,t)=>{let n=setTimeout(()=>{t(new v(`WS_HANDSHAKE_TIMEOUT`,`Authentication challenge timeout`))},this.challengeTimeout);this.pendingChallenge={resolve:e,reject:t,timeoutHandle:n},this.queuedChallengeNonce!==void 0&&(clearTimeout(n),e(this.queuedChallengeNonce),this.queuedChallengeNonce=void 0)})}async waitForAuthResponseWithIdentity(e){return new Promise((t,n)=>{let r={resolve:t,reject:n,timeoutHandle:setTimeout(()=>{n(new v(`WS_HANDSHAKE_TIMEOUT`,`Authentication response timeout`))},this.challengeTimeout)};this.serverPendingResponses.set(e,r)})}async waitForAuthResult(){if(this.queuedResult!==void 0){let e=this.queuedResult;return this.queuedResult=void 0,e}return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingResult=void 0,t(new v(`WS_HANDSHAKE_TIMEOUT`,`Authentication result timeout`))},this.challengeTimeout);this.pendingResult={resolve:e,reject:t,timeoutHandle:n}})}async computeHmac(e){return this.computeHmacWithSecret(e,this.secret)}async computeHmacWithSecret(e,t){let n=new TextEncoder,r=n.encode(t),i=this.algorithm.replace(/^sha/,`SHA-`),a=await crypto.subtle.importKey(`raw`,r,{name:`HMAC`,hash:i},!1,[`sign`]),o=await crypto.subtle.sign(`HMAC`,a,n.encode(e));return Array.from(new Uint8Array(o)).map(e=>e.toString(16).padStart(2,`0`)).join(``)}getReceiveContext(e){if(!e)return;let t=this.serverAuthenticatedPeers.get(e);if(t===void 0)return;let n=this.resolvePeer?.(t);if(n!=null)return{transportName:``,peer:{...n,id:n.id??t,authenticated:!0}}}isSocketAuthenticated(e){if(!this.serverAuthenticatedSockets.has(e))return!1;if(!this.resolveSecret)return!0;let t=this.serverAuthenticatedPeers.get(e);if(t===void 0)return!0;let n=this.resolveSecret(t);if(n===null)return this.cleanupSocket(e),!1;let r=this.serverAuthenticatedSecrets.get(e);return r!==void 0&&n!==r?(this.cleanupSocket(e),!1):!0}constantTimeEqual(e,t){if(typeof e!=`string`||e.length!==t.length||!/^[0-9a-f]+$/i.test(e))return!1;let n=new Uint8Array(e.length/2),r=new Uint8Array(t.length/2);for(let i=0;i<n.length;i++)n[i]=parseInt(e.slice(i*2,i*2+2),16),r[i]=parseInt(t.slice(i*2,i*2+2),16);let i=0;for(let e=0;e<n.length;e++)i|=n[e]^r[e];return i===0}sendAuthResultBestEffort(e,t){try{e(t)}catch{}}cleanupSocket(e){let t=this.serverPendingResponses.get(e);t&&(clearTimeout(t.timeoutHandle),this.serverPendingResponses.delete(e),t.reject(new v(`WS_CONNECTION_UNAVAILABLE`,`Socket disconnected during HMAC authentication`))),this.serverAuthenticatedPeers.delete(e),this.serverAuthenticatedSecrets.delete(e),this.serverAuthenticatedSockets.delete(e)}cleanup(){this.pendingChallenge&&=(clearTimeout(this.pendingChallenge.timeoutHandle),this.pendingChallenge.reject(new v(`WS_CONNECTION_UNAVAILABLE`,`Socket disconnected during HMAC authentication`)),void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.reject(new v(`WS_CONNECTION_UNAVAILABLE`,`Socket disconnected during HMAC authentication`)),void 0),this.queuedChallengeNonce=void 0,this.queuedResult=void 0,this.clientAuthComplete=!1;for(let e of this.serverPendingResponses.values())clearTimeout(e.timeoutHandle),e.reject(new v(`WS_CONNECTION_UNAVAILABLE`,`Socket disconnected during HMAC authentication`));this.serverPendingResponses.clear(),this.serverAuthenticatedPeers.clear(),this.serverAuthenticatedSecrets.clear(),this.serverAuthenticatedSockets.clear()}};function P(e){let t=Array.from(e,e=>String.fromCharCode(e)).join(``);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``)}function F(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=(4-t.length%4)%4;t+=`=`.repeat(n);let r=atob(t),i=new Uint8Array(r.length);for(let e=0;e<r.length;e++)i[e]=r.charCodeAt(e);return i}function I(e){return new TextEncoder().encode(e)}function L(e){return new TextDecoder().decode(e)}async function R(e){let t=await crypto.subtle.exportKey(`spki`,e);return P(new Uint8Array(t))}async function z(e){let t=await crypto.subtle.exportKey(`raw`,e);return P(new Uint8Array(t))}async function B(e,t,n=[]){let r=F(e);return crypto.subtle.importKey(`spki`,r,t,!0,n)}async function V(e,t,n=[]){let r=F(e);return crypto.subtle.importKey(`raw`,r,t,!0,n)}async function H(e){let t=await crypto.subtle.exportKey(`pkcs8`,e),n=P(new Uint8Array(t)).replace(/-/g,`+`).replace(/_/g,`/`),r=(4-n.length%4)%4;return n+=`=`.repeat(r),`-----BEGIN PRIVATE KEY-----\n${n.match(/.{1,64}/g)?.join(`
+`)??n}\n-----END PRIVATE KEY-----`}async function Qe(e,t,n){let r=F(e.replace(/-----BEGIN PRIVATE KEY-----/,``).replace(/-----END PRIVATE KEY-----/,``).replace(/\s/g,``).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``));return crypto.subtle.importKey(`pkcs8`,r,t,!0,n)}const U={name:`ECDH`,namedCurve:`P-256`};async function $e(e=!0){return crypto.subtle.generateKey(U,e,[`deriveKey`,`deriveBits`])}async function et(e){return R(e)}async function tt(e){return z(e)}async function nt(e){return V(e,U)}async function rt(e,t=[]){return B(e,U,t)}async function it(e){return H(e)}async function at(e){return Qe(e,U,[`deriveKey`,`deriveBits`])}async function ot(e,t){return crypto.subtle.deriveBits({name:`ECDH`,public:t},e,256)}async function W(e,t){let n=crypto.getRandomValues(new Uint8Array(12)),r=await crypto.subtle.encrypt({name:`AES-GCM`,iv:n},e,t);return{ciphertext:new Uint8Array(r),nonce:n}}async function G(e,t,n){let r=await crypto.subtle.decrypt({name:`AES-GCM`,iv:n},e,t);return new Uint8Array(r)}async function st(e){return crypto.subtle.importKey(`raw`,e,{name:`AES-GCM`},!1,[`encrypt`,`decrypt`])}async function ct(e,t,n){let r=await crypto.subtle.importKey(`raw`,e,{name:`HKDF`},!1,[`deriveKey`]);return crypto.subtle.deriveKey({name:`HKDF`,hash:`SHA-256`,salt:t,info:I(n)},r,{name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`])}const K={name:`ECDSA`,namedCurve:`P-256`};async function lt(e=!0){return crypto.subtle.generateKey(K,e,[`sign`,`verify`])}async function ut(e,t){let n=await crypto.subtle.sign({name:`ECDSA`,hash:{name:`SHA-256`}},e,t);return new Uint8Array(n)}async function dt(e,t,n){return crypto.subtle.verify({name:`ECDSA`,hash:{name:`SHA-256`}},e,t,n)}async function ft(e){return R(e)}async function pt(e){return B(e,K,[`verify`])}async function mt(e){return z(e)}async function ht(e){return V(e,K,[`verify`])}async function gt(e){return H(e)}async function _t(e){return Qe(e,K,[`sign`])}var vt=e({decodeText:()=>L,decrypt:()=>G,deriveSessionKey:()=>ct,deriveSharedSecret:()=>ot,encodeText:()=>I,encrypt:()=>W,exportPrivateKeyPEM:()=>it,exportPublicKey:()=>et,exportPublicKeyRaw:()=>tt,exportSigningPrivateKeyPEM:()=>gt,exportSigningPublicKey:()=>ft,exportSigningPublicKeyRaw:()=>mt,fromBase64Url:()=>F,generateECDHKeyPair:()=>$e,generateSigningKeyPair:()=>lt,importAESKey:()=>st,importPrivateKeyPEM:()=>at,importPublicKey:()=>rt,importPublicKeyRaw:()=>nt,importSigningPrivateKeyPEM:()=>_t,importSigningPublicKey:()=>pt,importSigningPublicKeyRaw:()=>ht,sign:()=>ut,toBase64Url:()=>P,verify:()=>dt});function yt(e){let t=e.match(/.{1,2}/g);return new Uint8Array(t?.map(e=>parseInt(e,16))??[])}function q(e){return Array.from(e).map(e=>e.toString(16).padStart(2,`0`)).join(``)}async function J(e,t){let n=await $e(!0),r=await et(n.publicKey);return{ephemeralKeyPair:n,ephemeralPublicKey:r,signature:q(await ut(e,I(r+t)))}}function bt(){return q(crypto.getRandomValues(new Uint8Array(16)))}async function Y(e,t,n,r){let i=I(t+r);return dt(e,yt(n),i)}async function X(e,t,n,r){let i;try{i=await rt(t)}catch(e){throw e instanceof DOMException&&e.name===`DataError`?new v(`WS_AUTHENTICATION_REJECTED`,`Invalid E2E peer public key`,{cause:e}):e}return ct(await ot(e,i),yt(n),r)}async function xt(e,t,n,r){if(e===t)throw Error(`deriveRelaySaltHex: identityId must differ from peerId`);let[i,a]=e<t?[e,t]:[t,e],[o,s]=e<t?[n,r]:[r,n],c=I(`${i}${a}${o}${s}`),l=new Uint8Array(c).buffer,u=await crypto.subtle.digest(`SHA-256`,l);return q(new Uint8Array(u))}function St(e,t){return typeof e==`string`&&/^[A-Za-z0-9_-]+$/.test(e)&&e.length%4!=1&&typeof t==`string`&&/^[0-9a-f]{128}$/i.test(t)}function Ct(e){return St(e.ephemeralPublicKey,e.signature)&&typeof e.salt==`string`&&/^[0-9a-f]{32}$/i.test(e.salt)}var wt=class{signingKeyPair;identityId;peerId;getPeerSigningKey;timeout;pendingKeyExchange;pendingResult;clientSession;clientEphemeralKeyPair;serverPendingKeyExchange=new Map;serverSessions=new Map;serverEphemeralKeyPairs=new Map;constructor(e){this.signingKeyPair=e.signingKeyPair,this.identityId=e.identityId,this.peerId=e.peerId,this.getPeerSigningKey=e.getPeerSigningKey,this.timeout=e.timeout??1e4}async authenticateClient(e){if(!this.peerId)throw Error(`E2E authentication failed: peerId is required for client authentication`);let t=this.waitForKeyExchangeResponse(),n=this.pendingKeyExchange,r=this.waitForAuthResult();t.catch(()=>void 0),r.catch(()=>void 0);try{let{ephemeralKeyPair:i,ephemeralPublicKey:a,signature:o}=await J(this.signingKeyPair.privateKey,this.identityId);this.assertClientOwner(n),this.clientEphemeralKeyPair=i,e({type:`e2e-key-exchange`,deviceId:this.identityId,ephemeralPublicKey:a,signature:o}),this.assertClientOwner(n);let s=await t;this.assertClientOwner(n);let c=await this.getPeerSigningKey(this.peerId);if(this.assertClientOwner(n),!c)throw new v(`WS_AUTHENTICATION_REJECTED`,`E2E authentication failed: Unknown server`);let l=await Y(c,s.ephemeralPublicKey,s.signature,this.peerId);if(this.assertClientOwner(n),!l)throw new v(`WS_AUTHENTICATION_REJECTED`,`E2E authentication failed: Invalid server signature`);let u=await X(i.privateKey,s.ephemeralPublicKey,s.salt,`makaio-e2e-session-v1`);this.assertClientOwner(n);let d=await r;if(this.assertClientOwner(n),!d.success)throw new v(`WS_AUTHENTICATION_REJECTED`,`E2E authentication failed: ${d.error??`Unknown error`}`);this.clientSession={sessionKey:u,peerId:this.peerId}}catch(e){throw this.pendingKeyExchange===n&&(this.clientSession=void 0,this.clientEphemeralKeyPair=void 0),e}finally{clearTimeout(n.timeoutHandle),this.pendingKeyExchange===n&&(this.pendingKeyExchange=void 0,this.pendingResult&&clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult=void 0)}}async authenticateServer(e,t){let n=this.waitForClientKeyExchange(e),r=this.serverPendingKeyExchange.get(e);try{let i=await n;this.assertServerOwner(e,r);let a=await this.getPeerSigningKey(i.deviceId);if(this.assertServerOwner(e,r),!a)throw new v(`WS_AUTHENTICATION_REJECTED`,`E2E authentication failed: Unknown device ${i.deviceId}`);let o=await Y(a,i.ephemeralPublicKey,i.signature,i.deviceId);if(this.assertServerOwner(e,r),!o)throw new v(`WS_AUTHENTICATION_REJECTED`,`E2E authentication failed: Invalid client signature`);let{ephemeralKeyPair:s,ephemeralPublicKey:c,signature:l}=await J(this.signingKeyPair.privateKey,this.identityId);this.assertServerOwner(e,r);let u=bt();this.serverEphemeralKeyPairs.set(e,s),t({type:`e2e-key-exchange-response`,ephemeralPublicKey:c,signature:l,salt:u}),this.assertServerOwner(e,r);let d=await X(s.privateKey,i.ephemeralPublicKey,u,`makaio-e2e-session-v1`);this.assertServerOwner(e,r),this.serverSessions.set(e,{sessionKey:d,peerId:i.deviceId}),t({type:`e2e-auth-result`,success:!0}),this.assertServerOwner(e,r)}catch(n){if(this.serverPendingKeyExchange.get(e)===r){this.serverEphemeralKeyPairs.delete(e),this.serverSessions.delete(e);try{n instanceof v&&n.code===`WS_AUTHENTICATION_REJECTED`&&t({type:`e2e-auth-result`,success:!1,error:n.message})}catch{}}throw n}finally{clearTimeout(r.timeoutHandle),this.serverPendingKeyExchange.get(e)===r&&this.serverPendingKeyExchange.delete(e)}}assertClientOwner(e){if(this.pendingKeyExchange!==e)throw new v(`WS_CONNECTION_UNAVAILABLE`,`Connection closed during E2E authentication`)}assertServerOwner(e,t){if(this.serverPendingKeyExchange.get(e)!==t)throw new v(`WS_CONNECTION_UNAVAILABLE`,`Connection closed during E2E authentication`)}handleAuthMessage(e,t){if(typeof e!=`object`||!e||!(`type`in e)||typeof e.type!=`string`)return!1;let n=e;if(n.type===`e2e-key-exchange-response`){if(this.pendingKeyExchange){if(clearTimeout(this.pendingKeyExchange.timeoutHandle),!Ct(n))return this.pendingKeyExchange.reject(new v(`WS_AUTHENTICATION_REJECTED`,`Malformed E2E key exchange response`)),!0;this.pendingKeyExchange.resolve({ephemeralPublicKey:n.ephemeralPublicKey,signature:n.signature,salt:n.salt})}return!0}if(n.type===`e2e-auth-result`){if(typeof n.success!=`boolean`)return!0;let e=typeof n.error==`string`?n.error:void 0;return!n.success&&this.pendingKeyExchange&&(clearTimeout(this.pendingKeyExchange.timeoutHandle),this.pendingKeyExchange.reject(new v(`WS_AUTHENTICATION_REJECTED`,`E2E authentication failed: ${e??`Unknown error`}`))),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.resolve({success:n.success,error:e}),void 0),!0}if(n.type===`e2e-key-exchange`&&t){let e=this.serverPendingKeyExchange.get(t);if(e){if(clearTimeout(e.timeoutHandle),typeof n.deviceId!=`string`||!St(n.ephemeralPublicKey,n.signature))return e.reject(new v(`WS_AUTHENTICATION_REJECTED`,`Malformed E2E key exchange`)),!0;e.resolve({deviceId:n.deviceId,ephemeralPublicKey:n.ephemeralPublicKey,signature:n.signature})}return!0}return!1}async waitForKeyExchangeResponse(){return new Promise((e,t)=>{let n=setTimeout(()=>{t(new v(`WS_HANDSHAKE_TIMEOUT`,`E2E key exchange timeout`))},this.timeout);this.pendingKeyExchange={resolve:e,reject:t,timeoutHandle:n}})}async waitForAuthResult(){return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingResult=void 0,t(new v(`WS_HANDSHAKE_TIMEOUT`,`E2E authentication result timeout`))},this.timeout);this.pendingResult={resolve:e,reject:t,timeoutHandle:n}})}async waitForClientKeyExchange(e){return new Promise((t,n)=>{let r={resolve:t,reject:n,timeoutHandle:setTimeout(()=>{n(new v(`WS_HANDSHAKE_TIMEOUT`,`E2E key exchange timeout`))},this.timeout)};this.serverPendingKeyExchange.set(e,r)})}getSessionKey(e){return e?this.serverSessions.get(e)?.sessionKey??null:this.clientSession?.sessionKey??null}getPeerId(e){return e?this.serverSessions.get(e)?.peerId??null:this.clientSession?.peerId??null}getReceiveContext(e){let t=this.getPeerId(e);if(t!==null)return{transportName:``,peer:{kind:`e2e`,id:t,authenticated:!0,encrypted:!0}}}cleanupSocket(e){let t=this.serverPendingKeyExchange.get(e);t&&(clearTimeout(t.timeoutHandle),t.reject(new v(`WS_CONNECTION_UNAVAILABLE`,`Connection closed during E2E authentication`)),this.serverPendingKeyExchange.delete(e)),this.serverSessions.delete(e),this.serverEphemeralKeyPairs.delete(e)}cleanup(){this.pendingKeyExchange&&=(clearTimeout(this.pendingKeyExchange.timeoutHandle),this.pendingKeyExchange.reject(new v(`WS_CONNECTION_UNAVAILABLE`,`Connection closed during E2E authentication`)),void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.reject(new v(`WS_CONNECTION_UNAVAILABLE`,`Connection closed during E2E authentication`)),void 0),this.clientSession=void 0,this.clientEphemeralKeyPair=void 0;for(let e of this.serverPendingKeyExchange.values())clearTimeout(e.timeoutHandle),e.reject(new v(`WS_CONNECTION_UNAVAILABLE`,`Connection closed during E2E authentication`));this.serverPendingKeyExchange.clear(),this.serverSessions.clear(),this.serverEphemeralKeyPairs.clear()}};const Z=`E2E relay auth session aborted by reconnect`;var Tt=class{signingKeyPair;identityId;getPeerSigningKey;timeout;mode;blocking;pendingPeer;sessionKey;peerId;localEphemeral;localExchangeMessage;sentLocalExchange=!1;earlyPeer;sendAuthMessage;authGeneration=0;processingExchange=!1;constructor(e){this.signingKeyPair=e.signingKeyPair,this.identityId=e.identityId,this.getPeerSigningKey=e.getPeerSigningKey,this.timeout=e.timeout??1e4,this.mode=e.mode??`initiator`,this.blocking=e.blocking??!0}async authenticateClient(e){let t=this.sendAuthMessage===void 0?this.earlyPeer:void 0;this.cleanup();let n=this.authGeneration;if(this.earlyPeer=t,this.sendAuthMessage=e,this.mode===`initiator`){if(await this.ensureLocalExchangeMessage(),n!==this.authGeneration)throw Error(Z);this.sendLocalExchange()}if(!this.blocking){if(this.earlyPeer){let e=this.earlyPeer;this.earlyPeer=void 0,this.dispatchPeerExchange(e,n)}return}let r=await this.waitForPeerExchange();if(await this.processPeerExchange(r,n),n!==this.authGeneration||!this.sessionKey)throw Error(Z)}async authenticateServer(e,t){throw Error(`E2ERelayAuth does not support server authentication`)}handleAuthMessage(e){let t=e;return!t||t.type!==`e2e-relay-key-exchange`?!1:t.identityId===this.identityId?!0:this.pendingPeer?(this.pendingPeer.resolve(t),this.pendingPeer=void 0,!0):(this.earlyPeer=t,!this.blocking&&this.sendAuthMessage&&!this.sessionKey&&!this.processingExchange&&this.dispatchPeerExchange(t,this.authGeneration),!0)}cleanupSocket(e){}cleanup(){this.authGeneration++,this.pendingPeer&&=(this.pendingPeer.reject(Error(Z)),void 0),this.earlyPeer&&=void 0,this.sessionKey=void 0,this.peerId=void 0,this.localEphemeral=void 0,this.localExchangeMessage=void 0,this.sentLocalExchange=!1,this.processingExchange=!1,this.sendAuthMessage=void 0}dispatchPeerExchange(e,t){this.processingExchange=!0,this.processPeerExchange(e,t).catch(e=>{e instanceof Error&&e.message===Z||console.error(`[E2ERelayAuth] Peer exchange failed:`,e)}).finally(()=>{t===this.authGeneration&&(this.processingExchange=!1,this.retryQueuedPeerExchange(t))})}getSessionKey(){return this.sessionKey??null}getPeerId(){return this.peerId??null}getReceiveContext(){let e=this.getPeerId();if(e!