@makaio/framework 1.0.0-dev-1790087128488 → 1.0.0-dev-1790165101280

package/dist/node/transports/index.mjs

@@ -1,2 +1,2 @@
-import{r as e}from"../../chunk-DTipWd-i.mjs";import{isRecord as t}from"@makaio/framework/utils";import{ConnectionLostError as n,CorrelationTracker as r,DEFAULT_REQUEST_TIMEOUT_MS as i,NoHandlerError as a,TimeoutError as o,buildSubscribeMessage as s,buildUnsubscribeMessage as c,deserializeTransportError as l,getSubjectFromBusMessage as u,handleCorrelationResponse as d,isNoHandlerErrorForSubject as f,matchesFilter as p,matchesSubscription as m,shouldReceiveMessage as ee,trackMessageCorrelation as h}from"@makaio/framework/bus";const te={baseMs:1e3,maxMs:1e4};function ne(e,t,n){let r=Math.max(t,100),i=Math.max(n,r);return Math.min(r*2**e,i)}function re(e,t){return new Promise(n=>{if(t.aborted){n();return}let r=()=>{clearTimeout(i),t.removeEventListener(`abort`,r),n()},i=setTimeout(()=>{t.removeEventListener(`abort`,r),n()},e);t.addEventListener(`abort`,r)})}const ie={intervalMs:3e4,timeoutMs:1e4},ae={encode:async e=>JSON.stringify(e),decode:async e=>e};function oe(e){return e===!1?!1:{baseMs:e?.baseMs??te.baseMs,maxMs:e?.maxMs??te.maxMs}}function se(e){if(e===!1)return!1;let t=e?.intervalMs??ie.intervalMs,n=e?.timeoutMs??ie.timeoutMs;if(!Number.isFinite(t)||t<=0)throw RangeError(`heartbeat.intervalMs must be a finite number > 0 (got ${String(t)})`);if(!Number.isFinite(n)||n<=0)throw RangeError(`heartbeat.timeoutMs must be a finite number > 0 (got ${String(n)})`);return{intervalMs:t,timeoutMs:n}}var g=class extends Error{code;constructor(e,t,n){super(t,n),this.code=e,this.name=`WebSocketConnectionError`}};function _(e){let t=typeof e==`object`&&!!e&&`code`in e&&e.code===1008;return new g(t?`WS_POLICY_REJECTED`:`WS_CONNECTION_UNAVAILABLE`,t?`WebSocket connection rejected by peer policy`:`WebSocket closed before connection completed`)}function v(e,t=`unknown error`){return`message`in e?String(e.message):t}async function y(e,t,n){let r=await t.encode(e);n.send(r)}function ce(e,t,n){return n?.aborted?Promise.reject(n.reason):e.readyState===1?Promise.resolve():e.readyState>=2?Promise.reject(_()):new Promise((r,i)=>{let a=()=>{u!==void 0&&clearTimeout(u),e.removeEventListener(`open`,o),e.removeEventListener(`error`,s),e.removeEventListener(`close`,c),n?.removeEventListener(`abort`,l)},o=()=>{a(),r()},s=e=>{a(),i(new g(`WS_CONNECTION_UNAVAILABLE`,`WebSocket connection failed — ${v(e)}`,{cause:e}))},c=e=>{a(),i(_(e))},l=()=>{a(),i(n?.reason)},u=t===void 0?void 0:setTimeout(()=>{a(),i(new g(`WS_CONNECTION_TIMEOUT`,`WebSocket open timed out after ${t}ms`))},t);e.addEventListener(`open`,o),e.addEventListener(`error`,s),e.addEventListener(`close`,c),n?.addEventListener(`abort`,l)})}function b(e){if(e.readyState!==0&&e.readyState!==1)return;let t=()=>{},n=()=>{e.removeEventListener(`error`,t),e.removeEventListener(`close`,n)};e.addEventListener(`error`,t),e.addEventListener(`close`,n);try{e.close()}catch(e){throw n(),e}}async function le(e,t,n){let r=await Promise.allSettled(Array.from(t).map(t=>t(e,n.receiveContext)));for(let e of r)e.status===`rejected`&&n.debug&&console.error(`[WebSocketClientTransport:${n.name}] Handler error:`,e.reason);return r.every(e=>e.status===`fulfilled`)}function ue(e,t){return{...t?.getReceiveContext?.(),transportName:e}}async function de(e,t){let{name:n,debug:r,auth:i,codec:a,messageTransform:o,correlations:s}=t,c=JSON.parse(e.toString());if(typeof c!=`object`||!c||typeof c.type!=`string`)return r&&console.error(`[WebSocketClientTransport:${n}] Invalid message structure:`,c),null;let l=c;if(i?.handleAuthMessage(l)||l.type===`heartbeat`)return null;let u=await a.decode(l);return!t.isCurrentSession()||o&&(u=await o(u),!t.isCurrentSession())||u.type===`heartbeat`?null:u.type===`subscribe-sync-complete`?(t.onSyncComplete(),null):u.type===`subscription-ack`?(typeof u.ackId==`string`&&t.onSubscriptionAck(u.ackId),null):d(u,s)?null:u}async function fe(e,t){let{name:n,debug:r,auth:i,handlers:a}=t,o=null;try{o=await de(e,t)}catch(e){r&&console.error(`[WebSocketClientTransport:${n}] Failed to parse message:`,e);return}if(o===null||!t.isCurrentSession())return;let s=ue(n,i),c=o;le(c,a,{debug:r,name:n,receiveContext:s}).then(async e=>{e&&(c.type===`subscribe`||c.type===`unsubscribe`)&&typeof c.ackId==`string`&&await t.sendSubscriptionAck(c.ackId)}).catch(e=>{r&&console.error(`[WebSocketClientTransport:${n}] Handler dispatch error:`,e)})}function pe(e){let t=e;return typeof t.ping==`function`&&typeof t.terminate==`function`&&typeof t.on==`function`&&typeof t.off==`function`}function me(e){e.unref?.()}function he(e,t,n){if(!pe(e))return()=>{};let r=!1,i=Date.now(),a=null,o=null,s=()=>{if(r)return;let e=Date.now()-i,n=Math.max(0,t.intervalMs-e);a=setTimeout(l,n),me(a)},c=()=>{o=null,f(),n.debug&&console.warn(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Heartbeat deadline expired (no message/pong within ${t.timeoutMs}ms) — terminating socket`),e.terminate()},l=()=>{if(a=null,!r&&o===null){if(Date.now()-i<t.intervalMs){s();return}e.readyState===1&&(e.ping(),o=setTimeout(c,t.timeoutMs),me(o))}},u=()=>{i=Date.now(),o!