==null)return{transportName:``,peer:{kind:`e2e`,id:e,authenticated:!0,encrypted:!0}}}async waitForPeerExchange(){if(this.earlyPeer){let e=this.earlyPeer;return this.earlyPeer=void 0,e}return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingPeer=void 0,t(Error(`E2E relay key exchange timeout`))},this.timeout),r=()=>{clearTimeout(n),this.pendingPeer=void 0};this.pendingPeer={resolve:t=>{r(),e(t)},reject:e=>{r(),t(e)},timeoutHandle:n}})}async ensureLocalExchangeMessage(){if(this.localExchangeMessage&&this.localEphemeral)return this.localExchangeMessage;let{ephemeralKeyPair:e,ephemeralPublicKey:t,signature:n}=await J(this.signingKeyPair.privateKey,this.identityId);return this.localEphemeral=e,this.localExchangeMessage={type:`e2e-relay-key-exchange`,identityId:this.identityId,ephemeralPublicKey:t,signature:n},this.localExchangeMessage}sendLocalExchange(e=!1){!this.sendAuthMessage||!this.localExchangeMessage||!e&&this.sentLocalExchange||(this.sendAuthMessage(this.localExchangeMessage),this.sentLocalExchange=!0)}retryQueuedPeerExchange(e){if(this.blocking||!this.sendAuthMessage||this.sessionKey||this.processingExchange||e!==this.authGeneration)return;let t=this.earlyPeer;t&&(this.earlyPeer=void 0,this.dispatchPeerExchange(t,e))}async processPeerExchange(e,t){if(!this.sendAuthMessage){this.earlyPeer=e;return}let n=await this.ensureLocalExchangeMessage();if(t!==this.authGeneration)return;let r=await this.getPeerSigningKey(e.identityId);if(!r)throw Error(`E2E relay authentication failed: Unknown peer ${e.identityId}`);if(!await Y(r,e.ephemeralPublicKey,e.signature,e.identityId))throw Error(`E2E relay authentication failed: Invalid peer signature`);let i=await xt(this.identityId,e.identityId,n.ephemeralPublicKey,e.ephemeralPublicKey);if(!this.localEphemeral)throw Error(`E2E relay authentication failed: Local ephemeral key missing`);let a=await X(this.localEphemeral.privateKey,e.ephemeralPublicKey,i,`makaio-e2e-relay-v1`);t===this.authGeneration&&(this.sessionKey=a,this.peerId=e.identityId,this.mode===`initiator`?this.sendLocalExchange(!0):this.sendLocalExchange())}},Et=class{hmac;e2e;socketStrategy=new Map;pendingServerAuth=new Map;hmacCancelled=new Map;constructor(e){this.hmac=e.hmac,this.e2e=e.e2e}setE2EAuth(e){this.e2e=e}async authenticateClient(e){let t=this.hmac??this.e2e;if(!t)throw Error(`DispatchingAuth: no auth strategy configured`);return t.authenticateClient(e)}async authenticateServer(e,t){let n=this.resolveSingleStrategy();if(n)return n.authenticateServer(e,t);if(!this.hmac||!this.e2e)throw Error(`DispatchingAuth: no auth strategy configured`);let r={cancelled:!1};this.hmacCancelled.set(e,r);let i=this.hmac.authenticateServer(e,e=>{r.cancelled||t(e)});return new Promise((n,a)=>{this.pendingServerAuth.set(e,{resolve:n,reject:a,send:t}),i.then(n).catch(e=>{r.cancelled||a(e instanceof Error?e:Error(String(e)))})})}handleAuthMessage(e,t){if(!t)return(this.hmac??this.e2e)?.handleAuthMessage(e)??!1;let n=this.socketStrategy.get(t);if(n)return n.handleAuthMessage(e,t);let r=this.resolveStrategy(e),i=this.pendingServerAuth.get(t);return r?(this.socketStrategy.set(t,r),this.pendingServerAuth.delete(t),r===this.hmac?this.hmacCancelled.delete(t):(this.cancelHmac(t),i&&r.authenticateServer(t,i.send).then(i.resolve).catch(e=>{i.reject(e instanceof Error?e:Error(String(e)))})),r.handleAuthMessage(e,t)):(this.cancelHmac(t),i&&(this.pendingServerAuth.delete(t),i.reject(new v(`WS_POLICY_REJECTED`,`DispatchingAuth: unrecognised auth message type "${this.peekType(e)}" — no matching strategy`))),!1)}cleanupSocket(e){let t=this.socketStrategy.get(e);t&&(t.cleanupSocket(e),this.socketStrategy.delete(e)),this.cancelHmac(e);let n=this.pendingServerAuth.get(e);n&&(this.pendingServerAuth.delete(e),n.reject(Error(`DispatchingAuth: socket disconnected before auth type was determined`)))}cleanup(){this.hmac?.cleanup(),this.e2e?.cleanup(),this.socketStrategy.clear();for(let e of this.pendingServerAuth.values())e.reject(Error(`DispatchingAuth: cleanup called before authentication completed`));this.pendingServerAuth.clear(),this.hmacCancelled.clear()}peekType(e){if(typeof e!=`object`||!e||!(`type`in e))return;let{type:t}=e;return typeof t==`string`?t:void 0}resolveSingleStrategy(){if(this.hmac&&!this.e2e)return this.hmac;if(this.e2e&&!this.hmac)return this.e2e}resolveStrategy(e){let t=this.peekType(e);if(t){if(t===`e2e-key-exchange`&&this.e2e)return this.e2e;if(t===`auth-response`&&this.hmac)return this.hmac}}cancelHmac(e){let t=this.hmacCancelled.get(e);t&&(t.cancelled=!0,this.hmacCancelled.delete(e),this.hmac?.cleanupSocket(e))}};function Dt(e){return`payload`in e}async function Ot(e,t,n){if(e.type!==`response`||e.result===void 0||e.error!==void 0)return;let{ciphertext:r,nonce:i}=await W(n,I(JSON.stringify(e.result)));t.result=P(r),t.e2e={nonce:P(i),v:1}}async function kt(e,t,n){if(e.type!==`broadcast-response`||e.results===void 0||e.error!==void 0)return;let{ciphertext:r,nonce:i}=await W(n,I(JSON.stringify(e.results)));t.results=P(r),t.e2e={nonce:P(i),v:1}}async function At(e,t,n){if(!Dt(e)||e.payload===void 0)return;let{ciphertext:r,nonce:i}=await W(n,I(JSON.stringify(e.payload)));t.payload=P(r),t.e2e={nonce:P(i),v:1}}async function jt(e,t,n){if(e.type!==`response`&&e.type!==`broadcast-response`||e.error===void 0)return;let{ciphertext:r,nonce:i}=await W(n,I(JSON.stringify(e.error)));t.error=P(r),t.e2e={nonce:P(i),v:1}}async function Mt(e,t,n,r){if(!Dt(e)||typeof e.payload!=`string`)return;let i=L(await G(n,F(e.payload),r));t.payload=JSON.parse(i)}async function Nt(e,t,n,r){if(e.type!==`response`||typeof e.result!=`string`)return;let i=L(await G(n,F(e.result),r));t.result=JSON.parse(i)}async function Pt(e,t,n,r){if(e.type!==`broadcast-response`||typeof e.results!=`string`)return;let i=L(await G(n,F(e.results),r));t.results=JSON.parse(i)}async function Ft(e,t,n,r){if(e.type!==`response`&&e.type!==`broadcast-response`||typeof e.error!=`string`)return;let i=L(await G(n,F(e.error),r));t.error=JSON.parse(i)}async function It(e,t){let n={...e};return await At(e,n,t),await Ot(e,n,t),await kt(e,n,t),await jt(e,n,t),n}async function Lt(e,t){if(!e.e2e)return e;let n={...e};delete n.e2e;let r=F(e.e2e.nonce);return await Mt(e,n,t,r),await Nt(e,n,t,r),await Pt(e,n,t,r),await Ft(e,n,t,r),n}function Rt(e){return e.type===`subscription-ack`&&typeof e.ackId==`string`}function zt(e){let{e2eAuth:t,websocket:n,...r}=e,i=new D({...r,url:`<pre-connected>`,createWebSocket:()=>n,auth:t,autoReconnect:!1,heartbeat:r.heartbeat??!1,messageTransform:async e=>{let n=t.getSessionKey();if(!n||Rt(e))return e;let r=e;if(!r.e2e)throw Error(`Received plaintext message on E2E-encrypted channel — possible injection`);return Lt(r,n)}});async function a(e,n){let r=t.getSessionKey();if(!r)throw Error(`E2E session key not available - authentication may have failed`);let a=await It(e,r);return i.send(a,n)}return{name:i.name,connect:i.connect.bind(i),disconnect:i.disconnect.bind(i),send:a,cancelRequest:i.cancelRequest.bind(i),onReceive:i.onReceive.bind(i),subscribe:i.subscribe.bind(i),unsubscribe:i.unsubscribe.bind(i),getSubscriptions:i.getSubscriptions.bind(i)}}function Bt(e){return zt(e)}function Vt(e){if(!e||typeof e!=`object`)return!1;let t=e;if(t.type!==`e2e-relay-envelope`||typeof t.payload!=`string`)return!1;let n=t.e2e;return!!n&&typeof n.nonce==`string`&&typeof n.v==`number`}async function Ht(e,t){let{ciphertext:n,nonce:r}=await W(t,I(JSON.stringify(e)));return{type:`e2e-relay-envelope`,payload:P(n),e2e:{nonce:P(r),v:1}}}async function Ut(e,t){let n=F(e.e2e.nonce),r=L(await G(t,F(e.payload),n));return JSON.parse(r)}function Wt(e){let t=()=>{if(!e.isFrozen())throw Error(`RelayControlRegistry must be frozen before processing relay control messages`)};function n(t){return typeof t.namespace!=`string`||typeof t.subject!=`string`||!e.isControlEvent(t.namespace,t.subject)||typeof t.messageId!=`string`?!1:t.payload!==void 0}function r(t){return typeof t.namespace!=`string`||typeof t.subject!=`string`||!e.isControlRequest(t.namespace,t.subject)||typeof t.messageId!=`string`||typeof t.correlationId!=`string`?!1:t.payload!==void 0}function i(e){if(t(),!e||typeof e!=`object`)return!1;let i=e;return i.type===`event`?n(i):i.type===`request`?r(i):!1}function a(e){if(t(),!e||typeof e!=`object`)return!1;let n=e;return n.type!==`relay-control`||n.v!==1||!n.payload||typeof n.payload!=`object`?!1:i(n.payload)}function o(e){if(t(),!i(e))throw Error(`Invalid relay control message`);return{type:`relay-control`,v:1,payload:e}}return{createRelayControlEnvelope:o,isRelayControlEnvelopeMessage:a,isRelayControlBusMessage:i}}function Q(e){let t=Date.now()-3e5;for(let[n,r]of e)r>=t||e.delete(n);for(;e.size>2048;){let t=e.keys().next().value;if(!t)break;e.delete(t)}}const Gt=e=>{if(!e||typeof e!=`object`)return!1;let t=e;return t.type===`response`&&typeof t.correlationId==`string`},Kt=e=>e.type===`subscribe`||e.type===`unsubscribe`,qt=e=>{if(!e||typeof e!=`object`)return!1;let t=e;return t.type===`subscription-ack`&&typeof t.ackId==`string`};function $(e,t,n,r){if(!r.isFrozen())throw Error(`E2ERelay transport requires a frozen relay control registry`);let{createRelayControlEnvelope:i,isRelayControlEnvelopeMessage:a,isRelayControlBusMessage:o}=Wt(r),s=e=>{n.delete(e),n.set(e,Date.now()),Q(n)};return{encode:async t=>{if(o(t))return t.type===`request`&&s(t.correlationId),JSON.stringify(i(t));if(Q(n),t.type===`response`&&n.has(t.correlationId))return n.delete(t.correlationId),JSON.stringify(t);let r=e.getSessionKey();if(!r&&Kt(t)||!r&&qt(t))return JSON.stringify(t);if(!r)throw Error(`E2E relay session not established`);let a=await Ht(t,r);return JSON.stringify(a)},decode:async r=>{let i=e.getSessionKey();if(a(r)){let e=r.payload;return t&&console.info(`[E2ERelayTransport] Decoded relay control envelope:`,e.type,e.namespace,e.subject),e.type===`request`&&s(e.correlationId),e}if(Q(n),Gt(r)&&n.has(r.correlationId))return n.delete(r.correlationId),r;if(!i&&qt(r))return r;if(!i)throw Error(`E2E relay session not established`);if(!Vt(r))throw Error(`Received plaintext message on relay E2E channel — possible injection`);return Ut(r,i)}}}function Jt(e,t,n=!1){let r=new Map;return{codec:$(e,n,r,t),reset:()=>r.clear()}}function Yt(e){let{e2eAuth:t,registry:n,websocket:r,...i}=e,a=e.debug??!1,o=new Map,s=$(t,a,o,n);a&&console.info(`[E2ERelayTransport] Creating inner transport...`);let c=new D({...i,url:`<pre-connected>`,createWebSocket:()=>r,auth:t,codec:s,autoReconnect:!1,heartbeat:i.heartbeat??!1});return a&&console.info(`[E2ERelayTransport] Inner transport created`),{name:c.name,connect:async()=>{if(!n.isFrozen())throw Error(`E2ERelayClientTransport: registry must be frozen before connect()`);o.clear();try{await c.connect()}catch(e){throw o.clear(),e}},disconnect:async()=>{o.clear();try{await c.disconnect()}finally{o.clear()}},send:c.send.bind(c),cancelRequest:c.cancelRequest.bind(c),onReceive:(...e)=>(a&&console.info(`[E2ERelayTransport] onReceive called, delegating to inner transport`),c.onReceive(...e)),subscribe:c.subscribe.bind(c),unsubscribe:c.unsubscribe.bind(c),getSubscriptions:c.getSubscriptions.bind(c),isReady:()=>!!t.getSessionKey()&&c.isReady()}}function Xt(){let e=!1,t=new Map,n=new Map,r=()=>{if(e)throw Error(`RelayControlRegistry is frozen and cannot be modified`)};return{registerEventSubjects(e,n){r();let i=t.get(e)??new Set;for(let e of n)i.add(e);t.set(e,i)},registerRequestNamespace(e,t){if(r(),t.length===0)throw Error(`RelayControlRegistry request namespace "${e}" requires at least one subject`);let i=n.get(e)??new Set;for(let e of t)i.add(e);n.set(e,i)},freeze(){e=!0},isFrozen(){return e},isControlEvent(e,n){return t.get(e)?.has(n)??!1},isControlRequest(e,t){return n.get(e)?.has(t)??!1}}}function Zt(e){if(Je(e),e.mode===`client`){if(e.connectionOptions!==void 0)throw Error(`createWebSocketTransport(client) does not support connectionOptions when wrapping a pre-created WebSocket. Use WebSocketClientTransport for reconnect or dial-time socket options.`);let t=e.websocket;return new D({url:`<pre-connected>`,createWebSocket:()=>t,auth:e.auth,debug:e.debug,autoReconnect:!1,heartbeat:!1})}else return new N({websocket:e.websocket,auth:e.auth,debug:e.debug})}export{Et as DispatchingAuth,wt as E2EAuth,Tt as E2ERelayAuth,Ze as HmacAuth,N as ServerTransport,D as WebSocketClientTransport,v as WebSocketConnectionError,je as clearHmacIdentitySecretsForTesting,Bt as createE2EClientTransport,Yt as createE2ERelayClientTransport,Jt as createE2ERelayCodec,Wt as createRelayControlHelpers,Xt as createRelayControlRegistry,qe as createWebSocketCloseEvent,Zt as createWebSocketTransport,vt as crypto,b as extractSocketErrorMessage,De as registerHmacIdentitySecret,A as resolveHmacIdentityAllowedSubjects,Ae as resolveHmacIdentityPeer,ke as resolveHmacIdentitySecret,Oe as rotateHmacIdentitySecret};

package/dist/package-CzKoZ1k0.mjs

@@ -0,0 +1,7 @@
+import{$ as e,A as t,B as n,D as r,G as i,H as a,I as o,J as s,K as c,L as l,M as u,N as d,O as f,P as p,Q as ee,R as te,U as ne,V as re,W as ie,X as ae,Y as oe,Z as se,_t as ce,a as le,at as ue,c as de,ct as fe,dt as pe,et as me,f as he,ft as ge,g as _e,gt as ve,h as ye,ht as be,i as xe,it as Se,j as Ce,k as m,l as we,lt as Te,m as Ee,mt as De,n as Oe,nt as ke,o as Ae,ot as je,p as Me,pt as Ne,q as Pe,r as Fe,rt as Ie,st as Le,tt as Re,u as ze,ut as Be,v as Ve,vt as h,z as g}from"./authority-state-bootstrap-7Cgb9TR2.mjs";import{a as He}from"./execution-attempt-repository-D0cCU7dI.mjs";import{assertWorkflowTriggerPayload as Ue,compileWorkflowTriggerBindingFilter as We}from"./workflow-engine/workflow-trigger-binding-consumer.mjs";import{SerialLane as Ge}from"@makaio/framework/utils";import{ArtifactSubjects as Ke,AutomationTriggerSubjects as qe,CRON_AUTOMATION_TRIGGER_KIND as Je,EXECUTION_LIST_DEFAULT_LIMIT as Ye,EXECUTION_LIST_MAX_LIMIT as _,EXECUTION_LIST_MIN_LIMIT as v,EXTERNAL_EXECUTION_ID_PREFIX as y,ExecutionAttemptSchemas as b,ExecutionAttemptSubjects as x,ExecutionsByArtifactRefsQuerySchema as Xe,JsonPatchOperationSchema as Ze,JsonValueSchema as Qe,SessionSubjects as $e,WORKFLOW_CANCELLED_REASON as et,WorkLogFrameEntrySchema as tt,WorkerSubjects as nt,WorkflowAutomationTriggerBindingSchema as rt,WorkflowError as S,WorkflowErrorCode as it,WorkflowNamespace as at,WorkflowRunContextSchema as ot,WorkflowRunResultSchema as st,WorkflowStepTypeSchema as ct,WorkflowSubjects as C,createWorkflowCancelSubject as lt,createWorkflowDelegateResultFinalizerNamespace as ut,createWorkflowFinalizerNamespace as dt,dep as ft,extensionToken as pt,serializeArtifactRef as mt,walkWorkflowDefinition as ht}from"@makaio/framework/contracts";import{BaseService as gt}from"@makaio/framework/service-base";import{defineDialectSchema as _t,executeTransaction as w,getDatabaseDialect as vt,registerDrizzleHandlers as yt,resolveSchema as T,serializeDatabaseOperation as E}from"@makaio/framework/storage/drizzle";import{and as D,asc as O,count as k,desc as A,eq as j,getTableColumns as bt,gte as xt,isNotNull as St,isNull as M,lt as Ct,lte as wt,notInArray as Tt,or as Et,sql as N,sum as P}from"drizzle-orm";import{SessionToken as Dt}from"@makaio/framework/services";import{AutomationTriggerBindingRuntimeToken as Ot}from"@makaio/framework/services/automation-trigger";const kt=ie.postgres,At=me.postgres,jt=c.postgres,Mt=ke.postgres,Nt=je.postgres,Pt=s.postgres,Ft=Se.postgres,It=De.postgres,Lt=Be.postgres,Rt=fe.postgres,zt=ge.postgres,Bt=ae.postgres,Vt=ee.postgres,Ht=ve.postgres,F=_t({workflowDefinitions:ne,workflowExecutions:e,workflowExecutionFrames:i,workflowGateInstances:Re,workflowStepSpans:ue,workflowExecutionLinks:Pe,workflowRunContexts:Ie,worklogSummaries:Ne,worklogFrameEntries:Te,worklogArtifactWrites:Le,worklogGateEvents:pe,workflowExecutionState:oe,workflowExecutionStateEvents:se,workflowFinalizations:be},{workflowDefinitions:kt,workflowExecutions:At,workflowExecutionFrames:jt,workflowGateInstances:Mt,workflowStepSpans:Nt,workflowExecutionLinks:Pt,workflowRunContexts:Ft,worklogSummaries:It,worklogFrameEntries:Lt,worklogArtifactWrites:Rt,worklogGateEvents:zt,workflowExecutionState:Bt,workflowExecutionStateEvents:Vt,workflowFinalizations:Ht});function I(e){return e.type===`global`?{scopeType:`global`,scopeKind:``,scopeId:``}:e.type===`external`?{scopeType:`external`,scopeKind:e.kind,scopeId:e.id}:{scopeType:e.type,scopeKind:``,scopeId:e.id}}function L(e){switch(e.scopeType){case`global`:return{type:`global`};case`external`:if(!e.scopeKind||!e.scopeId)throw Error(`Invalid external workflow scope row: scopeKind and scopeId are required`);return{type:`external`,kind:e.scopeKind,id:e.scopeId};case`workspace`:case`session`:if(!e.scopeId)throw Error(`Invalid ${e.scopeType} workflow scope row: scopeId is required`);return{type:e.scopeType,id:e.scopeId};default:{let t=e.scopeType;throw Error(`Unknown scope type: ${String(t)}`)}}}function Ut(e,t){let{scopeType:n,scopeKind:r,scopeId:i}=I(t);return[j(e.scopeType,n),j(e.scopeKind,r),j(e.scopeId,i)]}function R(e){return{id:e.id,name:e.name,description:e.description??void 0,root:e.root,inputSchema:e.inputSchema??void 0,configSchema:e.configSchema??void 0,outputSchema:e.outputSchema??void 0,state:e.state??void 0,artifact:e.artifact??void 0,triggers:e.triggers??void 0,scope:L(e),canvasLayout:e.canvasLayout??void 0,source:e.source??void 0,executableSource:e.executableSource??void 0,requirements:e.requirements??void 0,successFinalizerId:e.successFinalizerId??void 0}}function Wt(e,t){let n=I(e.scope);return{id:e.id,name:e.name??e.id,root:e.root,description:e.description??null,inputSchema:e.inputSchema??null,configSchema:e.configSchema??null,outputSchema:e.outputSchema??null,state:e.state??null,artifact:e.artifact??null,triggers:e.triggers??null,canvasLayout:e.canvasLayout??null,source:e.source??null,executableSource:e.executableSource??null,requirements:e.requirements??null,successFinalizerId:e.successFinalizerId??null,createdAt:t,updatedAt:t,...n}}function Gt(e,t){let{workflowDefinitions:n}=T(t,F),r=bt(n),i=e.on(a.get,async e=>{let r=await t.select().from(n).where(j(n.id,e.payload.id)).limit(1);e.setResult({workflow:r[0]?R(r[0]):null})}),o=e.on(a.set,async i=>{let a=i.payload.workflow,o=Date.now(),s=Wt(a,o),c=await E(t,async()=>{let e=await t.insert(n).values(s).onConflictDoNothing({target:n.id}).returning();if(e.length>0)return{kind:`created`,row:e[0]};let[i]=await t.update(n).set({name:s.name,root:s.root,updatedAt:o,createdAt:N`COALESCE(${r.createdAt}, ${o})`,description:s.description===null?N`${r.description}`:s.description,inputSchema:s.inputSchema===null?N`${r.inputSchema}`:s.inputSchema,configSchema:s.configSchema===null?N`${r.configSchema}`:s.configSchema,outputSchema:s.outputSchema===null?N`${r.outputSchema}`:s.outputSchema,state:s.state,artifact:s.artifact===null?N`${r.artifact}`:s.artifact,triggers:s.triggers===null?N`${r.triggers}`:s.triggers,canvasLayout:s.canvasLayout===null?N`${r.canvasLayout}`:s.canvasLayout,source:s.source===null?N`${r.source}`:s.source,executableSource:s.executableSource,requirements:s.requirements,successFinalizerId:s.successFinalizerId,...I(a.scope)}).where(j(n.id,a.id)).returning();return i?{kind:`updated`,row:i}:void 0});c&&await e.emit(c.kind===`created`?h.definition.created:h.definition.updated,R(c.row)),i.setResult({id:a.id})}),s=e.on(a.delete,async r=>{let i=(await E(t,()=>t.delete(n).where(j(n.id,r.payload.id)).returning())).length>0;i&&await e.emit(h.definition.deleted,{id:r.payload.id}),r.setResult({deleted:i})}),c=e.on(a.list,async e=>{let r=e.payload,i=r.scope?Ut(n,r.scope):[],a=i.length>0?await t.select().from(n).where(D(...i)):await t.select().from(n);e.setResult({workflows:a.map(R)})});return()=>{i(),o(),s(),c()}}function Kt(e){return{frameId:e.frameId,nodeId:e.nodeId,nodeType:e.nodeType,path:e.path,parentFrameId:e.parentFrameId??void 0,status:e.status,attempt:e.attempt,iteration:e.iteration??void 0,branchKey:e.branchKey??void 0,...e.outputPresent?{output:e.output}:{},error:e.error??void 0,startedAt:e.startedAt??void 0,completedAt:e.completedAt??void 0}}function qt(e,t){return{frameId:t.frameId,executionId:e,nodeId:t.nodeId,nodeType:t.nodeType,path:t.path,parentFrameId:t.parentFrameId??null,status:t.status,attempt:t.attempt,iteration:t.iteration??null,branchKey:t.branchKey??null,output:t.output===void 0?null:t.output,outputPresent:t.output!==void 0,error:t.error??null,startedAt:t.startedAt??null,completedAt:t.completedAt??null}}function Jt(e,t){let{workflowExecutionFrames:n}=T(t,F),r=e.on(a.setFrame,async e=>{let{executionId:r,frame:i}=e.payload;if(!g(e,r))throw Error(`Unauthorized: caller is not permitted to write frames for execution: ${r}`);let a=qt(r,i);await E(t,()=>t.insert(n).values(a).onConflictDoUpdate({target:n.frameId,set:a})),e.setResult({frameId:i.frameId})}),i=e.on(a.getFrame,async e=>{let r=await t.select().from(n).where(j(n.frameId,e.payload.frameId)).limit(1);e.setResult({frame:r[0]?Kt(r[0]):null})}),o=e.on(a.listFrames,async e=>{if(!g(e,e.payload.executionId))throw Error(`Unauthorized: caller is not permitted to list frames for execution: ${e.payload.executionId}`);let r=await t.select().from(n).where(j(n.executionId,e.payload.executionId)).orderBy(O(n.startedAt),O(n.frameId));e.setResult({frames:r.map(Kt)})});return()=>{r(),i(),o()}}function Yt(e){return`${e.executionId}:${e.nodeId}:${e.frameId}`}function z(e){return{executionId:e.executionId,nodeId:e.nodeId,frameId:e.frameId,schema:e.schema,prompt:e.prompt??void 0,status:e.status,autoAction:e.autoAction,timeoutMs:e.timeoutMs??null,...e.resumeDataPresent?{resumeData:e.resumeData}:{},...e.reason===null?{}:{reason:e.reason},createdAt:e.createdAt,resolvedAt:e.resolvedAt??void 0}}function B(e){return{id:Yt(e),executionId:e.executionId,nodeId:e.nodeId,frameId:e.frameId,schema:e.schema,prompt:e.prompt??null,status:e.status,autoAction:e.autoAction,timeoutMs:e.timeoutMs,resumeData:e.resumeData===void 0?null:e.resumeData,reason:e.reason??null,resumeDataPresent:e.resumeData!==void 0,createdAt:e.createdAt,resolvedAt:e.resolvedAt??null}}function Xt(e,t,n,r){if(e===void 0&&t===void 0)throw Error(`Either executionId or status is required to list gate instances.`);let i=n??Ye;if(!Number.isInteger(i)||i<v||i>_)throw Error(`Gate instance list limit must be an integer between ${v} and ${_}.`);return{resolvedLimit:i,predicates:[...e===void 0?[]:[j(r.executionId,e)],...t===void 0?[]:[j(r.status,t)]]}}function Zt(e,t){let{workflowExecutions:n,workflowGateInstances:r}=T(t,F),i=e.on(a.setGateInstance,async e=>{let n=e.payload.gate;if(!g(e,n.executionId))throw Error(`Unauthorized: caller is not permitted to write gates for execution: ${n.executionId}`);let i=B(n);await E(t,()=>t.insert(r).values(i).onConflictDoUpdate({target:r.id,set:i})),e.setResult({id:i.id})}),o=e.on(a.resolveWaitingGateInstance,async e=>{let n=e.payload.gate,i=B(n),a=await E(t,()=>t.update(r).set(i).where(D(j(r.id,i.id),j(r.status,`waiting`))).returning({id:r.id}));e.setResult({accepted:a.length===1})}),s=e.on(a.getGateInstance,async e=>{let{executionId:n,nodeId:i,frameId:a}=e.payload;if(!g(e,n))throw Error(`Unauthorized: caller is not permitted to read gates for execution: ${n}`);let o=[j(r.executionId,n),j(r.nodeId,i)];a!==void 0&&o.push(j(r.frameId,a));let s=await t.select().from(r).where(D(...o)).limit(1);e.setResult({gate:s[0]?z(s[0]):null})}),c=e.on(a.listGateInstances,async e=>{let{executionId:n,status:i,limit:a}=e.payload,{resolvedLimit:o,predicates:s}=Xt(n,i,a,r),c=await t.select().from(r).where(D(...s)).orderBy(A(r.createdAt),A(r.id)).limit(o);e.setResult({gates:c.map(z)})}),l=e.on(a.listPausedGateTimeouts,async e=>{let i=await t.select({gate:r}).from(r).innerJoin(n,j(r.executionId,n.id)).where(D(j(r.status,`waiting`),j(n.status,`paused`),St(r.timeoutMs)));e.setResult({gates:i.map(e=>z(e.gate))})});return()=>{i(),o(),s(),c(),l()}}function Qt(e){return{executionId:e.executionId,frameId:e.frameId,stepId:e.stepId,stepType:e.stepType,status:e.status,startedAt:e.startedAt??void 0,completedAt:e.completedAt??void 0,durationMs:e.durationMs??void 0,inputTokens:e.inputTokens??void 0,outputTokens:e.outputTokens??void 0,estimatedCost:e.estimatedCost??void 0,toolCallCount:e.toolCallCount??void 0,input:e.input??void 0,output:e.output??void 0}}function $t(e){return{sourceExecutionId:e.sourceExecutionId,targetExecutionId:e.targetExecutionId,linkType:e.linkType,metadata:e.metadata??void 0}}function en(e,t){let{workflowStepSpans:n,workflowExecutionLinks:r}=T(t,F),i=e.on(a.setSpan,async e=>{let{span:r}=e.payload;if(!g(e,r.executionId))throw Error(`Unauthorized: caller is not permitted to write spans for execution: ${r.executionId}`);await E(t,()=>t.insert(n).values(r).onConflictDoUpdate({target:[n.executionId,n.frameId],set:r})),e.setResult({id:`${r.executionId}:${r.frameId}`})}),o=e.on(a.listSpans,async e=>{let r=await t.select().from(n).where(j(n.executionId,e.payload.executionId)).orderBy(O(n.startedAt),O(n.stepId),O(n.frameId));e.setResult({spans:r.map(Qt)})}),s=e.on(a.setExecutionLink,async e=>{let{link:n}=e.payload;await E(t,()=>t.insert(r).values(n).onConflictDoUpdate({target:[r.sourceExecutionId,r.targetExecutionId],set:n})),e.setResult({id:`${n.sourceExecutionId}:${n.targetExecutionId}`})}),c=e.on(a.listExecutionLinks,async e=>{let{sourceExecutionId:n,targetExecutionId:i}=e.payload;if(n===void 0&&i===void 0)throw Error(`Either sourceExecutionId or targetExecutionId is required to list execution links.`);let a=[...n===void 0?[]:[j(r.sourceExecutionId,n)],...i===void 0?[]:[j(r.targetExecutionId,i)]],o=t.select().from(r).where(D(...a));e.setResult({links:(await o).map($t)})});return()=>{i(),o(),s(),c()}}function V(e,t){return t===null?vt(e)===`postgres`?N`'null'::jsonb`:N`'null'`:t}function tn(e){switch(e.kind){case`path`:return{sourceKind:`path`,sourcePath:e.path,sourceFilename:null,sourceCode:null};case`source`:return{sourceKind:`source`,sourcePath:null,sourceFilename:e.filename,sourceCode:e.source};case`definition`:return{sourceKind:`definition`,sourcePath:null,sourceFilename:null,sourceCode:null}}}function nn(e){switch(e.sourceKind){case`path`:if(!e.sourcePath)throw Error(`Invalid run context row: sourcePath required for kind=path`);return{kind:`path`,path:e.sourcePath};case`source`:if(!e.sourceFilename)throw Error(`Invalid run context row: sourceFilename required for kind=source`);return{kind:`source`,filename:e.sourceFilename,source:e.sourceCode??``};case`definition`:return{kind:`definition`,workflowId:e.workflowId};default:throw Error(`Unknown run context source kind: ${String(e.sourceKind)}`)}}function rn(e){return{executionId:e.executionId,workflowId:e.workflowId,coordinatorSessionId:e.coordinatorSessionId,source:nn(e),definitionSnapshot:e.definitionSnapshot??void 0,workerManifest:e.workerManifest,inputs:e.inputs,config:e.config??{},triggerPayload:e.triggerPayload,triggerMode:e.triggerMode,...e.artifactRef===null?{}:{artifactRef:e.artifactRef},scope:L(e),...e.dispatchMetadata===null?{}:{dispatchMetadata:e.dispatchMetadata},cancelSubject:e.cancelSubject,env:e.env,createdAt:e.createdAt,suspensionStrategy:e.suspensionStrategy??`wait-in-process`,...e.terminalAuthority===null?{}:{terminalAuthority:e.terminalAuthority},...e.materializationSpec===null?{}:{materializationSpec:e.materializationSpec}}}function an(e){let t=tn(e.source),n=I(e.scope);return{executionId:e.executionId,workflowId:e.workflowId,coordinatorSessionId:e.coordinatorSessionId,...t,definitionSnapshot:e.definitionSnapshot??null,workerManifest:e.workerManifest,inputs:e.inputs,config:e.config??{},triggerPayload:e.triggerPayload,triggerMode:e.triggerMode??`immediate`,artifactRef:e.artifactRef??null,dispatchMetadata:e.dispatchMetadata??null,...n,cancelSubject:e.cancelSubject,env:e.env,createdAt:e.createdAt,suspensionStrategy:e.suspensionStrategy,terminalAuthority:e.terminalAuthority??null,materializationSpec:e.materializationSpec??null}}async function on(e,t,n){let r=an(t);await e.insert(n).values(r).onConflictDoUpdate({target:n.executionId,set:r})}function sn(e,t){let{workflowRunContexts:n,workflowExecutionState:r,workflowExecutionStateEvents:i}=T(t,F),o=e.on(a.setRunContext,async e=>{let a=e.payload.runContext,o=e.payload.initialState;await w(t,async e=>{if(await on(e,a,n),o===void 0)return;let s=Date.now(),c=V(t,o);await e.insert(r).values({executionId:a.executionId,sequence:0,value:c,updatedAt:s}).onConflictDoNothing(),await e.insert(i).values({executionId:a.executionId,sequence:0,patch:[],value:c,createdAt:s}).onConflictDoNothing()}),e.setResult({executionId:a.executionId})}),s=e.on(a.getRunContext,async e=>{let{executionId:r}=e.payload,i=await t.select().from(n).where(j(n.executionId,r)),a=i[0]?rn(i[0]):null;e.setResult({runContext:a})});return()=>{o(),s()}}async function cn(e,t,n){let{workflowExecutionState:r,workflowExecutionStateEvents:i}=T(e,F),a=Date.now(),o=V(e,n);await w(e,async e=>{await e.insert(r).values({executionId:t,sequence:0,value:o,updatedAt:a}).onConflictDoNothing(),await e.insert(i).values({executionId:t,sequence:0,patch:[],value:o,createdAt:a}).onConflictDoNothing()})}async function ln(e,t){let{workflowExecutionState:n}=T(e,F),r=(await e.select().from(n).where(j(n.executionId,t)).limit(1))[0];return r?{executionId:r.executionId,sequence:r.sequence,value:r.value}:null}async function un(e,t){let{workflowExecutionState:n,workflowExecutionStateEvents:r}=T(e,F),i=Date.now(),a=V(e,t.nextValue);return w(e,async e=>{let o=(await e.select().from(n).where(j(n.executionId,t.executionId)).limit(1))[0];if(!o)throw Error(`no workflow state for execution ${t.executionId}`);if(t.expectedSequence===void 0)throw Error(`expectedSequence is required to patch workflow state`);let s=o.sequence+1,c=te(o.value,t.nextValue);if((await e.update(n).set({sequence:s,value:a,updatedAt:i}).where(D(j(n.executionId,t.executionId),j(n.sequence,t.expectedSequence))).returning()).length===0)throw Error(`state sequence conflict: expected ${String(t.expectedSequence)}, got ${String(o.sequence)}`);return await e.insert(r).values({executionId:t.executionId,sequence:s,patch:c,value:a,createdAt:i}),{executionId:t.executionId,sequence:s,patch:c,value:t.nextValue}})}function dn(e,t){let n=e.on(a.initializeState,async e=>{let{executionId:n,initialValue:r}=e.payload;await cn(t,n,r),e.setResult({})}),r=e.on(a.getState,async e=>{let{executionId:n}=e.payload,r=await ln(t,n);e.setResult({state:r})}),i=e.on(a.patchState,async e=>{let{executionId:n,expectedSequence:r,nextValue:i}=e.payload,a=await un(t,{executionId:n,expectedSequence:r,nextValue:i});e.setResult(a)});return()=>{n(),r(),i()}}function fn(e){return{executionId:e.executionId,workflowId:e.workflowId,workflowName:e.workflowName??void 0,status:e.status,startedAt:e.startedAt,completedAt:e.completedAt??void 0,durationMs:e.durationMs??void 0,totalInputTokens:e.totalInputTokens??void 0,totalOutputTokens:e.totalOutputTokens??void 0,totalEstimatedCost:e.totalEstimatedCost??void 0,error:e.error??void 0,failedNodeId:e.failedNodeId??void 0}}async function pn(e,t){let{worklogSummaries:n}=T(e,F);await e.insert(n).values(t).onConflictDoNothing()}async function mn(e,t){let{worklogSummaries:n}=T(e,F);await e.insert(n).values(t).onConflictDoUpdate({target:n.executionId,set:hn(t),setWhere:Tt(n.status,[`completed`,`failed`,`cancelled`])})}function hn(e){return{workflowId:e.workflowId,workflowName:e.workflowName,status:e.status,startedAt:e.startedAt,completedAt:e.completedAt,durationMs:e.durationMs,error:e.error,failedNodeId:e.failedNodeId}}async function H(e,t){let{worklogSummaries:n}=T(e,F),r=await e.select().from(n).where(j(n.executionId,t)).limit(1);return r[0]?fn(r[0]):null}async function gn(e,t={}){let{worklogSummaries:n}=T(e,F),{workflowId:r,status:i,limit:a=50,offset:o=0}=t,s=[...r===void 0?[]:[j(n.workflowId,r)],...i===void 0?[]:[j(n.status,i)]],c=s.length>0?D(...s):void 0,[l,u]=await Promise.all([e.select().from(n).where(c).orderBy(A(n.startedAt)).limit(a).offset(o),e.select({count:k()}).from(n).where(c)]);return{items:l.map(fn),total:u[0]?.count??0}}async function _n(e,t){let{worklogFrameEntries:n}=T(e,F);await e.insert(n).values(t).onConflictDoNothing()}async function vn(e,t){let{worklogFrameEntries:n}=T(e,F);await e.insert(n).values(t).onConflictDoUpdate({target:n.frameId,set:t,setWhere:Tt(n.status,[`completed`,`failed`,`skipped`,`cancelled`])})}async function U(e,t){let{worklogFrameEntries:n}=T(e,F);return(await e.select().from(n).where(j(n.frameId,t)).limit(1))[0]??null}async function yn(e,t){let n=await U(e,t);return n===null?null:tt.parse({executionId:n.executionId,frameId:n.frameId,nodeId:n.nodeId,nodeType:n.nodeType,path:n.path,status:n.status,attempt:n.attempt,iteration:n.iteration??void 0,branchKey:n.branchKey??void 0,startedAt:n.startedAt??void 0,completedAt:n.completedAt??void 0,durationMs:n.durationMs??void 0,inputTokens:n.inputTokens??void 0,outputTokens:n.outputTokens??void 0,estimatedCost:n.estimatedCost??void 0,error:n.error??void 0})}async function bn(e,t){let{worklogArtifactWrites:n}=T(e,F);await e.insert(n).values(t).onConflictDoUpdate({target:n.id,set:t})}function xn(e,t,n,r,i){return`${e}:${t}:${n}:${r}:${i}`}async function W(e,t){let{worklogGateEvents:n}=T(e,F);await e.insert(n).values(t).onConflictDoUpdate({target:n.id,set:t})}async function Sn(e,t){let{worklogGateEvents:n}=T(e,F);return(await e.select().from(n).where(j(n.id,t)).limit(1))[0]??null}function G(e,t,n){return`${e}:${t}:${n}`}async function Cn(e,t,n){let[r]=await e.update(t).set({totalInputTokens:t.totalInputTokens}).where(j(t.executionId,n)).returning();return r}async function wn(e,t,n){let[r]=await e.select({totalInputTokens:P(t.inputTokens),totalOutputTokens:P(t.outputTokens),totalEstimatedCost:P(t.estimatedCost),measuredInputTokens:k(t.inputTokens),measuredOutputTokens:k(t.outputTokens),measuredCosts:k(t.estimatedCost)}).from(t).where(j(t.executionId,n));return{totalInputTokens:Number(r?.totalInputTokens??0),totalOutputTokens:Number(r?.totalOutputTokens??0),totalEstimatedCost:Number(r?.totalEstimatedCost??0),hasMeasurements:Number(r?.measuredInputTokens??0)>0||Number(r?.measuredOutputTokens??0)>0||Number(r?.measuredCosts??0)>0}}function Tn(e){return e.hasMeasurements}async function En(e,t,n,r){await e.update(t).set({totalInputTokens:r.totalInputTokens,totalOutputTokens:r.totalOutputTokens,totalEstimatedCost:r.totalEstimatedCost}).where(j(t.executionId,n))}async function Dn(e,t,n,r){let i=N`coalesce((select sum(${n.inputTokens}) from ${n} where ${n.executionId} = ${r}), 0)`,a=N`coalesce((select sum(${n.outputTokens}) from ${n} where ${n.executionId} = ${r}), 0)`,o=N`coalesce((select sum(${n.estimatedCost}) from ${n} where ${n.executionId} = ${r}), 0)`,s=N`exists(