==null&&(clearTimeout(o),o=null),a===null&&s()},d=()=>{f()},f=()=>{r||(r=!0,a!==null&&(clearTimeout(a),a=null),o!==null&&(clearTimeout(o),o=null),e.removeEventListener(`message`,u),e.removeEventListener(`close`,d),e.off(`pong`,u))};return e.addEventListener(`message`,u),e.on(`pong`,u),e.addEventListener(`close`,d),s(),f}async function x(e,t){await Promise.allSettled(e.inFlightMessages),e.getSocket()===t&&e.correlations.rejectAll(e.getSessionFailure()??new n(e.name))}function ge(e,t){let n=n=>{if(t.getSocket()!==e)return;let r=fe(n.data,{isCurrentSession:()=>t.getSocket()===e,name:t.name,debug:t.debug,auth:t.auth,codec:t.codec,messageTransform:t.messageTransform,correlations:t.correlations,handlers:t.handlers,onSyncComplete:()=>{t.readiness===`peer-sync`&&t.resolveReady()},onSubscriptionAck:e=>{t.resolveSubscriptionAck(e)},sendSubscriptionAck:async n=>{t.getSocket()!==e||e.readyState!==1||await y({type:`subscription-ack`,ackId:n},t.codec,e)}}).finally(()=>{t.inFlightMessages.delete(r)});t.inFlightMessages.add(r)};t.setMessageListener(n),e.addEventListener(`message`,n)}function S(e,t){if(t.getSocket()!==e)return;let n=t.getMessageListener();n!==null&&(e.removeEventListener(`message`,n),t.setMessageListener(null));let r=t.getCloseListener();r!==null&&(e.removeEventListener(`close`,r),t.setCloseListener(null))}function _e(e,t,n){let r=[n];if(t.getSocket()===e){S(e,t),t.setSocket(null,n instanceof Error?n:Error(`WebSocket connection failed`,{cause:n})),t.setAuthComplete(!1);try{t.auth?.cleanup()}catch(e){r.push(e)}}try{b(e)}catch(e){r.push(e)}return r.length===1?n:AggregateError(r,`WebSocket connection failed and cleanup was incomplete`,{cause:n})}async function ve(e,t){t.throwIfAborted();let n=new AbortController,r=()=>n.abort(new g(`WS_CONNECTION_UNAVAILABLE`,`WebSocket connection cancelled`));t.addEventListener(`abort`,r);let i=setTimeout(()=>n.abort(new g(`WS_CONNECTION_TIMEOUT`,`WebSocket connection timed out after ${e.connectTimeoutMs}ms`)),e.connectTimeoutMs),a=null,o=()=>{},s=()=>{a?.removeEventListener(`close`,c),a?.removeEventListener(`error`,l)},c=e=>n.abort(_(e)),l=e=>n.abort(new g(`WS_CONNECTION_UNAVAILABLE`,`WebSocket connection failed — ${v(e)}`,{cause:e})),u=t=>{if(o(),a===null)return t;let n=a;return s(),a=null,_e(n,e,t)},d=()=>{},f=new Promise((e,t)=>{d=()=>{t(u(n.signal.reason))},n.signal.addEventListener(`abort`,d)});try{let t=ye(e,n.signal,()=>{o=e.resetReadyPromise()},t=>{a=t,e.setSocket(t),e.setAuthComplete(!1),t.addEventListener(`close`,c),t.addEventListener(`error`,l),ge(t,e)});await Promise.race([t,f])}catch(e){throw u(e)}finally{clearTimeout(i),t.removeEventListener(`abort`,r),n.signal.removeEventListener(`abort`,d),s()}}async function ye(e,t,r,i){e.inFlightMessages.size>0&&await Promise.allSettled(e.inFlightMessages),t.throwIfAborted();let a=e.getSocket();e.correlations.rejectAll(e.getSessionFailure()??new n(e.name)),e.inFlightMessages.clear(),e.resolveReady(),e.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: reconnecting before subscription ack`)),r(),t.throwIfAborted(),a!==null&&S(a,e);let o=await e.wsFactory(e.url);t.aborted&&(b(o),t.throwIfAborted()),i(o),await be(o,e,t)}async function be(e,t,n){if(await ce(e,void 0,n),n.throwIfAborted(),t.auth&&(await t.auth.authenticateClient(t=>{if(n.throwIfAborted(),e.readyState!==1)throw _();e.send(JSON.stringify(t))}),n.throwIfAborted()),t.setAuthComplete(!0),t.localSubscriptions.size>0){let r=await t.codec.encode(s(t.localSubscriptions));n.throwIfAborted(),e.send(r)}t.heartbeat!==!1&&he(e,t.heartbeat,t),t.readiness===`session-established`&&t.resolveReady(),t.debug&&console.info(`[WebSocketClientTransport:${t.name}] Connected to ${t.url}`),t.notifyConnected()}function xe(e,t){return new Promise(n=>{if(e.readyState===3||t.aborted){n();return}let r=()=>{t.removeEventListener(`abort`,i),n()},i=()=>{e.removeEventListener(`close`,r),n()};e.addEventListener(`close`,r),t.addEventListener(`abort`,i)})}async function Se(e,t,r,i,a){a(!0);try{for(;!e.aborted;){let a=r.getSocket(),o=a!==null;if(a!==null&&a.readyState!==3&&await xe(a,e),e.aborted)break;if(o&&a!==null){if(await x(r,a),e.aborted)break;r.debug&&console.info(`[WebSocketClientTransport:${r.name}] ${new Date().toISOString()} Connection lost, starting reconnect loop (maxMs=${t.maxMs})`),r.notifyDisconnected()}let s=0;for(;!e.aborted;){let a=ne(s,t.baseMs,t.maxMs);r.debug&&console.info(`[WebSocketClientTransport:${r.name}] ${new Date().toISOString()} Reconnecting in ${a}ms (attempt ${s+1})`);let o=new AbortController;if(i(o),await re(a,AbortSignal.any([e,o.signal])),i(null),e.aborted)break;try{if(await ve(r,e),e.aborted)break;s=0;let t=r.getSocket();if(t!==null){let i=async()=>{await Promise.allSettled(r.inFlightMessages),!(e.aborted||r.getSocket()!==t)&&(r.correlations.rejectAll(r.getSessionFailure()??new n(r.name)),r.auth?.cleanup(),r.setAuthComplete(!1),r.debug&&console.info(`[WebSocketClientTransport:${r.name}] ${new Date().toISOString()} Connection closed`),r.