+    select 1 from ${n}
+    where ${n.executionId} = ${r}
+      and (${n.inputTokens} is not null
+        or ${n.outputTokens} is not null
+        or ${n.estimatedCost} is not null)
+  )`;await e.update(t).set({totalInputTokens:i,totalOutputTokens:a,totalEstimatedCost:o}).where(D(j(t.executionId,r),s))}async function On(e,t){let{worklogSummaries:n,worklogFrameEntries:r}=T(e,F);if(vt(e)===`sqlite`){await Dn(e,n,r,t);return}await w(e,async e=>{if(await Cn(e,n,t)===void 0)return;let i=await wn(e,r,t);Tn(i)&&await En(e,n,t,i)})}async function kn(e,t={}){let{worklogSummaries:n}=T(e,F),{workflowId:r,since:i,until:a}=t,o=[...r===void 0?[]:[j(n.workflowId,r)],...i===void 0?[]:[xt(n.startedAt,i)],...a===void 0?[]:[wt(n.startedAt,a)]],s=o.length>0?D(...o):void 0,[c,l]=await Promise.all([e.select({status:n.status,count:k()}).from(n).where(s).groupBy(n.status),e.select({totalDurationMs:P(n.durationMs),totalInputTokens:P(n.totalInputTokens),totalOutputTokens:P(n.totalOutputTokens),totalEstimatedCost:P(n.totalEstimatedCost)}).from(n).where(s)]),u={pending:0,running:0,paused:0,finalizing:0,completed:0,failed:0,cancelled:0},d=0;for(let e of c)u[e.status]=e.count,d+=e.count;let f=l[0];return{total:d,byStatus:u,totalDurationMs:Number(f?.totalDurationMs??0),totalInputTokens:Number(f?.totalInputTokens??0),totalOutputTokens:Number(f?.totalOutputTokens??0),totalEstimatedCost:Number(f?.totalEstimatedCost??0)}}async function An(e,t,n,r,i){let a=await U(t,n);if(a===null||i===void 0)return null;let o=await e.requestOptional(Ke.resolve,{ref:{refClass:`artifact`,kind:r.kind,id:r.id,revision:i}}).catch(()=>void 0);if(o===void 0||!o.handled||o.data.artifact===null)return null;let{kind:s,schemaVersion:c,scope:l}=o.data.artifact;return{nodeId:a.nodeId,artifact:{kind:s,schemaVersion:c,scope:l}}}async function K(e,t){try{await t()}catch(t){console.error(`[WorklogProjection] Write failed (${e}):`,t)}}async function q(e,t){try{await e.emit(h.worklog.changed,{executionId:t})}catch(e){console.error(`[WorklogProjection] worklog.changed emit failed for ${t}:`,e)}}const jn=new Set([`completed`,`failed`,`cancelled`]);function Mn(e){return jn.has(e)}async function Nn(e,t){return await pn(e,{executionId:t.executionId,workflowId:t.workflowId,workflowName:null,status:`running`,startedAt:t.startedAt??Date.now(),completedAt:null,durationMs:null,totalInputTokens:null,totalOutputTokens:null,totalEstimatedCost:null,error:null,failedNodeId:null}),!0}async function Pn(e,t){let n=t.completedAt??Date.now(),r=await H(e,t.executionId);return r!==null&&Mn(r.status)?!1:(await mn(e,{executionId:t.executionId,workflowId:r?.workflowId??t.executionId,workflowName:r?.workflowName??null,status:`completed`,startedAt:r?.startedAt??n-t.totalDuration,completedAt:n,durationMs:t.totalDuration,totalInputTokens:r?.totalInputTokens??null,totalOutputTokens:r?.totalOutputTokens??null,totalEstimatedCost:r?.totalEstimatedCost??null,error:null,failedNodeId:null}),!0)}async function Fn(e,t,n,r,i,a){let o=await H(e,t);if(o!==null&&Mn(o.status))return!1;let s=o?.startedAt??a;return await mn(e,{executionId:t,workflowId:o?.workflowId??t,workflowName:o?.workflowName??null,status:n,startedAt:s,completedAt:a,durationMs:a-s,totalInputTokens:o?.totalInputTokens??null,totalOutputTokens:o?.totalOutputTokens??null,totalEstimatedCost:o?.totalEstimatedCost??null,error:r,failedNodeId:i}),!0}function In(e,t){return[e.on(h.execution.started,async n=>{let{executionId:r}=n.payload;await K(`execution.started[${r}]`,async()=>{await E(t,()=>Nn(t,n.payload))&&await q(e,r)})}),e.on(h.execution.completed,async n=>{let{executionId:r}=n.payload;await K(`execution.completed[${r}]`,async()=>{await E(t,()=>Pn(t,n.payload))&&await q(e,r)})}),e.on(h.execution.failed,async n=>{let{executionId:r,error:i,failedStepId:a}=n.payload,o=n.payload.completedAt??Date.now();await K(`execution.failed[${r}]`,async()=>{await E(t,()=>Fn(t,r,`failed`,i,a??null,o))&&await q(e,r)})}),e.on(h.execution.cancelled,async n=>{let{executionId:r}=n.payload,i=n.payload.completedAt??Date.now();await K(`execution.cancelled[${r}]`,async()=>{await E(t,()=>Fn(t,r,`cancelled`,null,null,i))&&await q(e,r)})})]}const Ln=new Set([`completed`,`failed`,`skipped`,`cancelled`]);function Rn(e){return Ln.has(e)}function zn(e,t,n){return e===null?{nodeId:t,nodeType:`station`,path:[],attempt:0,iteration:null,branchKey:null,startedAt:n,inputTokens:null,outputTokens:null,estimatedCost:null}:{nodeId:e.nodeId,nodeType:e.nodeType,path:e.path,attempt:e.attempt,iteration:e.iteration,branchKey:e.branchKey,startedAt:e.startedAt,inputTokens:e.inputTokens,outputTokens:e.outputTokens,estimatedCost:e.estimatedCost}}async function Bn(e,t,n,r,i,a,o){let s=o??Date.now(),c=await U(t,r);c!==null&&Rn(c.status)||(await vn(t,{frameId:r,executionId:n,...zn(c,i,a===void 0?null:s-a),status:`completed`,completedAt:s,durationMs:a??null,error:null}),await On(t,n),await q(e,n))}async function Vn(e,t,n,r,i,a,o,s){let c=s??Date.now(),l=await U(t,r);l!==null&&Rn(l.status)||(await vn(t,{frameId:r,executionId:n,...zn(l,i,o===void 0?null:c-o),status:`failed`,completedAt:c,durationMs:o??null,error:a}),await q(e,n))}function Hn(e,t){return[e.on(h.frame.started,async n=>{let{executionId:r,frameId:i,nodeId:a,nodeType:o,path:s,startedAt:c}=n.payload;await K(`frame.started[${i}]`,async()=>{await _n(t,{frameId:i,executionId:r,nodeId:a,nodeType:o,path:s,status:`running`,attempt:0,iteration:null,branchKey:null,startedAt:c??Date.now(),completedAt:null,durationMs:null,inputTokens:null,outputTokens:null,estimatedCost:null,error:null}),await q(e,r)})}),e.on(h.frame.completed,async n=>{let{executionId:r,frameId:i,nodeId:a,duration:o,completedAt:s}=n.payload;await K(`frame.completed[${i}]`,()=>Bn(e,t,r,i,a,o,s))}),e.on(h.frame.failed,async n=>{let{executionId:r,frameId:i,nodeId:a,error:o,duration:s,completedAt:c}=n.payload;await K(`frame.failed[${i}]`,()=>Vn(e,t,r,i,a,o,s,c))})]}const Un={user:`rejected`,timeout:`timed-out`,cancelled:`cancelled`};function Wn(e,t){return[e.on(h.gate.suspended,async n=>{let{executionId:r,frameId:i,nodeId:a,prompt:o}=n.payload;await K(`gate.suspended[${i}]`,async()=>{await W(t,{id:G(r,a,i),executionId:r,nodeId:a,frameId:i,status:`waiting`,prompt:o??null,openedAt:Date.now(),resolvedAt:null,resumeData:null}),await q(e,r)})}),e.on(h.gate.resumed,async n=>{let{executionId:r,frameId:i,nodeId:a,resumeData:o}=n.payload;await K(`gate.resumed[${i}]`,async()=>{let n=G(r,a,i),s=await Sn(t,n),c=Date.now();await W(t,{id:n,executionId:r,nodeId:a,frameId:i,status:`resumed`,prompt:s?.prompt??null,openedAt:s?.openedAt??c,resolvedAt:c,resumeData:o}),await q(e,r)})}),e.on(h.gate.resolved,async n=>Gn(n.payload,e,t)),e.on(h.artifact.updated,async n=>{let{executionId:r,frameId:i,artifactRef:a,revision:o}=n.payload;await K(`artifact.updated[${r}:${i}]`,async()=>{let n=await An(e,t,i,a,o);if(n===null)return;let s=Date.now();await bn(t,{id:xn(r,i,a.kind,a.id,s),executionId:r,frameId:i,nodeId:n.nodeId,artifact:n.artifact,revision:o??null,writtenAt:s}),await q(e,r)})})]}async function Gn(e,t,n){let{executionId:r,frameId:i,stepId:a,source:o}=e;o===`user`&&e.action===`approve`||await K(`gate.resolved[${i}]`,async()=>{let s=G(r,a,i),c=await Sn(n,s),l=Date.now();await W(n,{id:s,executionId:r,nodeId:a,frameId:i,status:o!==`cancelled`&&e.action===`approve`?`resumed`:Un[o],prompt:c?.prompt??null,openedAt:c?.openedAt??l,resolvedAt:l,resumeData:c?.resumeData??null}),await q(t,r)})}function Kn(e,t){let n=[...In(e,t),...Hn(e,t),...Wn(e,t),e.on(h.worklog.get,async e=>{let{executionId:n}=e.payload,r=await H(t,n);e.setResult({summary:r})}),e.on(h.worklog.frame.get,async e=>{let{frameId:n}=e.payload,r=await yn(t,n);e.setResult({frame:r})}),e.on(h.worklog.list,async e=>{let{workflowId:n,status:r,limit:i,offset:a}=e.payload,o=await gn(t,{workflowId:n,status:r,limit:i,offset:a});e.setResult(o)}),e.on(h.worklog.stats,async e=>{let{workflowId:n,since:r,until:i}=e.payload,a=await kn(t,{workflowId:n,since:r,until:i});e.setResult({stats:a})})];return()=>{for(let e of n)e()}}function J(e,t){if(Object.is(e,t))return!0;if(Array.isArray(e)||Array.isArray(t))return Array.isArray(e)&&Array.isArray(t)&&e.length===t.length&&e.every((e,n)=>J(e,t[n]));if(e===null||t===null||typeof e!=`object`||typeof t!=`object`)return!1;let n=e,r=t,i=Object.keys(n).sort(),a=Object.keys(r).sort();return i.length===a.length&&i.every((e,t)=>e===a[t]&&J(n[e],r[e]))}function qn(e){return{executionId:e.executionId,frameId:e.frameId,nodeId:e.nodeId,nodeType:e.nodeType,path:e.path,status:e.status,attempt:e.attempt,iteration:e.iteration??null,branchKey:e.branchKey??null,startedAt:e.startedAt??null,completedAt:e.completedAt??null,durationMs:e.durationMs??null,inputTokens:e.inputTokens??null,outputTokens:e.outputTokens??null,estimatedCost:e.estimatedCost??null,error:e.error??null}}function Jn(e,t){let n=e.frame;if(n!==void 0){let r=e.status===`failed`?e.error??null:null;if(n.executionId!==e.executionId)throw Error(`settleExternalExecution requires frame.executionId to match executionId`);if(n.status!==e.status)throw Error(`settleExternalExecution requires frame.status to match status`);if(n.completedAt!==t)throw Error(`settleExternalExecution requires frame.completedAt to match completedAt`);if(n.durationMs!==t-n.startedAt)throw Error(`settleExternalExecution requires frame.durationMs to match its timestamps`);if((n.error??null)!==r)throw Error(`settleExternalExecution requires frame.error to match terminal error metadata`)}return JSON.stringify({version:1,status:e.status,completedAt:t,error:e.status===`failed`?e.error??null:null,reason:e.status===`cancelled`?e.reason??null:null,frame:n===void 0?null:{executionId:n.executionId,frameId:n.frameId,nodeId:n.nodeId,nodeType:n.nodeType,path:n.path,status:n.status,attempt:n.attempt,iteration:n.iteration??null,branchKey:n.branchKey??null,startedAt:n.startedAt,completedAt:n.completedAt,durationMs:n.durationMs,error:n.status===`failed`?n.error??null:null}})}function Yn(e,t,n){if(e!==t)throw Error(`settleExternalExecution: execution "${n}" conflicts with an existing terminal settlement fingerprint`)}async function Xn(e,t,n,r,i){let a=Jn(r,i);if(n.externalSettlementFingerprint!==null){Yn(n.externalSettlementFingerprint,a,r.executionId);return}if(r.frame!==void 0)throw Error(`settleExternalExecution: frame presence conflicts with the legacy frame-less settlement for execution "${r.executionId}"`);let o=r.status===`failed`?r.error??null:null,s=r.status===`cancelled`?r.reason??null:null;if((await e.update(t).set({externalSettlementFingerprint:a}).where(D(j(t.id,r.executionId),M(t.externalSettlementFingerprint),j(t.status,r.status),j(t.completedAt,i),o===null?M(t.error):j(t.error,o),s===null?M(t.reason):j(t.reason,s))).returning({fingerprint:t.externalSettlementFingerprint})).length>0)return;let[c]=await e.select().from(t).where(j(t.id,r.executionId)).limit(1);if(c===void 0)throw Error(`settleExternalExecution: execution "${r.executionId}" disappeared`);if(Y(c,r,i),c.externalSettlementFingerprint===null)throw Error(`settleExternalExecution: failed to adopt terminal settlement fingerprint for execution "${r.executionId}"`);Yn(c.externalSettlementFingerprint,a,r.executionId)}function Zn(e,t){if(e.executionId!==t.executionId||e.nodeId!==t.nodeId||e.nodeType!==t.nodeType||!J(e.path,t.path)||e.attempt!==t.attempt||e.iteration!==(t.iteration??null)||e.branchKey!==(t.branchKey??null)||e.startedAt!==t.startedAt)throw Error(`settleExternalExecution: frame "${t.frameId}" conflicts with its registered metadata`)}function Y(e,t,n){let r=t.status===`failed`?t.error??null:null,i=t.status===`cancelled`?t.reason??null:null;if(e.status!==t.status||e.completedAt!==n||e.error!==r||e.reason!==i)throw e.status===t.status?Error(`settleExternalExecution: execution "${t.executionId}" conflicts with an existing terminal settlement`):Error(`settleExternalExecution: execution "${t.executionId}" cannot transition from status "${e.status}"`)}async function Qn(e,t,n){let r=await e.select().from(t).where(j(t.executionId,n.executionId)),i=r.find(e=>e.frameId===n.frame.frameId);if(i!==void 0)return i;if(r.length>0)throw Error(`settleExternalExecution: frame "${n.frame.frameId}" conflicts with the registered frame identity`);let[a]=await e.select().from(t).where(j(t.frameId,n.frame.frameId)).limit(1);if(a!==void 0)throw Error(`settleExternalExecution: frame "${n.frame.frameId}" belongs to another execution`)}function $n(e,t,n,r){let i=Math.min(e.startedAt,r);return{executionId:e.id,workflowId:e.workflowId,workflowName:t?.workflowName??null,status:n.status,startedAt:i,completedAt:r,durationMs:r-i,totalInputTokens:t?.totalInputTokens??null,totalOutputTokens:t?.totalOutputTokens??null,totalEstimatedCost:t?.totalEstimatedCost??null,error:n.status===`failed`?n.error??null:null,failedNodeId:n.status===`failed`?n.frame?.nodeId??t?.failedNodeId??null:null}}function er(e,t){return qn({...e,inputTokens:e.inputTokens??t?.inputTokens??void 0,outputTokens:e.outputTokens??t?.outputTokens??void 0,estimatedCost:e.estimatedCost??t?.estimatedCost??void 0})}function tr(e,t){if(e.externalRegistrationFrameId!==(t.externalRegistrationFrameId??null))throw Error(`setExternalExecutionStart: frame metadata conflicts for execution "${t.id}"`);if(!(e.id===t.id&&e.workflowId===t.workflowId&&e.coordinatorSessionId===t.coordinatorSessionId&&e.startedAt===t.startedAt&&e.scopeType===t.scopeType&&e.scopeKind===t.scopeKind&&e.scopeId===t.scopeId&&e.artifactKind===t.artifactKind&&e.artifactId===t.artifactId&&J(e.inputs,t.inputs)&&J(e.triggerPayload,t.triggerPayload)))throw Error(`setExternalExecutionStart: registration conflicts for execution "${t.id}"`)}function nr(e,t){if(e.workflowId!==t.workflowId||e.startedAt!==t.startedAt||e.executionId!==t.executionId)throw Error(`setExternalExecutionStart: WorkLog summary conflicts for execution "${t.executionId}"`)}function rr(e,t){if(e.executionId!==t.executionId||e.frameId!==t.frameId||e.nodeId!==t.nodeId||e.nodeType!==t.nodeType||!J(e.path,t.path)||e.attempt!==t.attempt||e.iteration!==(t.iteration??null)||e.branchKey!==(t.branchKey??null)||e.startedAt!==t.startedAt)throw Error(`setExternalExecutionStart: WorkLog frame conflicts for frame "${t.frameId}"`)}async function ir(e,t,n,r){if(!t.id.startsWith(y))throw Error(`setExternalExecutionStart: execution "${t.id}" is not an external execution ID`);if(n!==void 0&&n.executionId!==t.id)throw Error(`setExternalExecutionStart requires frame.executionId to match execution.id`);let{workflowExecutions:i,worklogSummaries:a,worklogFrameEntries:o}=T(e,F),s={...r(t),externalRegistrationFrameId:n?.frameId??null},c={executionId:t.id,workflowId:t.workflowId,workflowName:null,status:`running`,startedAt:t.startedAt,completedAt:null,durationMs:null,totalInputTokens:null,totalOutputTokens:null,totalEstimatedCost:null,error:null,failedNodeId:null};await w(e,async e=>{let r=(await e.insert(i).values(s).onConflictDoNothing().returning({id:i.id})).length===0;if(r){let[n]=await e.select().from(i).where(j(i.id,t.id)).limit(1);if(n===void 0)throw Error(`setExternalExecutionStart: execution "${t.id}" disappeared`);tr(n,s)}let[l]=await e.select().from(a).where(j(a.executionId,t.id)).limit(1);if(l===void 0?await e.insert(a).values(c):nr(l,c),n!==void 0){let[i]=await e.select().from(o).where(j(o.frameId,n.frameId)).limit(1);if(i===void 0){if(r)throw Error(`setExternalExecutionStart: frame metadata conflicts for execution "${t.id}"`);await e.insert(o).values(qn(n))}else rr(i,n)}})}async function ar(e,t,n,r,i){if(r.frame!==void 0){let n=await Qn(e,t,r);return n!==void 0&&Zn(n,r.frame),{frame:r.frame,existing:n}}if(n.externalRegistrationFrameId===null)return;let[a]=await e.select().from(t).where(j(t.frameId,n.externalRegistrationFrameId)).limit(1);if(a===void 0||a.executionId!==n.id)throw Error(`settleExternalExecution: registered frame "${n.externalRegistrationFrameId}" is unavailable for execution "${n.id}"`);if(a.startedAt===null)throw Error(`settleExternalExecution: registered frame "${a.frameId}" has no start timestamp`);if(i<a.startedAt)throw Error(`settleExternalExecution: completedAt must not precede the registered frame start timestamp`);let o=ct.parse(a.nodeType);return{frame:{executionId:a.executionId,frameId:a.frameId,nodeId:a.nodeId,nodeType:o,path:a.path,status:r.status,attempt:a.attempt,...a.iteration===null?{}:{iteration:a.iteration},...a.branchKey===null?{}:{branchKey:a.branchKey},startedAt:a.startedAt,completedAt:i,durationMs:i-a.startedAt,...r.status===`failed`&&r.error!==void 0?{error:r.error}:{}},existing:a}}async function or(e,t,n,r,i){let{worklogSummaries:a,worklogFrameEntries:o}=t,s=await Cn(e,a,n.id),c=await ar(e,o,n,r,i),l=c===void 0?r:{...r,frame:c.frame};if(c!==void 0){let t=er(c.frame,c.existing);await e.insert(o).values(t).onConflictDoUpdate({target:o.frameId,set:t})}let u=await wn(e,o,n.id),d=Tn(u),f={totalInputTokens:u.totalInputTokens,totalOutputTokens:u.totalOutputTokens,totalEstimatedCost:u.totalEstimatedCost},p={...$n(n,s,l,i),...d?f:{}};await e.insert(a).values(p).onConflictDoUpdate({target:a.executionId,set:hn(p)}),d&&await En(e,a,n.id,u)}async function sr(e,t){if(!t.executionId.startsWith(y))throw Error(`settleExternalExecution: execution "${t.executionId}" is engine-owned and must use the engine finalizer`);if(t.frame!==void 0&&t.frame.executionId!==t.executionId)throw Error(`settleExternalExecution requires frame.executionId to match executionId`);let{workflowExecutions:n,worklogSummaries:r,worklogFrameEntries:i}=T(e,F);return w(e,async e=>{let[a]=await e.select().from(n).where(j(n.id,t.executionId)).limit(1);if(a===void 0)throw Error(`settleExternalExecution: execution "${t.executionId}" was not registered`);let o=t.completedAt??a.completedAt??Date.now();if(a.status===`running`){let r=Jn(t,o);if((await e.update(n).set({status:t.status,completedAt:o,error:t.status===`failed`?t.error??null:null,reason:t.status===`cancelled`?t.reason??null:null,externalSettlementFingerprint:r}).where(D(j(n.id,t.executionId),j(n.status,`running`),M(n.externalSettlementFingerprint))).returning({id:n.id})).length===0){let[r]=await e.select().from(n).where(j(n.id,t.executionId)).limit(1);if(r===void 0)throw Error(`settleExternalExecution: execution "${t.executionId}" disappeared`);t.completedAt===void 0&&r.completedAt!==null&&(o=r.completedAt),Y(r,t,o),await Xn(e,n,r,t,o)}}else Y(a,t,o),await Xn(e,n,a,t,o);return await or(e,{worklogSummaries:r,worklogFrameEntries:i},a,t,o),!0})}function cr(e,t,n){let r=e.on(a.setExternalExecutionStart,async r=>{let i=r.payload.execution,a=r.payload.frame;await ir(t,i,a,n),await q(e,i.id),r.setResult({executionId:i.id,...a===void 0?{}:{frameId:a.frameId}})}),i=e.on(a.settleExternalExecution,async n=>{let r=await sr(t,n.payload);await q(e,n.payload.executionId),n.setResult({success:r})});return()=>{r(),i()}}function X(e){return{executionId:e.executionId,workflowId:e.workflowId,finalizerId:e.finalizerId,transitionKey:e.transitionKey,claimToken:e.claimToken,intent:e.intent,claimedAt:e.claimedAt}}function lr(e,t){return e.state===`claimed`&&e.executionId===t.executionId&&e.workflowId===t.workflowId&&e.finalizerId===t.finalizerId&&e.transitionKey===t.transitionKey&&e.claimToken===t.claimToken&&e.intent.status===t.intent.status&&e.intent.completedAt===t.intent.completedAt&&e.intent.error===t.intent.error&&e.intent.reason===t.intent.reason}function ur(e,t){if(e.executionId!==t.executionId||e.workflowId!==t.workflowId||e.finalizerId!==t.finalizerId||e.transitionKey!==t.transitionKey||e.claimToken!==t.claimToken)throw Error(`workflow finalization publication claim does not match durable transition ${t.executionId}`)}async function dr(e,t){let{workflowExecutions:n,workflowFinalizations:r}=T(e,F);return w(e,async e=>{let i=await e.select().from(r).where(j(r.executionId,t.executionId)).limit(1);return i[0]?lr(i[0],t):(await e.update(n).set({status:`finalizing`}).where(D(j(n.id,t.executionId),j(n.workflowId,t.workflowId),j(n.status,`running`))).returning({id:n.id})).length===0?!1:(await e.insert(r).values({...t,state:`claimed`}),!0)})}function fr(e){return{status:e.status,completedAt:e.completedAt,error:e.status===`failed`?e.error??`Workflow finalization failed`:null,reason:e.status===`cancelled`?e.reason??null:null}}async function pr(e,t,n,r){let{workflowExecutions:i,workflowFinalizations:a}=T(e,F);return w(e,async e=>{let o=(await e.select().from(a).where(j(a.executionId,t)).limit(1))[0];return!o||o.claimToken!==n||o.state===`failed`?!1:o.state===`acknowledged`?!0:(await e.update(i).set(fr(o.intent)).where(D(j(i.id,t),j(i.status,`finalizing`))).returning({id:i.id})).length===0?!1:(await e.update(a).set({state:`acknowledged`,settledAt:r}).where(D(j(a.executionId,t),j(a.claimToken,n),j(a.state,`claimed`))),!0)})}async function mr(e,t,n,r,i){let{workflowExecutions:a,workflowFinalizations:o}=T(e,F);return w(e,async e=>{let s=(await e.select().from(o).where(j(o.executionId,t)).limit(1))[0];return!s||s.claimToken!==n||s.state===`acknowledged`?!1:s.state===`failed`?!0:(await e.update(a).set({status:`failed`,error:r,reason:null,completedAt:i}).where(D(j(a.id,t),j(a.status,`finalizing`))).returning({id:a.id})).length===0?!1:(await e.update(o).set({state:`failed`,failure:r,settledAt:i}).where(D(j(o.executionId,t),j(o.claimToken,n),j(o.state,`claimed`))),!0)})}async function hr(e,t,n){let{workflowExecutions:r,workflowFinalizations:i}=T(t,F),a=(await t.select().from(i).where(j(i.executionId,n.executionId)).limit(1))[0];if(!a||(ur(a,n),a.state===`claimed`||a.publishedAt!==null))return;let o=(await t.select({startedAt:r.startedAt,status:r.status,error:r.error,reason:r.reason,completedAt:r.completedAt}).from(r).where(j(r.id,a.executionId)).limit(1))[0];if(!(!o||o.completedAt==null)){if(o.status===`completed`)await e.emit(h.execution.completed,{executionId:a.executionId,workflowId:a.workflowId,totalDuration:o.completedAt-o.startedAt,completedAt:o.completedAt,transitionKey:a.transitionKey});else if(o.status===`failed`)await e.emit(h.execution.failed,{executionId:a.executionId,workflowId:a.workflowId,error:o.error??`Workflow finalization failed`,completedAt:o.completedAt,transitionKey:a.transitionKey});else if(o.status===`cancelled`)await e.emit(h.execution.cancelled,{executionId:a.executionId,workflowId:a.workflowId,reason:o.reason??void 0,completedAt:o.completedAt,transitionKey:a.transitionKey});else return;await E(t,()=>t.update(i).set({publishedAt:Date.now()}).where(D(j(i.executionId,a.executionId),M(i.publishedAt))))}}function gr(e,t){let n=new Map;return async r=>{let i=(n.get(r.executionId)??Promise.resolve()).catch(()=>void 0).then(()=>hr(e,t,r));n.set(r.executionId,i);try{await i}finally{n.get(r.executionId)===i&&n.delete(r.executionId)}}}function _r(e,t){let n=gr(e,t),r=e.on(a.claimFinalization,async e=>{e.setResult({claimed:await dr(t,e.payload.claim)})}),i=e.on(a.listClaimedFinalizations,async e=>{let{workflowFinalizations:n}=T(t,F),r=await t.select().from(n).where(D(j(n.finalizerId,e.payload.finalizerId),j(n.state,`claimed`)));e.setResult({claims:r.map(X)})}),o=e.on(a.listUnpublishedFinalizations,async e=>{let{workflowFinalizations:n}=T(t,F),r=await t.select().from(n).where(D(Et(j(n.state,`acknowledged`),j(n.state,`failed`)),j(n.finalizerId,e.payload.finalizerId),M(n.publishedAt)));e.setResult({claims:r.map(X)})}),s=e.on(a.publishFinalization,async e=>{await n(e.payload.claim),e.setResult({})}),c=e.on(a.acknowledgeFinalization,async e=>{let{executionId:r,claimToken:i,settledAt:a}=e.payload,o=await pr(t,r,i,a);if(e.setResult({acknowledged:o}),!o)return;let{workflowFinalizations:s}=T(t,F),c=await t.select().from(s).where(j(s.executionId,r)).limit(1);c[0]&&await n(X(c[0]))}),l=e.on(a.failFinalization,async e=>{let{executionId:r,claimToken:i,error:a,settledAt:o}=e.payload,s=await mr(t,r,i,a,o);if(e.setResult({failed:s}),!s)return;let{workflowFinalizations:c}=T(t,F),l=await t.select().from(c).where(j(c.executionId,r)).limit(1);l[0]&&await n(X(l[0]))});return()=>{r(),i(),o(),s(),c(),l()}}function vr(e){return{id:e.id,workflowId:e.workflowId,coordinatorSessionId:e.coordinatorSessionId??void 0,status:e.status,inputs:e.inputs,config:{},error:e.error??void 0,reason:e.reason??void 0,startedAt:e.startedAt,completedAt:e.completedAt??void 0,triggerPayload:e.triggerPayload??void 0,...e.artifactKind!==null&&e.artifactId!==null?{artifactRef:{kind:e.artifactKind,id:e.artifactId}}:{},scope:L(e)}}function Z(e){let t=I(e.scope);return{id:e.id,workflowId:e.workflowId,coordinatorSessionId:e.coordinatorSessionId??null,status:e.status,inputs:e.inputs,error:e.error??null,reason:e.reason??null,startedAt:e.startedAt,completedAt:e.completedAt??null,triggerPayload:e.triggerPayload??null,artifactKind:e.artifactRef?.kind??null,artifactId:e.artifactRef?.id??null,...t}}function yr(e,t,n,r,i,a){let o=[...e?[j(a.workflowId,e)]:[],...n?[j(a.status,n)]:[],...i===void 0?[]:[j(a.artifactKind,i.kind),j(a.artifactId,i.id)]];if(t&&o.push(...Ut(a,t)),r){let e=Et(Ct(a.startedAt,r.startedAt),D(j(a.startedAt,r.startedAt),Ct(a.id,r.id)));e&&o.push(e)}return o}async function br(e,t,n,r,i){if(n.executionId!==t.id)throw Error(`setExecutionStart requires execution.id to match runContext.executionId`);for(let e of i??[])if(e.targetExecutionId!==t.id)throw Error(`setExecutionStart requires executionLinks.targetExecutionId to match execution.id`);let{workflowExecutions:a,workflowRunContexts:o,workflowExecutionState:s,workflowExecutionStateEvents:c,workflowExecutionLinks:l}=T(e,F),u=Z(t);await w(e,async d=>{await d.insert(a).values(u).onConflictDoUpdate({target:a.id,set:u});let f=(n.dispatchMetadata===void 0?await d.select({dispatchMetadata:o.dispatchMetadata}).from(o).where(j(o.executionId,n.executionId)).limit(1):[])[0]?.dispatchMetadata;if(await on(d,n.dispatchMetadata===void 0&&f!=null?{...n,dispatchMetadata:f}:n,o),r!==void 0){let n=Date.now(),i=V(e,r);await d.insert(s).values({executionId:t.id,sequence:0,value:i,updatedAt:n}).onConflictDoNothing(),await d.insert(c).values({executionId:t.id,sequence:0,patch:[],value:i,createdAt:n}).onConflictDoNothing()}for(let e of i??[])await d.insert(l).values(e).onConflictDoUpdate({target:[l.sourceExecutionId,l.targetExecutionId],set:e})})}async function xr(e,t,n){if(n.executionId!==t.id)throw Error(`restorePausedGateResumeState requires execution.id to match gate.executionId`);if(t.status!==`paused`||n.status!==`waiting`)throw Error(`restorePausedGateResumeState requires a paused execution and waiting gate`);let{workflowExecutions:r,workflowGateInstances:i}=T(e,F),a=Z(t),o=B(n);await w(e,async e=>{await e.insert(r).values(a).onConflictDoUpdate({target:r.id,set:a}),await e.insert(i).values(o).onConflictDoUpdate({target:i.id,set:o})})}async function Sr(e,t,n,r){let{workflowExecutions:i,workflowGateInstances:a}=T(e,F);return w(e,async e=>{if((await e.select().from(i).where(j(i.id,t)).limit(1))[0]?.status!==`paused`)return{cancelled:!1,gates:[]};let o=(await e.select().from(a).where(D(j(a.executionId,t),j(a.status,`waiting`)))).map(e=>({...z(e),status:`cancelled`,resolvedAt:n}));await e.update(i).set({status:`cancelled`,completedAt:n,reason:r??null}).where(j(i.id,t));for(let t of o){let n=B(t);await e.update(a).set(n).where(j(a.id,n.id))}return{cancelled:!0,gates:o}})}async function Cr(e,t,n,r,i,a){let{workflowExecutions:o}=T(e,F);return w(e,async e=>{if((await e.select({id:o.id}).from(o).where(j(o.id,t)).limit(1))[0]===void 0)return!1;let s={};return n!==void 0&&(s.status=n),r!==void 0&&(s.error=r),i!==void 0&&(s.reason=i),a!==void 0&&(s.completedAt=a),Object.keys(s).length>0&&await e.update(o).set(s).where(j(o.id,t)),!0})}function wr(e,t){let{workflowExecutions:n}=T(t,F),r=e.on(a.getExecution,async e=>{let{executionId:r}=e.payload;if(!g(e,r))throw Error(`Unauthorized execution read: ${r}`);let i=await t.select().from(n).where(j(n.id,r));e.setResult({execution:i[0]?vr(i[0]):null})}),i=e.on(a.setExecution,async e=>{let r=e.payload.execution,i=Z(r);await E(t,()=>t.insert(n).values(i).onConflictDoUpdate({target:n.id,set:i})),e.setResult({id:r.id})}),o=e.on(a.setExecutionStart,async e=>{let n=e.payload.execution,r=e.payload.runContext;await br(t,n,r,e.payload.initialState,e.payload.executionLinks),e.setResult({id:n.id,executionId:n.id})}),s=e.on(a.restorePausedGateResumeState,async e=>{let n=e.payload.execution,r=e.payload.gate;await xr(t,n,r),e.setResult({executionId:n.id,gateId:r.nodeId})}),c=e.on(a.updateExecution,async e=>{let{executionId:n,status:r,error:i,reason:a,completedAt:o}=e.payload,s=await Cr(t,n,r,i,a,o);e.setResult({success:s})}),l=e.on(a.pauseRunningExecution,async e=>{let{workflowExecutions:n}=T(t,F),r=await E(t,()=>t.update(n).set({status:`paused`}).where(D(j(n.id,e.payload.executionId),j(n.status,`running`))).returning({id:n.id}));e.setResult({paused:r.length===1})}),u=e.on(a.cancelPausedExecution,async e=>{let{executionId:n,completedAt:r,reason:i}=e.payload;e.setResult(await Sr(t,n,r,i))});return()=>{r(),i(),o(),s(),c(),l(),u()}}function Tr(e,t){let{workflowExecutions:n}=T(t,F),r=e.on(a.listExecutions,async e=>{let{workflowId:r,scope:i,status:a,limit:o,cursor:s,artifactRef:c}=e.payload;if(r===void 0&&i===void 0&&c===void 0)throw Error(`Either workflowId, scope, or artifactRef is required to list executions.`);let l=yr(r,i,a,s,c,n),u=o??Ye;if(!Number.isInteger(u)||u<v||u>_)throw Error(`Execution list limit must be an integer between ${v} and ${_}.`);let d=await t.select().from(n).where(D(...l)).orderBy(A(n.startedAt),A(n.id)).limit(u);e.setResult({executions:d.map(vr)})}),i=e.on(a.listExecutionsByArtifactRefs,async e=>{let r=Xe.safeParse(e.payload);if(!r.success)throw Error(`Invalid listExecutionsByArtifactRefs query: ${r.error.message}`);let{refs:i,limitPerRef:a}=r.data,o={};for(let e of i){let r=await t.select().from(n).where(D(j(n.artifactKind,e.kind),j(n.artifactId,e.id))).orderBy(A(n.startedAt),A(n.id)).limit(a);r.length>0&&(o[mt(e)]=r.map(vr))}e.setResult({executionsByRef:o})});return()=>{r(),i()}}function Er(e,t){let n=Gt(e,t),r=wr(e,t),i=Tr(e,t),a=Jt(e,t),o=Zt(e,t),s=en(e,t),c=sn(e,t),l=dn(e,t),u=Kn(e,t),d=cr(e,t,Z),f=_r(e,t);return()=>{n(),r(),i(),a(),o(),s(),c(),l(),u(),d(),f()}}function Dr(e){return e.startsWith(y)}function Or(e){let t={};return e.artifactRef!==void 0&&(t.artifactRef=e.artifactRef),e.triggerPayload!==void 0&&(t.triggerPayload=e.triggerPayload),t}function kr(e){if(e.status===`failed`){if(e.error===void 0)throw Error(`status 'failed' requires a non-empty 'error' message`);return{error:e.error}}if(e.status===`cancelled`){if(e.reason===void 0)throw Error(`status 'cancelled' requires a non-empty 'reason' string`);return{reason:e.reason}}return{}}async function Ar(e,t){let{runContext:n}=await e.request(a.getRunContext,{executionId:t});if(n===null)throw Error(`Run context not found for execution: ${t}`);if(n.definitionSnapshot!==void 0)return n.definitionSnapshot;let{workflow:r}=await e.request(a.get,{id:n.workflowId});return r??void 0}function jr(e){return[e.on(h.getDefinition,async t=>{let n=await e.request(a.get,{id:t.payload.id});t.setResult(n)}),e.on(h.setDefinition,async t=>{let n=await e.request(a.set,{workflow:t.payload.workflow});t.setResult(n)}),e.on(h.deleteDefinition,async t=>{let n=await e.request(a.delete,{id:t.payload.id});t.setResult(n)}),e.on(h.listDefinitions,async t=>{let n=await e.request(a.list,t.payload);t.setResult(n)}),e.on(h.getExecution,async t=>{let n=await e.request(a.getExecution,{executionId:t.payload.executionId});t.setResult(n)}),e.on(h.listExecutions,async t=>{let n=await e.request(a.listExecutions,t.payload);t.setResult(n)}),e.on(h.listExecutionsByArtifactRefs,async t=>{let n=await e.request(a.listExecutionsByArtifactRefs,t.payload);t.setResult(n)}),e.on(h.listSpans,async t=>{let n=await e.request(a.listSpans,{executionId:t.payload.executionId});t.setResult(n)}),e.on(h.listFrames,async t=>{let n=await e.request(a.listFrames,{executionId:t.payload.executionId});t.setResult(n)}),e.on(h.listGateInstances,async t=>{let n=await e.request(a.listGateInstances,t.payload);t.setResult(n)}),e.on(h.setExecutionLink,async t=>{let n=await e.request(a.setExecutionLink,{link:t.payload.link});t.setResult(n)}),e.on(h.listExecutionLinks,async t=>{let n=await e.request(a.listExecutionLinks,t.payload);t.setResult(n)}),e.on(h.getRunContext,async t=>{let{executionId:n}=t.payload;if(!g(t,n))throw Error(`Unauthorized: caller is not permitted to read run context for execution: ${n}`);let{runContext:r}=await e.request(a.getRunContext,{executionId:n});if(!r)throw Error(`Run context not found for execution: ${n}`);t.setResult(r)}),...Mr(e)]}function Mr(e){return[e.on(h.registerExternalExecution,async t=>{let n=ce.registerExternalExecution.request.parse(t.payload),{name:r,scope:i,input:o}=n;if(n.executionId!==void 0&&!t.origin.local)throw Error(`registerExternalExecution: caller-supplied executionId is restricted to local callers`);let s=n.executionId??p(`wfx-ext`);if(!Dr(s))throw Error(`registerExternalExecution: executionId must use the wfx-ext- prefix`);let c=n.startedAt??Date.now(),l={id:s,workflowId:r,status:`running`,inputs:o===void 0?{}:o,startedAt:c,scope:i??{type:`global`},...Or(n)},u=Nr(s,c,n.frame),d=await e.request(a.setExternalExecutionStart,{execution:l,...u===void 0?