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: disconnected before subscription ack`)))};r.setCloseListener(i),t.addEventListener(`close`,i),await xe(t,e)}break}catch(e){if(r.debug){let t=e instanceof Error?e.message:String(e);console.warn(`[WebSocketClientTransport:${r.name}] ${new Date().toISOString()} Connect attempt ${s+1} failed: ${t}`)}s++}}}}finally{a(!1)}}function Ce(e,t,n){let r=async()=>{t.getSocket()===e&&(S(e,t),t.auth?.cleanup(),t.setAuthComplete(!1),n(),t.resolveReady(),t.notifyDisconnected(),await x(t,e),t.getSocket()===e&&(t.setSocket(null),t.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: disconnected before subscription ack`))))};t.setCloseListener(r),e.addEventListener(`close`,r)}async function we(e,t,n,r,i){let a=i.localSubscriptions.get(e),o=a?.filter,c=t??o,l=r??a?.deliveryClass??`relayable`;if(i.localSubscriptions.set(e,{filter:c,priorities:n,deliveryClass:l}),i.socket!==null&&i.socket.readyState===1){let t=i.beginSubscriptionAck?.(),r=s(new Map([[e,{filter:c,priorities:n,deliveryClass:l}]]),t?.ackId);try{await y(r,i.codec,i.socket),await t?.promise}catch(e){throw t?.reject(e),e}}i.debug&&console.info(`[WebSocketClientTransport:${i.name}] Subscribed to ${e}${c?` with filter`:``}`)}async function Te(e,t){let n=t.localSubscriptions.get(e);if(t.localSubscriptions.delete(e),t.socket!==null&&t.socket.readyState===1){let r=t.beginSubscriptionAck?.(),i=c({[e]:n?.priorities??[]},r?.ackId);try{await y(i,t.codec,t.socket),await r?.promise}catch(e){throw r?.reject(e),e}}t.debug&&console.info(`[WebSocketClientTransport:${t.name}] Unsubscribed from ${e}`)}var Ee=class{name;termination=new AbortController;ownedSocket;onClose;constructor(e,t){this.name=t,this.ownedSocket=e,this.onClose=e=>{let r=_(e);this.end(r.code===`WS_POLICY_REJECTED`?r:new n(t))},e.addEventListener(`close`,this.onClose)}get socket(){return this.ownedSocket}get signal(){return this.termination.signal}get failure(){return this.signal.reason instanceof Error?this.signal.reason:void 0}end(e){this.ownedSocket?.removeEventListener(`close`,this.onClose),this.termination.abort(e)}release(e=new n(this.name)){this.end(e),this.ownedSocket=null}writable(e,t){if(t?.throwIfAborted(),this.signal.throwIfAborted(),e!==this||this.ownedSocket===null)throw new n(this.name);let r=this.ownedSocket;if(r.readyState===2||r.readyState===3){if(t===void 0)throw Error(`WebSocket is closing; uncorrelated message was not sent`);return De(new Promise(()=>{}),AbortSignal.any([t,this.signal]))}if(r.readyState!==1)throw new n(this.name);return r}};async function De(e,t){let n=()=>{},r=new Promise((e,r)=>{n=()=>r(t.reason),t.addEventListener(`abort`,n,{once:!0}),t.aborted&&n()});try{return await Promise.race([e,r])}finally{t.removeEventListener(`abort`,n)}}async function Oe(e,t,r){let i=e.session;if(i===null)throw new n(e.name);if(i.signal.throwIfAborted(),t.type!==`request`&&t.type!==`broadcast`)return await ke(e,i,t),h(t,e.correlations,r);let a=new AbortController,o=h(t,e.correlations,r).then(e=>(a.abort(),e),e=>{throw a.abort(e),e});return ke(e,i,t,a.signal).catch(n=>{if(a.signal.aborted)return;let r=n instanceof Error?n:Error(`WebSocket send failed`,{cause:n});e.correlations.reject(t.correlationId,r)}),o}async function ke(e,t,n,r){let i=t.writable(e.currentSession(),r);i instanceof Promise&&await i;let a=r===void 0?t.signal:AbortSignal.any([r,t.signal]);a.throwIfAborted();let o=await De(e.codec.encode(n),a),s=t.writable(e.currentSession(),r);s instanceof Promise?await s:s.send(o)}var C=class{name;url;auth;codec;messageTransform;autoReconnectConfig;heartbeatConfig;connectTimeoutMs;readiness;wsFactory;debug;onConnectedCallback;onDisconnectedCallback;session=null;authComplete=!1;correlations=new r;handlers=new Set;localSubscriptions=new Map;pendingSubscriptionAcks=new Map;subscriptionAckSeq=0;messageListener=null;closeListener=null;reconnectAbort=null;inFlightMessages=new Set;backoffWakeAbort=null;reconnectLoopRunning=!1;readyResolve=null;ready;onNewReadySession=void 0;onConnected=void 0;onDisconnected=void 0;get socket(){return this.session?.socket??null}constructor(e){this.url=e.url,this.name=e.name??`ws-client`,this.auth=e.auth,this.codec=e.codec??ae,this.messageTransform=e.messageTransform,this.debug=e.debug??!1,this.autoReconnectConfig=oe(e.autoReconnect),this.heartbeatConfig=se(e.heartbeat),this.connectTimeoutMs=e.connectTimeoutMs??3e4,this.readiness=e.readiness??`peer-sync`,this.wsFactory=e.createWebSocket??this.defaultWsFactory,this.onConnectedCallback=e.onConnected,this.onDisconnectedCallback=e.onDisconnected,this.ready=new Promise(e=>{this.readyResolve=e})}async connect(){if(this.reconnectAbort!==null)throw Error(`WebSocketClientTransport: already connected`);let e=new AbortController;this.reconnectAbort=e;try{await ve(this.connectionDeps(),e.signal)}catch(t){throw this.reconnectAbort===e&&(this.reconnectAbort=null),t}if(e.signal.aborted||this.reconnectAbort!==e)throw new g(`WS_CONNECTION_UNAVAILABLE`,`WebSocket connection cancelled`);this.autoReconnectConfig===!1?this.socket!