{}:{frame:u}});t.setResult(d)}),e.on(h.completeExternalExecution,async t=>{let n=ce.completeExternalExecution.request.parse(t.payload),{executionId:r,status:i}=n;if(!g(t,r))throw Error(`Unauthorized: caller is not permitted to settle execution: ${r}`);if(!Dr(r))throw Error(`completeExternalExecution: execution "${r}" is engine-owned and must be completed through the engine finalizer, not this API`);let o=Pr(n),s=await e.request(a.settleExternalExecution,{executionId:r,status:i,...kr(n),...n.completedAt===void 0?{}:{completedAt:n.completedAt},...o===void 0?{}:{frame:o}});t.setResult({success:s.success})})]}function Nr(e,t,n){if(n===void 0)return;let r=n.frameId??`${e}:${n.nodeId}`;return{executionId:e,frameId:r,nodeId:n.nodeId,nodeType:n.nodeType,path:n.path??[r],status:`running`,attempt:n.attempt,...n.iteration===void 0?{}:{iteration:n.iteration},...n.branchKey===void 0?{}:{branchKey:n.branchKey},startedAt:n.startedAt??t}}function Pr(e){if(e.frame===void 0)return;if(e.completedAt===void 0)throw Error(`completedAt is required when frame metadata is supplied`);let t=e.completedAt-e.frame.startedAt;if(t<0)throw Error(`completedAt must not precede frame.startedAt`);if(e.frame.durationMs!==void 0&&e.frame.durationMs!==t)throw Error(`frame.durationMs must equal completedAt - frame.startedAt`);return{executionId:e.executionId,frameId:e.frame.frameId,nodeId:e.frame.nodeId,nodeType:e.frame.nodeType,path:e.frame.path,status:e.status,attempt:e.frame.attempt,...e.frame.iteration===void 0?{}:{iteration:e.frame.iteration},...e.frame.branchKey===void 0?{}:{branchKey:e.frame.branchKey},startedAt:e.frame.startedAt,completedAt:e.completedAt,durationMs:t,...e.status===`failed`&&e.error!==void 0?{error:e.error}:{}}}function Fr(e){return[e.on(h.state.get,async t=>{let{executionId:n}=t.payload;if(!g(t,n))throw Error(`Unauthorized: caller is not permitted to read state for execution: ${n}`);let{state:r}=await e.request(a.getState,{executionId:n});if(r===null)throw Error(`no workflow state for execution ${n}`);t.setResult(r)}),e.on(h.state.patch,async t=>{let{executionId:n,expectedSequence:r,patch:i,nextValue:s}=t.payload;if(!g(t,n))throw Error(`Unauthorized: caller is not permitted to patch state for execution: ${n}`);if(r===void 0)throw Error(`expectedSequence is required to patch workflow state`);let c=await Ar(e,n);c!==void 0&&o(c,s,`next`),Ze.array().parse(i);let l=await e.request(a.patchState,{executionId:n,expectedSequence:r,nextValue:s});e.emit(h.state.updated,{executionId:l.executionId,sequence:l.sequence,patch:l.patch,value:l.value,updatedAt:Date.now()}).catch(()=>{}),t.setResult({executionId:l.executionId,sequence:l.sequence,value:l.value})})]}async function Ir(e,t){let{runContext:n}=await e.bus.request(a.getRunContext,{executionId:t});if(n===null)throw new S(it.RUN_CONTEXT_NOT_FOUND,`Run context not found for workflow execution '${t}'.`);return n}function Lr(e,t){return t===void 0?{mode:e}:{mode:e,reason:t}}async function Rr(e,t){let n=await Ir(e,t.executionId),r=t.input===void 0?n.inputs:t.input,i=t.config??n.config??{},a=t.triggerPayload??n.triggerPayload,o=t.artifactRef??n.artifactRef,s=t.scopeOverride??n.scope,c={input:r,config:i,parentSessionId:t.parentSessionId,triggerPayload:a,artifactRef:o,scopeOverride:s,executionLinks:e=>[{sourceExecutionId:t.executionId,targetExecutionId:e,linkType:`rerun-of`,metadata:Lr(t.mode,t.reason)}]};return t.mode===`snapshot`?await Hr(e,n,c):Br(n)?await Ur(e,n,c):await he(e,n.workflowId,c)}function zr(e,t){return Br(e)?t.id:e.workflowId}function Br(e){return e.source.kind!==`definition`&&e.workflowId===e.executionId}function Vr(e){let t=e.definitionSnapshot;if(t===void 0)throw new S(it.SNAPSHOT_UNAVAILABLE,`Workflow execution '${e.executionId}' does not have a definition snapshot.`);return t}async function Hr(e,t,n){let r=Vr(t);return Ee(e,zr(t,r),{workflow:r,executionSource:t.source,definitionSnapshot:r,input:n.input,config:n.config,parentSessionId:n.parentSessionId,triggerPayload:n.triggerPayload,artifactRef:n.artifactRef,scopeOverride:n.scopeOverride,executionLinks:n.executionLinks,...t.materializationSpec===void 0?{}:{materializationSpec:t.materializationSpec}})}async function Ur(e,t,n){if(t.definitionSnapshot===void 0&&t.source.kind===`path`){let{materializationSpec:r}=t;if(r===void 0)throw Error(`Invalid persisted path-backed run context: materializationSpec is required`);return Me(e,t.source.path,{...n,materializationSpec:r})}let r=Vr(t);return Ee(e,r.id,{workflow:r,executionSource:t.source,input:n.input,config:n.config,parentSessionId:n.parentSessionId,triggerPayload:n.triggerPayload,artifactRef:n.artifactRef,scopeOverride:n.scopeOverride,executionLinks:n.executionLinks,...t.materializationSpec===void 0?{}:{materializationSpec:t.materializationSpec}})}var Wr=class{bus;resumePausedExecution;handles=new Map;constructor(e,t){this.bus=e,this.resumePausedExecution=t}dispose(){for(let e of this.handles.values())clearTimeout(e);this.handles.clear()}clear(e,t,n){let r=this.makeKey(e,t,n),i=this.handles.get(r);i!==void 0&&(clearTimeout(i),this.handles.delete(r))}schedule(e){e.timeoutMs!==null&&(this.clear(e.executionId,e.nodeId,e.frameId),this.scheduleNextWakeup({...e,timeoutMs:e.timeoutMs}))}scheduleNextWakeup(e){let t=this.makeKey(e.executionId,e.nodeId,e.frameId),n=Math.max(0,e.openedAt+e.timeoutMs-Date.now()),r=setTimeout(()=>{if(this.handles.delete(t),Date.now()<e.openedAt+e.timeoutMs){this.scheduleNextWakeup(e);return}this.handleExpiredWakeup(e)},Math.min(n,2147483647));this.handles.set(t,r)}scheduleNextWakeupAfterDelay(e,t){let n=this.makeKey(e.executionId,e.nodeId,e.frameId),r=setTimeout(()=>{this.handles.delete(n),this.handleExpiredWakeup(e)},t);this.handles.set(n,r)}async handleExpiredWakeup(e){try{await this.resumeTimedOutPausedGate(e)===`retry`&&this.scheduleNextWakeupAfterDelay(e,25)}catch(t){this.scheduleFailedWakeupRetry(e,t)}}scheduleFailedWakeupRetry(e,t){let n=(e.failedWakeupAttempts??0)+1;if(n>4){console.error(`[WorkflowExecutor] Giving up on timed-out gate '${e.nodeId}' after 4 failed wakeup retries:`,t);return}let r=Math.min(250*2**(n-1),2e3);console.error(`[WorkflowExecutor] Failed to resume timed-out gate '${e.nodeId}', retrying in ${r} ms:`,t),this.scheduleNextWakeupAfterDelay({...e,failedWakeupAttempts:n},r)}makeKey(e,t,n){return`${e}:${t}:${n}`}async resumeTimedOutPausedGate(e){this.clear(e.executionId,e.nodeId,e.frameId);let{gate:t}=await this.bus.request(a.getGateInstance,{executionId:e.executionId,nodeId:e.nodeId,frameId:e.frameId});if(t===null||t.status!==`waiting`)return`settled`;let{execution:n}=await this.bus.request(a.getExecution,{executionId:e.executionId});return n?.status===`running`?`retry`:n?.status===`paused`?(await this.resumePausedExecution(e.executionId),`resumed`):`settled`}};function Gr(e){if(e!==void 0)return Kr(e)?e:{}}function Kr(e){if(typeof e!=`object`||!e||Array.isArray(e))return!1;let t=Object.getPrototypeOf(e);return t===Object.prototype||t===null}function qr(e){if(e!==void 0)return Qe.parse(e)}function Jr(e,t){return ot.parse({executionId:e.executionId,workflowId:e.workflowId,source:e.source,...e.definitionSnapshot===void 0?{}:{definitionSnapshot:e.definitionSnapshot},workerManifest:{contributionRefs:[]},inputs:e.inputs,config:e.config,scope:e.scope,triggerPayload:e.triggerPayload,triggerMode:e.triggerMode??`immediate`,...e.artifactRef===void 0?{}:{artifactRef:e.artifactRef},coordinatorSessionId:e.coordinatorSessionId,cancelSubject:`workflow.${e.executionId}.cancel`,env:t.platformDefaults.env??{},createdAt:Date.now(),suspensionStrategy:e.suspensionStrategy??`wait-in-process`,...e.terminalAuthority===void 0?{}:{terminalAuthority:e.terminalAuthority},...e.materializationSpec===void 0?{}:{materializationSpec:e.materializationSpec}})}function Yr(e){return e?.status===`paused`}function Xr(e){return e?.status===`waiting`}async function Zr(e,t,n,r,i,o,s){t.delete(i.id),n.delete(i.id),r.delete(i.id);try{await e.request(a.restorePausedGateResumeState,{execution:i,gate:o})}catch(e){console.error(`[WorkflowExecutor] Failed to restore paused gate '${s}' after resume launch failure:`,e)}}async function Qr(e,t){if(t.suspensionStrategy===`wait-in-process`)return;let{frames:n}=await e.request(a.listFrames,{executionId:t.executionId});if(n.length===0)throw Error(`[WorkflowExecutor] Missing resume frames for paused execution: ${t.executionId}`)}function $r(e){return{executionId:e.executionId,nodeId:e.nodeId,frameId:e.frameId,timeoutMs:e.timeoutMs,openedAt:e.createdAt}}async function ei(e,t){if(t.frameId!==void 0){let{gate:n}=await e.request(a.getGateInstance,t);return Xr(n)?n:null}let{gates:n}=await e.request(a.listGateInstances,{executionId:t.executionId}),r=n.filter(e=>e.nodeId===t.nodeId&&e.status===`waiting`);return r.length===1?r[0]:null}async function ti(e,t){let n=e.authority.canonicalizeOutcome(t.outcome),r=t.runtimeFence===void 0?void 0:{...t.runtimeFence};await e.validation?.validate(t.executionId,n.outcome);let i=await e.authority.commitOutcome(t.executionAttemptId,t.executionId,n,r);return(i.kind===`accepted`||i.kind===`duplicate`)&&(await e.convergence.converge({executionId:t.executionId,executionAttemptId:t.executionAttemptId,outcome:i.outcome,decision:i.kind}),e.authority.settleOutcome(t.executionAttemptId,{kind:i.kind,outcome:e.authority.decodeOutcome(i.text),text:i.text})),i.kind}function ni(e,t){let r=n(e);if(r===null)throw Error(`Attempt requests require an authenticated workflow-execution-attempt peer`);if(r.executionAttemptId!==t)throw Error(`Request executionAttemptId does not match authenticated peer identity`);return r}function ri(e,t){if(e===null||e.runtimeGeneration!==t.runtimeGeneration)return!1;if(t.outcome.kind===`cancelled`&&t.operationId===void 0)return e.activeOperationId===null;let n=t.outcome.kind===`technical-failure`?t.outcome.stage:t.outcome.kind===`cancelled`?e.activeOperationKind:`workload-invocation`;return n===`startup`?t.operationId===void 0&&e.activeOperationId===null:!(e.activeOperationId!==t.operationId||e.activeOperationGeneration!==t.runtimeGeneration||e.activeOperationKind!==n||n!==`workspace-preparation`&&n!==`workload-invocation`)}function ii(e,t){return e.on(x.instruction.get,async e=>{let n=b[`instruction.get`].request.parse(e.payload),r=ni(e,n.executionAttemptId),i=await t.getInstruction(r);if(i===null){e.setResult({decision:`refused`,refusalReason:`not-found`});return}if((await t.getAttemptControlState(r.executionAttemptId))?.runtimeGeneration!==n.runtimeGeneration){e.setResult({decision:`refused`,refusalReason:`stale-generation`});return}e.setResult({decision:`found`,instruction:i})})}function ai(e,t){let n=[ii(e,t.authority),e.on(x.operation.report,async e=>{let n=b[`operation.report`].request.parse(e.payload),r=ni(e,n.executionAttemptId),i=await t.authority.reportOperation({...n,executionId:r.executionId});i.kind===`accepted`||i.kind===`duplicate`?e.setResult({decision:i.kind,binding:i.binding}):e.setResult({decision:`refused`,refusalReason:i.kind})}),e.on(x.outcome.submit,async e=>{let n=b[`outcome.submit`].request.parse(e.payload),r=ni(e,n.executionAttemptId),i=await t.authority.getInstruction(r);if(i===null)throw Error(`No instruction belongs to this authenticated Attempt`);if(!ri(await t.authority.getAttemptControlState(r.executionAttemptId),n)){e.setResult({decision:`fenced`});return}let a={runtimeGeneration:n.runtimeGeneration,operationId:n.operationId??null},o=await t.decodeOutcome({instruction:i,outcome:n.outcome});try{let n=await ti(t,{...r,outcome:o,runtimeFence:a});e.setResult({decision:n})}catch(t){if(!(t instanceof He))throw t;e.setResult({decision:`fenced`})}})];return()=>{for(let e of n)e()}}function oi(e,t){return e.origin.local?{executionAttemptId:t.executionAttemptId,executionId:t.executionId}:n(e)}async function si(e,t,n){if(n.pausedAtGateId===void 0||n.pausedAtFrameId===void 0)throw Error(`Paused outcome for '${t}' is missing gate identity`);let{paused:r}=await e.request(a.pauseRunningExecution,{executionId:t});if(!r){let{execution:n}=await e.request(a.getExecution,{executionId:t});if(n?.status!==`paused`)throw Error(`Failed to park execution '${t}': status is '${n?.status??`missing`}'`);return}await e.emit(h.execution.paused,{executionId:t,workflowId:n.workflowId,pausedAtGateId:n.pausedAtGateId,pausedAtFrameId:n.pausedAtFrameId})}var ci=class{bus;acceptTerminalResult;acceptTechnicalFailure;acceptCancellation;constructor(e,t,n,r){this.bus=e,this.acceptTerminalResult=t,this.acceptTechnicalFailure=n,this.acceptCancellation=r}async converge(e){if(`kind`in e.outcome){if(e.outcome.kind===`cancelled`){let t=await this.acceptCancellation(e.executionId,e.outcome);if(!t.accepted||t.status!==`cancelled`)throw Error(`Cancellation did not converge workflow execution '${e.executionId}'`);return}let t=await this.acceptTechnicalFailure(e.executionId,e.outcome);if(!t.accepted||t.status!==`failed`&&t.status!==`cancelled`)throw Error(`Technical failure did not converge workflow execution '${e.executionId}'`);return}if(e.outcome.status===`paused`){await si(this.bus,e.executionId,e.outcome);return}let t=await this.acceptTerminalResult(e.executionId,e.outcome);if(!t.accepted||!u(t.status,e.outcome.status))throw Error(`Workflow result did not converge execution '${e.executionId}'`)}};function li(e,t){return{authority:t.authority,decodeOutcome:Ve,convergence:new ci(e,t.acceptTerminalResult,t.acceptTechnicalFailure,t.acceptCancellation)}}function ui(e,t){let n=li(e,t),r=ai(e,n),i=e.on(nt.control.outcome.submit,async e=>{let r=oi(e,e.payload);if(r===null)throw Error(`Outcome submission requires an authenticated workflow-execution-attempt peer`);let{result:i}=e.payload;if(!e.origin.local){if(e.payload.executionId!==r.executionId)throw Error(`Outcome payload executionId '${e.payload.executionId}' does not match authenticated peer claim '${r.executionId}'`);if(e.payload.executionAttemptId!==r.executionAttemptId)throw Error(`Outcome payload executionAttemptId '${e.payload.executionAttemptId}' does not match authenticated peer identity '${r.executionAttemptId}'`)}if(i.executionId!==r.executionId)throw Error(`Nested result.executionId '${i.executionId}' does not match trusted identity '${r.executionId}'`);let a=st.parse(i),o=await t.authority.getInstruction(r);if(o===null)throw Error(`No instruction belongs to this workflow Attempt`);let s=await n.decodeOutcome({instruction:o,outcome:{kind:`workload-result`,result:a}}),c=await ti(n,{executionId:r.executionId,executionAttemptId:r.executionAttemptId,outcome:s});e.setResult({decision:di(c)})});return()=>{i(),r()}}function di(e){return e}function fi(e,t){return e.on(x.operation.admit,async e=>{let r=n(e);if(r===null)throw Error(`Operation admission requires an authenticated workflow-execution-attempt peer`);let{executionAttemptId:i,operationKind:a,admissionKey:o,runtimeGeneration:s}=b[`operation.admit`].request.parse(e.payload);if(i!==r.executionAttemptId)throw Error(`Admission payload executionAttemptId '${i}' does not match authenticated peer identity '${r.executionAttemptId}'`);if(a===`runtime-probe`)throw Error(`Operation admission does not accept 'runtime-probe' (executionAttemptId='${i}'): the bounded probe is admitted only by runtime registration`);let c=await t.authority.admitOperation({executionAttemptId:i,executionId:r.executionId,operationKind:a,admissionKey:o,runtimeGeneration:s});if(c.kind===`admitted`||c.kind===`duplicate`){await t.bus.emit(x.operation.admitted,{executionAttemptId:i,operationId:c.operationId,operationKind:a,runtimeGeneration:c.runtimeGeneration,admittedAt:c.admittedAt}),e.setResult({decision:c.kind,operationId:c.operationId});return}e.setResult({decision:`refused`,refusalReason:c.kind})})}const pi=1e4;function mi(e,t){let r=t.probeDeliveryTimeoutMs??1e4;return e.on(x.runtime.register,async e=>{let i=n(e);if(i===null)throw Error(`Runtime registration requires an authenticated workflow-execution-attempt peer`);let{executionAttemptId:a,runtimeIncarnationId:o}=b[`runtime.register`].request.parse(e.payload);if(a!==i.executionAttemptId)throw Error(`Registration payload executionAttemptId '${a}' does not match authenticated peer identity '${i.executionAttemptId}'`);let s=await t.authority.registerRuntime({executionAttemptId:a,executionId:i.executionId,runtimeIncarnationId:o});if(s.kind===`duplicate`&&s.runtimeReadyAt!==null){await hi(t,a,s.runtimeGeneration),e.setResult({decision:`duplicate`,runtimeGeneration:s.runtimeGeneration});return}if(s.kind!==`registered`&&s.kind!==`duplicate`){e.setResult(vi(s.kind));return}let c=s.runtimeGeneration;if(await gi(t,r,{executionAttemptId:a,executionId:i.executionId,runtimeIncarnationId:o,runtimeGeneration:c})===null){e.setResult(vi(`probe-failed`));return}await hi(t,a,c),e.setResult({decision:`ready`,runtimeGeneration:c})})}async function hi(e,t,n){let r=await e.authority.getAttemptControlState(t);r===null||r.runtimeGeneration!==n||r.runtimeReadyAt===null||await e.bus.emit(x.runtime.ready,{executionAttemptId:t,runtimeGeneration:n,acceptedAt:r.runtimeReadyAt})}async function gi(e,t,n){let{executionAttemptId:r,executionId:i,runtimeIncarnationId:a,runtimeGeneration:o}=n,s=await e.authority.admitOperation({executionAttemptId:r,executionId:i,operationKind:`runtime-probe`,admissionKey:`probe:${a}`,runtimeGeneration:o});if(s.kind!==`admitted`&&s.kind!==`duplicate`)return null;let c=s.operationId,l=()=>_i(e,{executionAttemptId:r,operationId:c,runtimeGeneration:o}),u;try{u=(await e.bus.request(x.operation.deliver,{executionAttemptId:r,runtimeIncarnationId:a,operationId:c,operationKind:`runtime-probe`,runtimeGeneration:o},{timeout:t})).receipt}catch{return await l(),null}if(u!==`completed`&&u!==`duplicate`)return await l(),null;let d=await e.authority.completeOperation({executionAttemptId:r,operationId:c,runtimeGeneration:o});if(d.kind!==`completed`&&d.kind!==`duplicate`)return null;let f=await e.authority.markRuntimeReady({executionAttemptId:r,executionId:i,runtimeGeneration:o,readyAt:new Date().toISOString()});return f.kind!==`ready`&&f.kind!==`duplicate`?null:{kind:f.kind,acceptedAt:f.acceptedAt}}async function _i(e,t){try{await e.authority.completeOperation(t)}catch{}}function vi(e){return{decision:`refused`,runtimeGeneration:0,refusalReason:e}}function yi(e,t,n){n(mi(e,{bus:e,authority:t})),n(fi(e,{bus:e,authority:t}))}function bi(e,t){let r=new AbortController,i=e.on(x.bootstrap.awaitStart,async e=>{let i=n(e);if(i===null)throw Error(`Bootstrap start requires an authenticated workflow-execution-attempt peer`);let{executionAttemptId:a}=b[`bootstrap.awaitStart`].request.parse(e.payload);if(a!==i.executionAttemptId)throw Error(`Bootstrap start executionAttemptId does not match authenticated peer identity`);let o=e.signal?AbortSignal.any([e.signal,r.signal]):r.signal;e.setResult(await t.awaitBootstrapStart({executionAttemptId:a,executionId:i.executionId},{signal:o,deadline:e.deadline??Date.now()+31e3}))});return()=>{r.signal.aborted||(r.abort(Error(`Bootstrap start handler shut down`)),i())}}function xi(e){return e.on(h.finalizeDelegateResult,async t=>{let n=t.payload;Si(t,n.executionId);let{execution:r}=await e.request(a.getExecution,{executionId:n.executionId});if(r===null||r.workflowId!==n.workflowId)throw Error(`delegate result finalization execution does not own the requested workflow`);let{runContext:i}=await e.request(a.getRunContext,{executionId:n.executionId});if(i===null||i.executionId!==n.executionId||i.workflowId!==n.workflowId)throw Error(`delegate result finalization run context does not own the requested workflow execution`);if(i.definitionSnapshot===void 0)throw Error(`delegate result finalization requires an Authority-owned definition snapshot`);Ci(i.definitionSnapshot,n.nodeId,n.nodeType,n.finalizerId);let{subjects:o}=ut(n.finalizerId),s=await e.request(o.finalize,{executionId:n.executionId,workflowId:n.workflowId,frameId:n.frameId,nodeId:n.nodeId,nodeType:n.nodeType,rawResult:n.rawResult,toolObservations:n.toolObservations,...n.economics===void 0?{}:{economics:n.economics}});t.setResult(s)})}function Si(e,t){if(!g(e,t))throw Error(`delegate result finalization requires its authenticated workflow-execution-attempt peer`)}function Ci(e,t,n,r){let i=!1;if(ht(e.root,{enter(e){if(!(e.type!==`delegate-agent`&&e.type!==`delegate-role`||e.id!==t||e.type!==n))return e.resultFinalizerId===r&&(i=!0),!1}}),!i)throw Error(`delegate result finalizer is not selected by the requested durable delegate node`)}async function wi(e,n,r){let[{execution:i},{runContext:o}]=await Promise.all([e.bus.request(a.getExecution,{executionId:n}),e.bus.request(a.getRunContext,{executionId:n})]);if(!i)throw Error(`Authority execution not found: ${n}`);if(o?.executionId!==n||o.workflowId!==i.workflowId)throw Error(`authority technical failure run context identity mismatch`);if(o.terminalAuthority!==`authority`)throw Error(`authority technical failure requires terminalAuthority=authority`);if(i.status===`failed`||i.status===`cancelled`)return{accepted:!0,status:i.status};if(i.status!==`running`)throw Error(`Authority technical failure conflicts with execution status: ${i.status}`);await t(e,i,n,`${r.stage}: ${r.message}`);let s=await e.bus.request(a.getExecution,{executionId:n});if(s.execution?.status!==`failed`&&s.execution?.status!==`cancelled`)throw Error(`Authority technical failure did not settle as failed or cancelled`);return{accepted:!0,status:s.execution.status}}async function Ti(e,t,n){let[{execution:r},{runContext:i}]=await Promise.all([e.bus.request(a.getExecution,{executionId:t}),e.bus.request(a.getRunContext,{executionId:t})]);if(!r)throw Error(`Authority execution not found: ${t}`);if(i?.executionId!==t||i.workflowId!==r.workflowId)throw Error(`authority cancellation run context identity mismatch`);if(i.terminalAuthority!==`authority`)throw Error(`authority cancellation requires terminalAuthority=authority`);if(r.status===`cancelled`)return{accepted:!0,status:`cancelled`};if(r.status!==`running`)throw Error(`Authority cancellation conflicts with execution status: ${r.status}`);if(await m(e,t,n.reason),(await e.bus.request(a.getExecution,{executionId:t})).execution?.status!==`cancelled`)throw Error(`Authority cancellation did not settle as cancelled`);return{accepted:!0,status:`cancelled`}}var Ei=class extends gt{workflowRunner;executionAttemptAuthority;static storage={drizzle:Er};config;stopBootstrapWaits;activeExecutions=new Map;executionTasks=new Map;shellAbortControllers=new Map;activeRunnerSteps=new Map;gateTimeoutScheduler;resumeDispatches=new Set;workflowAbortControllers=new Map;successFinalizers=new Map;durableLifecycleTransitions=new Map;lifecyclePublications=new Map;publishingLifecycleExecutions=new Set;materializationSpecResolvers=new Set;constructor(e,t,n,r){super(e),this.workflowRunner=n,this.executionAttemptAuthority=r,this.config={...l,...t},this.gateTimeoutScheduler=new Wr(e,e=>this.resumePausedExecution(e))}registerWorkflowMaterializationSpecResolver(e){return this.materializationSpecResolvers.add(e),()=>this.materializationSpecResolvers.delete(e)}async registerSuccessFinalizer(e){if(!this.initialized)throw Error(`[WorkflowExecutor] Initialize the executor before registering success finalizers`);if(this.successFinalizers.has(e))throw Error(`[WorkflowExecutor] Success finalizer already registered: ${e}`);let{namespace:t,subjects:n}=dt(e);this.bus.registerNamespace(t);let r={finalizerId:e,finalizeSubject:n.finalize};this.successFinalizers.set(e,r);try{await d(this.buildFinalizerDeps())}catch(t){throw this.successFinalizers.get(e)===r&&this.successFinalizers.delete(e),t}let i=!1;return()=>{i||(i=!0,this.successFinalizers.get(e)===r&&this.successFinalizers.delete(e))}}async acceptAuthorityRunnerResult(e,t){if(t.status===`paused`)throw Error(`authority runner result must be terminal`);if(t.executionId!==e)throw Error(`authority runner result execution identity mismatch`);let{execution:n}=await this.bus.request(a.getExecution,{executionId:e});if(!n)throw Error(`Authority runner execution not found: ${e}`);if(n.workflowId!==t.workflowId)throw Error(`authority runner result workflow identity mismatch`);let r;if(n.status===`finalizing`){let{workflow:n}=await this.loadAuthorityRunnerContext(e,t.workflowId);r=await this.registerAuthorityResultFinalizer(n)}let i=await this.resolveAuthorityRunnerReplay(n,t).finally(()=>r?.());if(i!==void 0)return{accepted:!0,status:i};if(n.status!==`running`)throw Error(`Authority runner execution is ${n.status}`);let{runContext:o,workflow:s}=await this.loadAuthorityRunnerContext(e,t.workflowId),c=await this.registerAuthorityResultFinalizer(s),l=this.activeExecutions.get(e),d=!1;if(!l)this.activeExecutions.set(e,{execution:n,workflow:s,runContext:o,runtimeHandlers:new Map,runtimeLoopGates:new Map}),d=!0;else if(l.execution.workflowId!==t.workflowId)throw Error(`authority runner active execution identity mismatch`);try{await f({activeExecutions:this.activeExecutions,buildFinalizerDeps:()=>this.buildFinalizerDeps()},t)}finally{d&&this.activeExecutions.delete(e),c?.()}let p=await this.bus.request(a.getExecution,{executionId:e});if(!p.execution||!u(p.execution.status,t.status))throw Error(`Authority runner result did not settle compatibly with ${t.status}`);return{accepted:!0,status:p.execution.status}}acceptAuthorityTechnicalFailure=(e,t)=>wi(this.buildFinalizerDeps(),e,t);acceptAuthorityCancellation=(e,t)=>Ti(this.buildFinalizerDeps(),e,t);async resolveAuthorityRunnerReplay(e,t){if(e.status===`finalizing`){if(t.status!==`completed`)throw Error(`authority runner result conflicts with terminal execution`);await d(this.buildFinalizerDeps());let n=await this.bus.request(a.getExecution,{executionId:e.id});if(!n.execution)throw Error(`Authority runner success finalization execution is missing`);if(!u(n.execution.status,t.status))throw Error(`authority runner result conflicts with terminal execution`);return n.execution.status}if(!(e.status!==`completed`&&e.status!==`failed`&&e.status!==`cancelled`)){if(!u(e.status,t.status))throw Error(`authority runner result conflicts with terminal execution`);return e.status}}async loadAuthorityRunnerContext(e,t){let{runContext:n}=await this.bus.request(a.getRunContext,{executionId:e});if(!n)throw Error(`Authority runner run context not found: ${e}`);if(n.executionId!==e||n.workflowId!==t)throw Error(`authority runner run context identity mismatch`);if(n.terminalAuthority!==`authority`)throw Error(`authority runner result requires terminalAuthority=authority`);let r=n.definitionSnapshot??(await this.bus.request(a.get,{id:n.workflowId})).workflow;if(!r||r.id!==t)throw Error(`authority runner workflow definition is unavailable or mismatched`);return{runContext:n,workflow:r}}registerAuthorityResultFinalizer(e){return!e.successFinalizerId||this.successFinalizers.has(e.successFinalizerId)?Promise.resolve(void 0):this.registerSuccessFinalizer(e.successFinalizerId)}async onInit(){this.registerExecutionHandlers(),this.addCleanup(Oe(this.bus,(e,t)=>{let n=this.activeExecutions.get(e);n!==void 0&&(n.workflow=t)})),this.addCleanup(xi(this.bus)),this.executionAttemptAuthority!==void 0&&(this.stopBootstrapWaits=bi(this.bus,this.executionAttemptAuthority),this.addCleanup(this.stopBootstrapWaits),this.addCleanup(ui(this.bus,{bus:this.bus,authority:this.executionAttemptAuthority,acceptTerminalResult:(e,t)=>this.acceptAuthorityRunnerResult(e,t),acceptTechnicalFailure:this.acceptAuthorityTechnicalFailure,acceptCancellation:this.acceptAuthorityCancellation})),yi(this.bus,this.executionAttemptAuthority,e=>this.addCleanup(e))),jr(this.bus).forEach(e=>this.addCleanup(e)),Fr(this.bus).forEach(e=>this.addCleanup(e)),await this.rehydratePausedGateTimeouts()}async onDestroy(){this.stopBootstrapWaits?.();let e=this.buildFinalizerDeps();await Promise.allSettled([...this.activeExecutions.keys()].map(async t=>{await m(e,t,`Workflow engine shutdown`)&&(this.workflowAbortControllers.get(t)?.abort(),this.workflowAbortControllers.delete(t))}));for(let e of this.workflowAbortControllers.values())e.abort();this.workflowAbortControllers.clear(),await Promise.allSettled(this.executionTasks.values()),await Promise.allSettled(this.durableLifecycleTransitions.values()),await Promise.allSettled(this.lifecyclePublications.values());for(let e of this.shellAbortControllers.values())e.abort();this.shellAbortControllers.clear();for(let e of this.activeRunnerSteps.values())e.hardKillTimer&&clearTimeout(e.hardKillTimer);this.activeRunnerSteps.clear(),this.gateTimeoutScheduler.dispose(),await this.workflowRunner?.dispose?.(),this.activeExecutions.clear()}buildFinalizerDeps(){return{bus:this.bus,activeExecutions:this.activeExecutions,shellAbortControllers:this.shellAbortControllers,activeRunnerSteps:this.activeRunnerSteps,cancelTimeoutMs:this.config.cancelTimeoutMs,successFinalizers:this.successFinalizers,resolveSuccessFinalizerId:e=>this.activeExecutions.get(e)?.workflow.successFinalizerId,durableLifecycleTransitions:this.durableLifecycleTransitions,lifecyclePublications:this.lifecyclePublications,publishingLifecycleExecutions:this.publishingLifecycleExecutions}}buildRunnerTaskDeps(e){return{workflowRunner:e,workflowAbortControllers:this.workflowAbortControllers,executionTasks:this.executionTasks,activeExecutions:this.activeExecutions,buildFinalizerDeps:()=>this.buildFinalizerDeps(),config:this.config}}async resolveExecutionWorkspaceRoot(e){if(!e)return this.config.platformDefaults.cwd;let{session:t}=await this.bus.request($e.get,{sessionId:e});if(t===null)throw Error(`[WorkflowExecutor] Parent session not found: ${e}`);return t.targetWorkingDirectory??this.config.platformDefaults.cwd}resolveEphemeralPlatformFields(){return ze(this.config.platformDefaults.cwd,this.config.makaioHome)}buildStartDeps(){return{bus:this.bus,config:this.config,activeExecutions:this.activeExecutions,executionTasks:this.executionTasks,workflowRunner:this.workflowRunner,buildRunContext:e=>Jr(e,this.config),buildRunnerTaskDeps:e=>this.buildRunnerTaskDeps(e),buildFinalizerDeps:()=>this.buildFinalizerDeps(),resolveExecutionWorkspaceRoot:e=>this.resolveExecutionWorkspaceRoot(e),runExecution:e=>this.runExecution(e),executionAttemptAuthority:this.executionAttemptAuthority,materializationSpecResolvers:this.materializationSpecResolvers}}registerExecutionHandlers(){this.registerHandler(h.acceptAuthorityRunnerResult,async e=>{if(!e.origin.local)throw Error(`authority runner result acceptance is local-authority only`);let{executionId:t,result:n}=e.payload;e.setResult(await this.acceptAuthorityRunnerResult(t,n))}),this.registerHandler(h.start,async e=>{let{workflowId:t,input:n,config:r,parentSessionId:i,triggerPayload:a,artifactRef:o,scope:s}=e.payload;try{let c=await he(this.buildStartDeps(),t,{input:qr(n),config:Gr(r)??{},parentSessionId:i,triggerPayload:a,artifactRef:o,scopeOverride:s});e.setResult({executionId:c})}catch(e){if(e instanceof S)throw e;let t=e instanceof Error?e.message:String(e);throw Error(`Failed to start workflow: ${t}`)}}),this.registerHandler(h.rerun,async e=>{let{executionId:t,mode:n,input:r,config:i,parentSessionId:a,triggerPayload:o,artifactRef:s,scope:c,reason:l}=e.payload;try{let u=await Rr(this.buildStartDeps(),{executionId:t,mode:n,input:qr(r),config:Gr(i),parentSessionId:a,triggerPayload:o,artifactRef:s,scopeOverride:c,reason:l});e.setResult({executionId:u})}catch(e){if(e instanceof S)throw e;let t=e instanceof Error?e.message:String(e);throw Error(`Failed to rerun workflow: ${t}`)}}),this.registerHandler(h.runFile,async e=>{if(this.workflowRunner===void 0)throw Error(`workflow.runFile requires a workflow runner — configure a ThinWorkflowPiscinaRunner or equivalent.`);let{filePath:t,materializationSpec:n,triggerPayload:r,triggerMode:i,scope:a}=e.payload;try{let o=await Me(this.buildStartDeps(),t,{...n===void 0?{}:{materializationSpec:n},triggerPayload:r,triggerMode:i,scopeOverride:a});e.setResult({executionId:o})}catch(e){let t=e instanceof Error?e.message:String(e);throw Error(`Failed to start workflow file: ${t}`)}}),this.registerHandler(h.cancel,async e=>{let{executionId:t,reason:n}=e.payload;await this.bus.emit(lt(`workflow.${t}.cancel`),{executionId:t,reason:n}).catch(e=>{console.error(`[WorkflowExecutor] Failed to emit workflow cancel for ${t}:`,e)});let r=this.workflowAbortControllers.get(t);if(r){r.abort(n??et);let i=await m(this.buildFinalizerDeps(),t,n);e.setResult({cancelled:i});return}let i=await m(this.buildFinalizerDeps(),t,n);e.setResult({cancelled:i})}),this.registerGateTimeoutHandlers(),this.addCleanup(this.bus.on(h.gate.respond,async e=>{let{executionId:t,gateId:n,frameId:r,action:i,resumeData:a,reason:o}=e.payload,s=await this.respondToPausedGate({executionId:t,gateId:n,frameId:r,action:i,resumeData:a,reason:o});e.setResult({accepted:s})},{priority:-100}))}registerGateTimeoutHandlers(){this.addCleanup(this.bus.on(h.gate.suspended,e=>{this.gateTimeoutScheduler.schedule(e.payload)})),this.addCleanup(this.bus.on(h.gate.resolved,e=>{this.gateTimeoutScheduler.clear(e.payload.executionId,e.payload.stepId,e.payload.frameId)}))}async rehydratePausedGateTimeouts(){let{gates:e}=await this.bus.request(a.listPausedGateTimeouts,{});for(let t of e)this.gateTimeoutScheduler.schedule($r(t))}async runExecution(e){let n=this.activeExecutions.get(e);if(!n)return;let r=new AbortController;this.workflowAbortControllers.set(e,r);try{let i;try{let t=await de({definition:n.workflow,execution:n.execution,runContext:n.runContext,bus:this.bus}),a=new we(e,n.workflow.id,n.workflow,n.execution,n.runtimeHandlers,this.bus,r.signal,void 0,t,{context:this.resolveEphemeralPlatformFields(),env:n.runContext.env},{runtimeLoopGates:n.runtimeLoopGates});Fe(n.workflow,n.runtimeLoopGates);let o=a.buildExpressionContext();i=await xe(n.workflow.root,a,o)}catch(i){if(r.signal.aborted||n.execution.status===`cancelled`){await m(this.buildFinalizerDeps(),e,et);return}let a=i instanceof Error?i.message:String(i);await t(this.buildFinalizerDeps(),n.execution,e,a);return}let o=this.buildFinalizerDeps();i.status===`cancelled`||r.signal.aborted||n.execution.status===`cancelled`?await m(o,e,et):i.status===`failed`?await t(o,n.execution,e,i.error):i.status===`paused`?