==null&&this.wireNoReconnectClose(this.socket):this.startReconnectLoop(e.signal)}async disconnect(){let e=this.reconnectAbort,t=this.socket;this.reconnectAbort=null,e?.abort(new g(`WS_CONNECTION_UNAVAILABLE`,`WebSocket connection cancelled`));let r=t===null||this.socket===t;if(this.reconnectLoopRunning=!1,this.backoffWakeAbort=null,this.readyResolve?.(),this.readyResolve=null,this.socket!==null){S(this.socket,this.connectionDeps());let e=this.socket;this.session?.release(),this.authComplete=!1,b(e)}this.correlations.rejectAll(this.session?.failure??new n(this.name)),this.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: disconnected before subscription ack`)),r&&this.auth?.cleanup(),this.handlers.clear(),this.debug&&console.info(`[WebSocketClientTransport:${this.name}] Disconnected`)}async send(e,t){return Oe({session:this.session,currentSession:()=>this.session,name:this.name,codec:this.codec,correlations:this.correlations},e,t??i)}onReceive(e){return this.handlers.add(e),()=>{this.handlers.delete(e)}}async subscribe(e,t,n=[],r){await we(e,t,n,r,this.subscriptionDeps())}async unsubscribe(e){await Te(e,this.subscriptionDeps())}getSubscriptions(){return new Set(this.localSubscriptions.keys())}cancelRequest(e,t){this.correlations.cancel(e,t)}hasLiveWireSession(){return this.socket!==null&&this.socket.readyState===1&&this.authComplete}isReady(){return this.hasLiveWireSession()}canSend(e){return this.hasLiveWireSession()&&(this.codec.canEncode?.(e)??!0)}async reconnect(){if(!this.hasLiveWireSession()){if(this.backoffWakeAbort!==null){this.backoffWakeAbort.abort(),this.backoffWakeAbort=null;return}if(this.autoReconnectConfig!==!1){if(this.reconnectLoopRunning){let e=this.socket;e!==null&&e.readyState===0&&e.close();return}return}try{this.reconnectAbort===null&&await this.connect()}catch{}}}startReconnectLoop(e){return Se(e,this.autoReconnectConfig,this.connectionDeps(),t=>{e.aborted||(this.backoffWakeAbort=t)},t=>{this.reconnectAbort?.signal===e&&(this.reconnectLoopRunning=t)})}subscriptionDeps(){return{name:this.name,debug:this.debug,codec:this.codec,socket:this.socket,localSubscriptions:this.localSubscriptions,beginSubscriptionAck:()=>this.beginSubscriptionAck()}}beginSubscriptionAck(){let e=`${this.name}:sub:${++this.subscriptionAckSeq}`,t,n,r=new Promise((e,r)=>{t=e,n=r});r.catch(()=>void 0);let i=t=>{this.pendingSubscriptionAcks.has(e)&&(this.pendingSubscriptionAcks.delete(e),t())};return this.pendingSubscriptionAcks.set(e,{resolve:()=>i(t),reject:e=>i(()=>n(e))}),{ackId:e,promise:r,reject:t=>this.rejectSubscriptionAck(e,t)}}resolveSubscriptionAck(e){this.pendingSubscriptionAcks.get(e)?.resolve()}rejectSubscriptionAck(e,t){this.pendingSubscriptionAcks.get(e)?.reject(t)}rejectPendingSubscriptionAcks(e){for(let t of this.pendingSubscriptionAcks.keys())this.rejectSubscriptionAck(t,e)}connectionDeps(){return{name:this.name,debug:this.debug,auth:this.auth,codec:this.codec,messageTransform:this.messageTransform,correlations:this.correlations,handlers:this.handlers,localSubscriptions:this.localSubscriptions,wsFactory:this.wsFactory,url:this.url,connectTimeoutMs:this.connectTimeoutMs,readiness:this.readiness,heartbeat:this.heartbeatConfig,getSocket:()=>this.socket,setSocket:(e,t)=>{this.session?.release(t),e!==null&&(this.session=new Ee(e,this.name))},getSessionFailure:()=>this.session?.failure,setAuthComplete:e=>{this.authComplete=e},getMessageListener:()=>this.messageListener,setMessageListener:e=>{this.messageListener=e},getCloseListener:()=>this.closeListener,setCloseListener:e=>{this.closeListener=e},resolveReady:()=>{this.readyResolve?.(),this.readyResolve=null},resetReadyPromise:()=>{let e;this.ready=new Promise(t=>{this.readyResolve=t,e=t});let t=()=>{e(),this.readyResolve===e&&(this.readyResolve=null)};try{this.onNewReadySession?.(this.ready)}catch(e){throw t(),e}return t},resolveSubscriptionAck:e=>{this.resolveSubscriptionAck(e)},rejectPendingSubscriptionAcks:e=>{this.rejectPendingSubscriptionAcks(e)},notifyConnected:()=>{let e=this.socket;this.onConnectedCallback?.(),this.socket===e&&this.hasLiveWireSession()&&this.onConnected?.()},notifyDisconnected:()=>{this.onDisconnectedCallback?.(),this.onDisconnected?.()},inFlightMessages:this.inFlightMessages}}defaultWsFactory=async e=>new(await(import(`ws`))).WebSocket(e);wireNoReconnectClose(e){Ce(e,this.connectionDeps(),()=>{this.reconnectAbort=null})}};function w(e){e.timer!==void 0&&clearTimeout(e.timer)}var Ae=class{pendingBroadcasts=new Map;timeout;debug;constructor(e={}){this.timeout=e.timeout??5e3,this.debug=e.debug??!1}startClientBroadcast(e,t,n,r,i){let a=t.correlationId,o=i??this.timeout,s={kind:`client`,sender:e,results:[],pendingClients:new Set(n),nodeResultsReceived:!1,timer:o===0?void 0:setTimeout(()=>{this.debug&&console.warn(`[BroadcastAggregator] Broadcast ${a} timed out`),this.finalizeBroadcast(a)},o)};this.pendingBroadcasts.set(a,s);let c=JSON.stringify(t);for(let e of n)r(e,c);this.debug&&console.info(`[BroadcastAggregator] Broadcast ${a} forwarded to ${n.length} clients`)}startServerBroadcast(e,t,n,r){let i=e.correlationId,a=r??this.timeout;return t.length===0?