(n.execution.status=`paused`,await this.bus.request(a.setExecution,{execution:n.execution}),this.activeExecutions.delete(e)):await Ce(o,n.execution,e,n.execution.startedAt)}finally{this.workflowAbortControllers.delete(e)}}async respondToPausedGate(e){let{executionId:t,gateId:n,frameId:r,resumeData:i,reason:o}=e,{execution:s}=await this.bus.request(a.getExecution,{executionId:t});if(!Yr(s))return!1;let c=await ei(this.bus,{executionId:t,nodeId:n,frameId:r});if(c===null||!Ae(n,c.schema,i).valid)return!1;let{runContext:l}=await this.bus.request(a.getRunContext,{executionId:t});if(l===null)throw Error(`[WorkflowExecutor] Run context not found for paused execution: ${t}`);await Qr(this.bus,l);let{accepted:u}=await this.bus.request(a.resolveWaitingGateInstance,{gate:{...c,status:e.action===`reject`?`rejected`:`resumed`,resumeData:i,...o===void 0?{}:{reason:o},resolvedAt:Date.now()}});if(!u)return!1;try{await this.resumePausedExecution(s.id)}catch(e){throw await Zr(this.bus,this.activeExecutions,this.executionTasks,this.workflowAbortControllers,s,c,n),e}return this.gateTimeoutScheduler.clear(t,n,c.frameId),!0}async resumePausedExecution(e){if(!this.resumeDispatches.has(e)){this.resumeDispatches.add(e);try{await this.dispatchPausedExecutionResume(e)||this.resumeDispatches.delete(e)}catch(t){throw this.resumeDispatches.delete(e),t}}}async dispatchPausedExecutionResume(e){let{runContext:t}=await this.bus.request(a.getRunContext,{executionId:e});if(t===null)throw Error(`[WorkflowExecutor] Run context not found for paused execution: ${e}`);let n=t.definitionSnapshot??(await this.bus.request(a.get,{id:t.workflowId})).workflow??(()=>{throw Error(`[WorkflowExecutor] Workflow definition not found for paused execution: ${e}`)})(),{execution:i}=await this.bus.request(a.getExecution,{executionId:e});if(i===null)throw Error(`[WorkflowExecutor] Execution not found for paused execution: ${e}`);if(i.status!==`paused`)return!1;await Qr(this.bus,t);let o=r(t,n,{resume:!0}),s=_e(this.buildStartDeps(),o);await this.bus.request(a.setExecution,{execution:{...i,status:`running`}}),this.activeExecutions.set(e,{execution:{...i,status:`running`},workflow:n,runContext:t,runtimeHandlers:new Map,runtimeLoopGates:new Map});let c=ye(this.buildStartDeps(),o,s).finally(()=>{this.resumeDispatches.delete(e)});return this.executionTasks.set(e,c),!0}};const Q=`[WorkflowTriggerReconciler]`;function Di(e){return e.map(Oi)}function Oi(e){let t=rt.parse(e);return{binding:t,matches:We(t),subscription:void 0}}function ki(e,t,n){let r=e.triggers??[];try{return n===void 0?Di(r):r.map(e=>n.has(e.kind)?Oi(e):void 0)}catch(i){if(t){console.error(`${Q} keeping last-good triggers for workflow "${e.id}": its trigger bindings are invalid`,i);return}return r.map((t,r)=>{if(!(n!==void 0&&!n.has(t.kind)))try{return Oi(t)}catch(t){console.error(`${Q} leaving invalid trigger ${r} of workflow "${e.id}" inactive`,t);return}})}}function Ai(e,t){return e.scope.type!==`global`||t.kind!==Je}async function ji(e,t,n,r){if(r!==void 0)for(let[i,a]of Array.from(r)){let o=e.triggers?.[i];if(o!==void 0&&n!==void 0&&!n.has(o.kind))continue;let s=t[i];s!==void 0&&Ai(e,s.binding)||(r.delete(i),await $(a.subscription))}}async function $(e){if(e!==void 0)try{await e.detach()}catch(t){console.error(`${Q} detach failed for '${e.bindingKey}':`,t)}}var Mi=class{bus;resolveRuntime;consumers=new Map;cleanupFns=[];initialized=!1;initialization;lane=new Ge;pendingChanges=[];constructor(e,t){this.bus=e,this.resolveRuntime=t}async init(){if(this.initialized)return;if(this.initialization!==void 0)return this.initialization;let e=this.initialize();return this.initialization=e,e.then(()=>this.clearInitialization(e),()=>this.clearInitialization(e)),e}clearInitialization(e){this.initialization===e&&(this.initialization=void 0)}async initialize(){try{let e=({payload:e})=>{this.onSignal(`refresh of workflow "${e.id}"`,()=>this.refreshDefinition(e.id))};this.cleanupFns.push(this.bus.on(C.definition.created,e),this.bus.on(C.definition.updated,e),this.bus.on(C.definition.deleted,e),this.bus.on(qe.changed,e=>{this.scheduleRegistryReconcile(e.payload)})),await this.reconcileStored(`keep-last-good`),this.initialized=!0}catch(e){throw await this.teardown(),e}}async destroy(){await this.teardown(),this.initialized=!1}activeConsumerCount(){let e=0;for(let t of this.consumers.values())e+=t.size;return e}onSignal(e,t){t().catch(t=>{console.error(`${Q} ${e} failed:`,t)})}scheduleRegistryReconcile(e){let t=this.pendingChanges.length>0;this.pendingChanges.push(e),!t&&queueMicrotask(()=>{if(this.pendingChanges.length===0)return;let e=this.pendingChanges.splice(0),t=new Set(e.flatMap(({kinds:e})=>e)),n=e.map(({owner:e,revision:t})=>`${e}@${t}`).join(`, `);this.onSignal(`reconciliation after trigger registry changes (${n})`,()=>this.reconcileStored(`drop-unavailable`,t))})}async reconcileStored(e,t){await this.lane.run(async()=>{let{workflows:n}=await this.bus.request(a.list,{}),r=new Set(n.map(e=>e.id));for(let r of n){let n=r.triggers??[];t!==void 0&&!n.some(e=>t.has(e.kind))||await this.applyDefinitionWithinLane(r,e,t)}for(let e of Array.from(this.consumers.keys()))r.has(e)||await this.forgetWorkflowWithinLane(e)})}async refreshDefinition(e){await this.lane.run(async()=>{let{workflow:t}=await this.bus.request(a.get,{id:e});if(t===null){await this.forgetWorkflowWithinLane(e);return}await this.applyDefinitionWithinLane(t,`keep-last-good`)})}async applyDefinitionWithinLane(e,t,n){let r=ki(e,(this.consumers.get(e.id)?.size??0)>0,n);if(r===void 0)return;let i=this.consumers.get(e.id);if(await ji(e,r,n,i),i?.size===0&&this.consumers.delete(e.id),!r.some(t=>t!==void 0&&Ai(e,t.binding)&&(n===void 0||n.has(t.binding.kind))))return;let a=this.resolveRuntime();if(a===void 0){r.length>0&&console.warn(`${Q} no automation trigger binding runtime is available; declarative triggers of workflow "${e.id}" stay inactive`);return}let o=this.consumers.get(e.id);o===void 0&&(o=new Map,this.consumers.set(e.id,o));for(let[i,s]of r.entries())s!==void 0&&Ai(e,s.binding)&&(n!==void 0&&!n.has(s.binding.kind)||await this.refreshConsumerWithinLane(a,e.id,i,s,o,t));o.size===0&&this.consumers.delete(e.id)}async refreshConsumerWithinLane(e,t,n,r,i,a){let o=i.get(n),s=this.createListener(t,n,r);try{let t=o?.subscription?.bindingKey,a=e.prepareBinding(r.binding);if(a===void 0)throw Error(`Automation trigger kind '${r.binding.kind}' is not registered`);if(!a.workflowCompatible)throw Error(`Automation trigger kind '${r.binding.kind}' does not emit an object-root payload`);(t===void 0||t!==a.bindingKey)&&i.set(n,r),r.subscription=await a.subscribe(s),i.set(n,r),await $(o?.subscription);return}catch(e){if(o===void 0?i.delete(n):i.set(n,o),a===`keep-last-good`){console.error(`${Q} keeping last-good trigger ${n} of workflow "${t}": binding '${r.binding.kind}' could not be activated`,e);return}console.warn(`${Q} dropping trigger ${n} of workflow "${t}": binding '${r.binding.kind}' is no longer available`,e),i.delete(n),await $(o?.subscription)}}async forgetWorkflowWithinLane(e){let t=this.consumers.get(e);if(t!==void 0){this.consumers.delete(e);for(let e of t.values())await $(e.subscription)}}createListener(e,t,n){let r=`trigger ${t} ('${n.binding.kind}') of workflow "${e}"`;return async i=>{if(this.consumers.get(e)?.get(t)!==n)return;let a;try{a=n.matches(i.payload)}catch(e){console.error(`${Q} filter evaluation failed for ${r}:`,e);return}if(a)try{await this.bus.request(C.start,{workflowId:e,triggerPayload:Ue(i.payload)})}catch(t){console.error(`${Q} failed to start workflow "${e}" from ${r}:`,t)}}}async teardown(){this.cleanupFns.forEach(e=>e()),this.cleanupFns.length=0,this.pendingChanges.length=0,await this.lane.run(async()=>{for(let e of Array.from(this.consumers.keys()))await this.forgetWorkflowWithinLane(e)})}};const Ni=1e3;function Pi(e){if(e===null)return{status:`refused`,reason:`not-found`};if(e.settled)return{status:`refused`,reason:`resolved`};if(!e.active)return{status:`refused`,reason:`fenced`};if(e.allocationTerminated)return{status:`refused`,reason:`allocation-terminated`};if(e.operationStartGate===`closed`)return{status:`refused`,reason:`gate-closed`};let t=e.bootstrapDeadlineAt===null?NaN:Date.parse(e.bootstrapDeadlineAt);return!Number.isFinite(t)||t<=Date.now()?{status:`refused`,reason:`bootstrap-expired`}:{status:e.allocated?`permitted`:`pending`}}function Fi(e,t){return new Promise((n,r)=>{let i=()=>{t.removeEventListener(`abort`,i),r(t.reason)};t.addEventListener(`abort`,i,{once:!0}),t.aborted&&i(),e.then(n,r).finally(()=>t.removeEventListener(`abort`,i))})}function Ii(e,t){return new Promise((n,r)=>{let i=()=>{clearTimeout(o),t.removeEventListener(`abort`,a),n()},a=()=>{clearTimeout(o),t.removeEventListener(`abort`,a),r(t.reason)},o=setTimeout(i,e);t.addEventListener(`abort`,a,{once:!0}),t.aborted&&a()})}function Li(e,t){return setTimeout(()=>e.abort(Error(`Bootstrap start observation timed out`)),Math.max(0,t-Date.now()))}async function Ri(e,t,n){if(n.signal.throwIfAborted(),!Number.isFinite(n.deadline))throw Error(`Bootstrap start request requires a finite deadline`);let r=Math.min(Date.now()+3e4,n.deadline-Ni),i=new AbortController,a=AbortSignal.any([n.signal,i.signal]),o=Math.min(n.deadline,r+Ni),s=Li(i,o);try{for(;;){a.throwIfAborted();let n=await Fi(e.readBootstrapStartState(t),a);a.throwIfAborted();let c=Pi(n);if(c.status!==`pending`)return c;let l=Date.parse(n?.bootstrapDeadlineAt??``);clearTimeout(s),s=Li(i,Math.min(o,l+Ni));let u=Math.min(r,l)-Date.now();if(u<=0)return c;await Ii(Math.min(100,u),a)}}finally{clearTimeout(s)}}var zi=class{repository;bootstrapTimeoutMs;waiters=new Map;constructor(e,t){if(!Number.isSafeInteger(t?.bootstrapTimeoutMs)||t.bootstrapTimeoutMs<=0)throw Error(`ExecutionAttemptAuthority requires an explicit positive safe-integer bootstrapTimeoutMs`);this.repository=e,this.bootstrapTimeoutMs=t.bootstrapTimeoutMs}awaitBootstrapStart(e,t){return Ri(this.repository,e,t)}async createAttempt(e,t){let n=crypto.randomUUID(),r=await this.repository.createAttempt({executionAttemptId:n,executionId:e,instruction:t,bootstrapTimeoutMs:this.bootstrapTimeoutMs});return this.installWaiter(n),r}async getInstruction(e){return this.repository.getInstruction(e)}async reportOperation(e){return this.repository.reportOperation(e)}async beginProvisioning(e){return this.repository.beginProvisioning(e)}async getProviderOperation(e){return this.repository.getProviderOperation(e)}async renewProviderOperationClaim(e){return this.repository.renewProviderOperationClaim(e)}async takeOverProviderOperation(e){return this.repository.takeOverProviderOperation(e)}async handoffProviderOperation(e){return this.repository.handoffProviderOperation(e)}async recordProviderOperationUncertainty(e){return this.repository.recordProviderOperationUncertainty(e)}async recordAllocation(e){return this.repository.recordAllocation(e)}async recordProvisioningAbsent(e){let t=await this.repository.recordProvisioningAbsent(e);return t.kind===`recorded`&&this.rejectWaiterWith(e.claim.executionAttemptId,()=>Error(`Attempt '${e.claim.executionAttemptId}' provisioning produced no allocation: ${e.evidence.source} reported '${e.evidence.summary}'`)),t}async recordProvisionerIncarnationLost(e){let t=await this.repository.recordProvisionerIncarnationLost(e);if(t.kind===`recorded`){let{evidence:t,provisionerIncarnationId:n}=e.proof;this.rejectWaiterWith(e.claim.executionAttemptId,()=>Error(`Attempt '${e.claim.executionAttemptId}' lost the provisioner incarnation '${n}' its allocation was bound to: ${t.source} reported '${t.summary}'`))}return t}async recordAllocationTerminated(e){return this.repository.recordAllocationTerminated(e)}async registerRuntime(e){return this.repository.registerRuntime(e)}async admitOperation(e){return this.repository.admitOperation(e)}async completeOperation(e){return this.repository.completeOperation(e)}async markRuntimeReady(e){return this.repository.markRuntimeReady(e)}async getAttemptControlState(e){return this.repository.getAttemptControlState(e)}async getActiveAttempt(e,t){return this.repository.getActiveAttempt(e,t)}canonicalizeOutcome(e){return this.repository.canonicalizeOutcome(e)}decodeOutcome(e){return this.repository.decodeOutcome(e)}async commitOutcome(e,t,n,r){let i=await this.repository.commitOutcome({executionAttemptId:e,executionId:t,result:n,...r===void 0?{}:{runtimeFence:r}});return(i.kind===`conflict`||i.kind===`fenced`)&&this.settleWaiterInternal(e,i),i}waitForOutcome(e){return this.waiters.get(e)?.promise}settleOutcome(e,t){this.settleWaiterInternal(e,t)}discardWaiter(e){this.waiters.delete(e)}rejectAndDiscardWaiter(e,t){this.rejectWaiterWith(e,()=>t)}rejectWaiterWith(e,t){let n=this.waiters.get(e);n!==void 0&&(n.promise.catch(()=>void 0),n.reject(t()),this.waiters.delete(e))}get supportsRecovery(){return this.repository.recovery!==void 0}async getAttemptWithAllocation(e){return this.requireRecovery(`getAttemptWithAllocation`).getAttemptWithAllocation(e)}async recordDiscoveredAllocation(e){return this.requireRecovery(`recordDiscoveredAllocation`).recordDiscoveredAllocation(e)}async evolveAllocationRef(e){let t=this.requireRecovery(`evolveAllocationRef`);if(e.currentRef.providerId!==e.nextRef.providerId)throw Error(`Provider identity mismatch in allocation ref evolution: currentRef.providerId '${e.currentRef.providerId}' !== nextRef.providerId '${e.nextRef.providerId}'. Provider identity must not change during correlation.`);return t.evolveAllocationRef(e)}async getRecoverableAttempts(e){return this.requireRecovery(`getRecoverableAttempts`).getRecoverableAttempts(e)}async recordInfrastructureFailure(e){let t=await this.repository.recordInfrastructureFailure(e);return t.kind===`recorded`&&this.rejectWaiterWith(e.claim.executionAttemptId,()=>Error(`Attempt '${e.claim.executionAttemptId}' suffered infrastructure failure: the provider allocation terminated without an acknowledged outcome`)),t}async abandonPendingAttempt(e,t){let n=await this.repository.abandonPendingAttempt(e,t);return(n.kind===`abandoned`||n.kind===`already-abandoned`)&&this.waiters.delete(e),n}requireRecovery(e){let{recovery:t}=this.repository;if(t===void 0)throw Error(`Recovery operation '${e}' requires a repository that exposes recovery operations. The injected repository does not support recovery.`);return t}installWaiter(e){this.waiters.set(e,le())}settleWaiterInternal(e,t){let n=this.waiters.get(e);if(n){switch(t.kind){case`accepted`:case`duplicate`:n.resolve(t.outcome);break;case`conflict`:n.reject(Error(`Outcome conflict for attempt '${e}': a different outcome was already committed`));break;case`fenced`:n.reject(Error(`Attempt '${e}' has been fenced: it is no longer the active attempt for this execution`));break}this.waiters.delete(e)}}},Bi=class extends gt{workflowExecutor;triggerReconcilerInstance;attemptAuthority;workspaceRootResolvers=new Set;constructor(e,t){super(e);let n=t?.executionAttemptAuthority;if(!n&&t?.executionAttemptRepository){let e=t.executionAttemptBootstrapTimeoutMs;if(e===void 0)throw Error(`An ExecutionAttemptRepository requires executionAttemptBootstrapTimeoutMs`);n=new zi(t.executionAttemptRepository,{bootstrapTimeoutMs:e})}this.attemptAuthority=n,this.workflowExecutor=new Ei(e,t?.executorConfig,t?.workflowRunner,this.attemptAuthority);for(let e of t?.workflowMaterializationSpecResolvers??[])this.workflowExecutor.registerWorkflowMaterializationSpecResolver(e);let r=t?.automationTriggerBindingRuntime;this.triggerReconcilerInstance=new Mi(e,()=>r?.())}get executor(){return this.workflowExecutor}get executionAttemptAuthority(){return this.attemptAuthority}registerSuccessFinalizer(e){return this.workflowExecutor.registerSuccessFinalizer(e)}acceptAuthorityRunnerResult(e,t){return this.workflowExecutor.acceptAuthorityRunnerResult(e,t)}get triggerReconciler(){return this.triggerReconcilerInstance}registerWorkflowMaterializationSpecResolver(e){return this.workflowExecutor.registerWorkflowMaterializationSpecResolver(e)}registerWorkspaceRootResolver(e){return this.workspaceRootResolvers.add(e),()=>{this.workspaceRootResolvers.delete(e)}}async resolveWorkspaceRoot(e){for(let t of this.workspaceRootResolvers){let n=await t(e);if(n!==void 0)return n}}async onInit(){this.addCleanup(()=>this.destroyOwnedServices()),await this.workflowExecutor.init(),await this.triggerReconcilerInstance.init()}async destroyOwnedServices(){let e=[];for(let t of[()=>this.triggerReconcilerInstance.destroy(),()=>this.workflowExecutor.destroy()])try{await t()}catch(t){e.push(t)}if(e.length===1)throw e[0];if(e.length>1)throw AggregateError(e,`Workflow engine service teardown failed`)}};const Vi=pt(`makaio.workflow-engine`);function Hi(e){return{name:Vi.name,displayName:`Workflow Engine`,version:`0.1.0`,dependencies:[ft(Dt.name),ft(Ot.name,void 0,!0)],critical:!0,namespaces:[at,re],storage:{registerHandlers:yt(Er)},create:t=>new Bi(t.bus,{...e,automationTriggerBindingRuntime:()=>t.getService(Ot)})}}const Ui=Hi();export{un as _,zi as a,bi as c,fi as d,ai as f,cn as g,ln as h,Bi as i,pi as l,Er as m,Hi as n,Mi as o,ti as p,Ui as r,Ei as s,Vi as t,mi as u};