(this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${i} - no target clients`),Promise.resolve([])):new Promise(r=>{let o={kind:`server`,results:[],pendingClients:new Set(t),timer:a===0?void 0:setTimeout(()=>{this.debug&&console.warn(`[BroadcastAggregator] Server broadcast ${i} timed out`),this.finalizeServerBroadcast(i)},a),resolve:r};this.pendingBroadcasts.set(i,o);let s=JSON.stringify(e);for(let e of t)n(e,s);this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${i} sent to ${t.length} clients`)})}handleResponse(e,t){let n=this.pendingBroadcasts.get(t.correlationId);return n?(t.results&&n.results.push(...t.results),n.pendingClients.delete(e),this.debug&&console.info(`[BroadcastAggregator] Broadcast ${t.correlationId} got response, ${n.pendingClients.size} pending`),this.checkBroadcastComplete(t.correlationId,n),!0):!1}handleNodeResults(e,t,n){let r=this.pendingBroadcasts.get(e);return!r||r.kind!==`client`?!1:(r.results.push(...t),r.nodeResultsReceived=!0,r.nodeError=n,this.debug&&console.info(`[BroadcastAggregator] Broadcast ${e} node results aggregated${n?` (with error)`:``}`),this.checkBroadcastComplete(e,r),!0)}handleClientDisconnect(e){for(let[t,n]of this.pendingBroadcasts)n.kind===`client`&&n.sender===e?(w(n),this.pendingBroadcasts.delete(t)):n.pendingClients.has(e)&&(n.pendingClients.delete(e),this.checkBroadcastComplete(t,n))}cleanup(){for(let e of this.pendingBroadcasts.values())w(e),e.kind===`server`&&e.resolve(e.results);this.pendingBroadcasts.clear()}checkBroadcastComplete(e,t){if(!(t.pendingClients.size>0))if(t.kind===`client`){if(!t.nodeResultsReceived)return;this.finalizeBroadcast(e)}else this.finalizeServerBroadcast(e)}finalizeBroadcast(e){let t=this.pendingBroadcasts.get(e);if(!t||t.kind!==`client`)return;w(t),this.pendingBroadcasts.delete(e);let n=t.nodeError?{type:`broadcast-response`,correlationId:e,error:t.nodeError}:{type:`broadcast-response`,correlationId:e,results:t.results};t.sender.readyState===1&&t.sender.send(JSON.stringify(n)),this.debug&&console.info(`[BroadcastAggregator] Broadcast ${e} finalized with ${t.results.length} results`)}finalizeServerBroadcast(e){let t=this.pendingBroadcasts.get(e);!t||t.kind!==`server`||(w(t),this.pendingBroadcasts.delete(e),t.resolve(t.results),this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${e} finalized with ${t.results.length} results`))}},je=class{clients=new Set;authenticatingClients=new Set;clientSubscriptions=new Map;clientSubscriptionState=new Map;clientFilters=new Map;requestOrigins=new Map;debug;subscriptionSubjectRestrictionResolver;requiredSubscriptionFilterResolver;socketAuthChecker;constructor(e={}){this.debug=e.debug??!1,this.subscriptionSubjectRestrictionResolver=e.subscriptionSubjectRestrictionResolver,this.requiredSubscriptionFilterResolver=e.requiredSubscriptionFilterResolver,this.socketAuthChecker=e.socketAuthChecker}addAuthenticating(e){this.authenticatingClients.add(e)}removeAuthenticating(e){this.authenticatingClients.delete(e)}isAuthenticating(e){return this.authenticatingClients.has(e)}addClient(e){this.clients.add(e)}removeClient(e){let t=new Set(this.clientSubscriptionState.get(e)?.keys()??[]);this.clients.delete(e),this.authenticatingClients.delete(e),this.clientSubscriptions.delete(e),this.clientSubscriptionState.delete(e),this.clientFilters.delete(e);for(let[t,n]of this.requestOrigins)n.socket===e&&this.clearRequestOrigin(t,n);return this.debug&&console.info(`[ClientRegistry] Client removed (${this.clients.size} remaining)`),this.buildAggregateUpdates(t)}get size(){return this.clients.size}getAllSockets(){return new Set([...this.clients,...this.authenticatingClients])}handleSubscribeMessage(e,t){let n=this.clientSubscriptions.get(e);n||(n=new Set,this.clientSubscriptions.set(e,n));let r=this.clientFilters.get(e),i=this.clientSubscriptionState.get(e);i||(i=new Map,this.clientSubscriptionState.set(e,i));for(let[a,o]of Object.entries(t.subjects)){n.add(a),i.set(a,{priorities:o,deliveryClass:t.deliveryClasses?.[a]===`relayable`?`relayable`:`first-hop-only`});let s=t.filters?.[a];s===void 0?r?.delete(a):(r||(r=new Map,this.clientFilters.set(e,r)),r.set(a,s))}if(this.debug){let e=Object.keys(t.subjects).length,n=t.filters?Object.keys(t.filters).length:0;console.info(`[ClientRegistry] Client subscribed to ${e} subjects, ${n} filters`)}return this.buildAggregateUpdates(new Set(Object.keys(t.subjects)))}handleUnsubscribeMessage(e,t){let n=this.clientSubscriptions.get(e),r=this.clientFilters.get(e);for(let i of Object.keys(t))n?.delete(i),this.clientSubscriptionState.get(e)?.delete(i),r?.delete(i);return this.debug&&console.info(`[ClientRegistry] Client unsubscribed from ${Object.keys(t).length} subjects`),this.buildAggregateUpdates(new Set(Object.keys(t)))}getReadyClients(){let e=[];for(let t of this.clients)t.readyState===1&&e.push(t);return e}trackRequestOrigin(e,t){let{correlationId:n}=t;if(this.requestOrigins.has(n))return;let r=this.getRequestRemainingLifetime(t);if(r!==void 0&&r<=0)return;let i={socket:e,expiration:void 0};r!==void 0&&(i.expiration=setTimeout(()=>{this.requestOrigins.get(n)===i&&this.requestOrigins.delete(n)},r)),this.requestOrigins.set(n,i)}getRequestOrigin(e){return this.requestOrigins.get(e)?.socket}consumeResponseClient(e){let t=this.requestOrigins.get(e);if(t)return this.clearRequestOrigin(e,t),this.isReadyAndAuthenticated(t.socket)?t.socket:void 0}cancelRequestOrigin(e){let t=this.requestOrigins.get(e);t&&this.clearRequestOrigin(e,t)}getInterestedClients(e,t,n){let r=[];for(let i of this.clients)i===n||!this.isReadyAndAuthenticated(i)||this.clientWantsMessage(i,e,t)&&this.isSubjectAllowedForClient(i,e)&&this.isPayloadAllowedForClient(i,e,t)&&r.push(i);return r}getInterestedRequestClients(e,t,n){return this.getInterestedClients(e,t,n).filter(t=>{let n=this.clientSubscriptionState.get(t);return n?[...n].some(([t,n])=>n.priorities.length>0&&m(e,t)):!1})}forwardEventToClients(e,t,n){let r=u(t)??void 0,i=`payload`in t?t.payload:void 0,a=JSON.stringify(t),o=this.getInterestedClients(r,i,e);for(let e of o)n(e,a)}clientWantsMessage(e,t,n){return ee(t,n,this.clientSubscriptions.get(e)??new Set,this.clientFilters.get(e)??new Map)}isReadyAndAuthenticated(e){return e.readyState===1?!this.socketAuthChecker||this.socketAuthChecker(e)?!0:(e.close(1008,`Authentication expired`),!1):!1}getRequestRemainingLifetime(e){let t=e.timeout??i;return t>0?t:void 0}clearRequestOrigin(e,t){t.expiration!==void 0&&clearTimeout(t.expiration),this.requestOrigins.delete(e)}isSubjectAllowedForClient(e,t){if(!this.subscriptionSubjectRestrictionResolver||t===void 0)return!0;let n=this.subscriptionSubjectRestrictionResolver(e);return n===null?!0:[...n].some(e=>m(t,e))}isPayloadAllowedForClient(e,t,n){if(!this.requiredSubscriptionFilterResolver||t===void 0)return!0;let r=this.requiredSubscriptionFilterResolver(e)?.[t];return r===void 0||p(n,r)}buildAggregateUpdates(e){let t={},n={},r={};for(let i of e){let e=new Set,a=!1,o=`relayable`;for(let t of this.clientSubscriptionState.values()){let n=t.get(i);if(n){a=!0;for(let t of n.priorities)e.add(t);n.deliveryClass===`first-hop-only`&&(o=`first-hop-only`)}}a?(t[i]=[...e].sort((e,t)=>t-e),n[i]=o):r[i]=[]}let i=[];return Object.keys(t).length>0&&i.push({type:`subscribe`,subjects:t,deliveryClasses:n}),Object.keys(r).length>0&&i.push({type:`unsubscribe`,subjects:r}),i}};const T=new Map;function Me(e){if(typeof e==`object`&&e){for(let t of Object.values(e))Me(t);Object.freeze(e)}return e}function Ne(e){let t=Object.fromEntries(Object.entries(e).map(([e,t])=>[e,Me(structuredClone(t))]));return Object.freeze(t)}function E(e,t){let n=!0;return()=>{n&&(n=!1,T.get(e)===t&&T.delete(e))}}function Pe(e,t,n){if(e.trim().length===0)throw Error(`registerHmacIdentitySecret requires a non-empty identityId`);if(t.length===0)throw Error(`registerHmacIdentitySecret requires a non-empty secret`);if(`allowedSubjects`in n)throw Error(`registerHmacIdentitySecret no longer accepts allowedSubjects; use allowedMessageSubjects and/or allowedSubscriptionSubjects`);let r=n.peerKind.trim();if(r.length===0)throw Error(`registerHmacIdentitySecret requires a non-empty peerKind`);let i=n.allowedMessageSubjects!==void 0||n.allowedSubscriptionSubjects!==void 0;if(n.requiredSubscriptionFilters!==void 0){for(let e of Object.keys(n.requiredSubscriptionFilters))if(e.includes(`*`))throw Error(`registerHmacIdentitySecret requires exact full subjects for requiredSubscriptionFilters`)}let a={secret:t,peerKind:r,...n.claims===void 0?{}:{claims:n.claims},...i?{allowedMessageSubjects:new Set(n.allowedMessageSubjects??[]),allowedSubscriptionSubjects:new Set(n.allowedSubscriptionSubjects??[])}:{},...n.requiredSubscriptionFilters===void 0?{}:{requiredSubscriptionFilters:Ne(n.requiredSubscriptionFilters)}};return T.set(e,a),E(e,a)}function Fe(e,t,n={}){if(t.length===0)throw Error(`rotateHmacIdentitySecret requires a non-empty secret`);let r=T.get(e);if(!r)throw Error(`Cannot rotate HMAC identity secret: no registration exists for '${e}'`);let i={secret:t,peerKind:r.peerKind,...n.claims===void 0?r.claims===void 0?{}:{claims:r.claims}:{claims:n.claims},...r.allowedMessageSubjects===void 0?{}:{allowedMessageSubjects:r.allowedMessageSubjects},...r.allowedSubscriptionSubjects===void 0?{}:{allowedSubscriptionSubjects:r.allowedSubscriptionSubjects},...r.requiredSubscriptionFilters===void 0?{}:{requiredSubscriptionFilters:r.requiredSubscriptionFilters}};return T.set(e,i),E(e,i)}function Ie(e){let t=T.get(e);return t===void 0?void 0:E(e,t)}function Le(e){return T.get(e)?.secret??null}function Re(e){let t=T.get(e);return t?{kind:t.peerKind,id:e,authenticated:!0,...t.claims===void 0?{}:{claims:t.claims}}:null}function ze(e){return T.get(e)?.allowedMessageSubjects??null}function D(e){return T.get(e)?.allowedSubscriptionSubjects??null}function Be(e){return T.get(e)?.requiredSubscriptionFilters??null}function Ve(){T.clear()}function He(e){return e.type===`request`||e.type===`event`||e.type===`broadcast`}function Ue(e){return t(e)&&Object.values(e).every(e=>Array.isArray(e)&&e.every(e=>typeof e==`number`&&Number.isFinite(e)))}function We(e){return e.endsWith(`*`)}function Ge(e,t,n,r){let i={};for(let[a,o]of Object.entries(e))We(a)?t===null||t.has(a)?i[a]=o:n&&console.debug(`[ServerTransport] Dropping wildcard subscription '${a}': not in allowedSubscriptionSubjects for peer '${r}'`):t===null||[...t].some(e=>m(a,e))?i[a]=o:n&&console.debug(`[ServerTransport] Dropping subscription subject '${a}': not allowed for peer '${r}'`);return Object.keys(i).length>0?i:null}async function O(e,t,n){let r=await Promise.allSettled(Array.from(t).map(t=>t(e,n.receiveContext)));for(let e of r)if(e.status===`rejected`&&n.debug){let t=n.logContext?` ${n.logContext}`:``;console.error(`[ServerTransport] Handler error${t}:`,e.reason)}return r.every(e=>e.status===`fulfilled`)}async function Ke(e,t,n){let r=!0;for(let i of e)await O(i,t,n)||(r=!1);return r}function qe(e,t,n){let{correlations:r,broadcastAggregator:i,debug:a}=t;if(e.type===`heartbeat`)return!0;if(e.type===`response`){let t=e;return typeof t.correlationId==`string`?(t.error?r.reject(t.correlationId,l(t.error)):r.resolve(t.correlationId,t.result),!0):(a&&console.warn(`[ServerTransport] Malformed response message: missing correlationId`),!0)}if(e.type===`broadcast-response`){let t=e;return typeof t.correlationId==`string`?(i.handleResponse(n,t),!0):(a&&console.warn(`[ServerTransport] Malformed broadcast-response: missing correlationId`),!0)}return!1}function Je(e){let t=e?.peer?.id;if(t===void 0)return null;let n=ze(t),r=D(t);return n===null&&r===null?null:{peerId:t,allowedMessageSubjects:n,allowedSubscriptionSubjects:r}}function Ye(e,t,n,r){if(r===null||!He(e))return!1;let i=`${e.namespace}.${e.subject}`;return r.allowedMessageSubjects===null||r.allowedMessageSubjects.has(i)?!1:(e.type===`request`&&n.sendSafely(t,JSON.stringify({type:`response`,correlationId:e.correlationId,error:{message:`Subject '${i}' is not allowed for peer '${r.peerId}'`}})),n.debug&&console.warn(`[ServerTransport] Dropping ${e.type} to '${i}': not allowed for peer '${r.peerId}'`),!0)}function Xe(e,t,n){if(!Ue(e.subjects))return n&&console.warn(`[ServerTransport] Malformed ${e.type} message: missing subjects record`),null;if(t===null)return e.subjects;let r=Ge(e.subjects,t.allowedSubscriptionSubjects,n,t.peerId);return r===null&&n&&console.debug(`[ServerTransport] Dropping ${e.type} message: all subjects filtered for peer '${t.peerId}'`),r}async function Ze(e,t,n,r,i){if(e.type!==`subscribe`&&e.type!==`unsubscribe`)return!1;let a=e,o=Xe(a,i,n.debug);return o===null||await Ke(a.type===`subscribe`?n.registry.handleSubscribeMessage(t,{...a,subjects:o}):n.registry.handleUnsubscribeMessage(t,o),n.handlers,{debug:n.debug,receiveContext:r,logContext:`dispatching ${a.type}`})&&typeof a.ackId==`string`&&n.sendSafely(t,JSON.stringify({type:`subscription-ack`,ackId:a.ackId})),!0}async function Qe(e,t,n,r){if(e.type!==`broadcast`)return!1;let i=e;if(typeof i.correlationId!=`string`||typeof i.subject!=`string`)return n.debug&&console.warn(`[ServerTransport] Malformed broadcast message: missing correlationId or subject`),!0;let a=u(i)??void 0,o=n.registry.getInterestedClients(a,i.payload,t),s=n.normalizeBroadcastTimeout(i.timeout);return n.broadcastAggregator.startClientBroadcast(t,i,o,n.sendSafely,s),await O(e,n.handlers,{debug:n.debug,receiveContext:r}),!0}async function $e(e,t,n){if(qe(e,n,t))return;let r=n.auth?.getReceiveContext?.(t),i=Je(r);if(!Ye(e,t,n,i)){if(e.type===`subscribe`||e.type===`unsubscribe`){await Ze(e,t,n,r,i);return}if(e.type===`broadcast`){await Qe(e,t,n,r);return}e.type===`event`&&n.registry.forwardEventToClients(t,e,n.sendSafely),e.type===`request`&&n.registry.trackRequestOrigin(t,e),await O(e,n.handlers,{debug:n.debug,receiveContext:r})}}function et(e,t){let{auth:n,registry:r,debug:i}=t;return async a=>{let o;try{o=JSON.parse(a.toString())}catch(e){i&&console.error(`[ServerTransport] Failed to parse message:`,e);return}let s=o&&typeof o==`object`?o:void 0;if(!s||typeof s.type!=`string`){i&&console.error(`[ServerTransport] Invalid message structure:`,o);return}let c=o;try{if(n?.handleAuthMessage(c,e))return;if(n&&r.isAuthenticating(e)){i&&console.warn(`[ServerTransport] Ignoring message from unauthenticated client`);return}if(n?.isSocketAuthenticated?.(e)===!1){i&&console.warn(`[ServerTransport] Closing socket with expired authentication`),n.cleanupSocket(e),e.close(1008,`Authentication expired`);return}await $e(c,e,t)}catch(e){i&&console.error(`[ServerTransport] Failed to process message:`,e)}}}function tt(e){return typeof e!=`number`||!Number.isFinite(e)||e<=0?5e3:Math.min(e,6e4)}async function nt(e,t){let{registry:n,correlations:r,broadcastAggregator:i,handlers:a,auth:o,serverSubscriptions:c,sendSafely:l,debug:u}=t;o&&n.addAuthenticating(e);let d=et(e,{registry:n,correlations:r,broadcastAggregator:i,handlers:a,auth:o,normalizeBroadcastTimeout:tt,sendSafely:l,debug:u}),f=e=>{d(e.data)},p=()=>{o?.cleanupSocket(e);let t=n.removeClient(e);e.removeEventListener(`message`,f),e.removeEventListener(`close`,p),e.removeEventListener(`error`,m),i.handleClientDisconnect(e),Ke(t,a,{debug:u,logContext:`dispatching disconnected client subscriptions`}),u&&console.info(`[ServerTransport] Client disconnected (${n.size} remaining)`)},m=e=>{u&&console.error(`[ServerTransport] Client socket error:`,e)};e.addEventListener(`message`,f),e.addEventListener(`close`,p),e.addEventListener(`error`,m);try{if(o&&(await o.authenticateServer(e,t=>{if(e.readyState!==1)throw Error(`Cannot send auth message: socket not ready (state: ${e.readyState})`);e.send(JSON.stringify(t))}),n.removeAuthenticating(e)),e.readyState!==1)return;if(n.addClient(e),c.size>0){let t=s(c);l(e,JSON.stringify(t))}l(e,JSON.stringify({type:`subscribe-sync-complete`})),u&&console.info(`[ServerTransport] Client connected (${n.size} total)`)}catch(t){if(u&&console.error(`[ServerTransport] Client connection setup failed:`,t),e.readyState>=2)return;let n=t instanceof g&&(t.code===`WS_AUTHENTICATION_REJECTED`||t.code===`WS_POLICY_REJECTED`);e.close(n?1008:1011,n?`Authentication failed`:`Connection setup failed`)}}async function rt(e,t,n){let{registry:r,correlations:i}=n,s=`${e.namespace}.${e.subject}`,c=r.getRequestOrigin(e.correlationId),l=r.getInterestedRequestClients(s,e.payload,c);if(l.length===0)throw new a(s);for(let[n,r]of l.entries()){let a=`${e.correlationId}:attempt-${n+1}`,c={...e,correlationId:a};try{r.send(JSON.stringify(c))}catch{continue}try{return await i.track(a,t)}catch(e){if(f(e,s)||e instanceof o)continue;throw e}}throw new a(s)}var it=class{name;wss;auth;debug;handlers=new Set;registry;serverSubscriptions=new Map;broadcastAggregator;correlations=new r;connectionListener=null;constructor(e){let{websocket:t,name:n=`websocket`,auth:r,debug:i=!1}=e;this.wss=t,this.name=n,this.auth=r,this.debug=i,this.registry=new je({debug:i,subscriptionSubjectRestrictionResolver:r?e=>{let t=(r.getReceiveContext?.(e))?.peer?.id;return t===void 0?null:D(t)}:void 0,requiredSubscriptionFilterResolver:r?e=>{let t=(r.getReceiveContext?.(e))?.peer?.id;return t===void 0?null:Be(t)}:void 0,socketAuthChecker:r?e=>r.isSocketAuthenticated?.(e)??!0:void 0}),this.broadcastAggregator=new Ae({debug:i})}sendToClientSafely(e,t){try{e.send(t)}catch(e){this.debug&&console.warn(`[ServerTransport] Failed to send message to client:`,e)}}async connect(){if(this.connectionListener!==null)throw Error(`ServerTransport.connect() called while already connected`);this.connectionListener=e=>{nt(e,{registry:this.registry,correlations:this.correlations,broadcastAggregator:this.broadcastAggregator,handlers:this.handlers,auth:this.auth,serverSubscriptions:this.serverSubscriptions,sendSafely:(e,t)=>this.sendToClientSafely(e,t),debug:this.debug})},this.wss.on(`connection`,this.connectionListener),this.debug&&console.info(`[ServerTransport] Listening for connections`)}async disconnect(){this.connectionListener&&=(this.wss.off(`connection`,this.connectionListener),null);let e=this.registry.getAllSockets();for(let t of e)t.close();await new Promise((e,t)=>{this.wss.close(n=>n?t(n):e())}),this.correlations.cleanup(),this.broadcastAggregator.cleanup(),this.auth?.cleanup(),this.handlers.clear(),this.serverSubscriptions.clear(),this.debug&&console.info(`[ServerTransport] Disconnected`)}async send(e,t){if(e.type===`response`){let t=this.registry.consumeResponseClient(e.correlationId);return t?(this.sendToClientSafely(t,JSON.stringify(e)),!0):!1}if(e.type===`broadcast`){let n=u(e)??void 0,r=`payload`in e?e.payload:void 0,i=this.registry.getInterestedClients(n,r);return this.broadcastAggregator.startServerBroadcast(e,i,(e,t)=>{this.sendToClientSafely(e,t)},t)}if(e.type===`request`)return rt(e,t??i,{registry:this.registry,correlations:this.correlations});if(this.registry.size===0){if(this.debug){let t=u(e);console.debug(`[ServerTransport] No clients to receive ${e.type}${t?`: ${t}`:``}`)}return!1}let n=u(e)??void 0,r=`payload`in e?e.payload:void 0,a=JSON.stringify(e),o=this.registry.getInterestedClients(n,r);for(let e of o)this.sendToClientSafely(e,a);let s=o.length>0;if(!s&&(n&&this.debug&&console.warn(`[ServerTransport] No interested clients for subject: ${n}`),!n))throw Error(`No connected clients available to receive message`);return s}onReceive(e){return this.handlers.add(e),()=>{this.handlers.delete(e)}}cancelRequest(e,t){this.correlations.cancel(e,t),this.registry.cancelRequestOrigin(e)}onBroadcastResults(e,t,n){this.broadcastAggregator.handleNodeResults(e,t,n)}async subscribe(e,t,n=[],r){let i=this.serverSubscriptions.get(e),a=i?.filter,o=t??a,c=r??i?.deliveryClass??`relayable`;if(this.serverSubscriptions.set(e,{filter:o,priorities:n,deliveryClass:c}),this.registry.size>0){let t=s(new Map([[e,{filter:o,priorities:n,deliveryClass:c}]])),r=JSON.stringify(t);for(let e of this.registry.getReadyClients())this.sendToClientSafely(e,r)}}getConnectionCount(){return this.registry.getReadyClients().length}async unsubscribe(e){if(this.serverSubscriptions.delete(e),this.registry.size>0){let t=c({[e]:[]}),n=JSON.stringify(t);for(let e of this.registry.getReadyClients())this.sendToClientSafely(e,n)}}};function at(e,t){let n=new Event(`close`);return Object.defineProperties(n,{code:{value:e??1e3,enumerable:!0},reason:{value:t??``,enumerable:!0}}),n}function ot(e){if(typeof e!=`object`||!e)throw TypeError(`WebSocket transport options must be an object`);let t=e;if(t.mode!==`client`&&t.mode!==`server`)throw TypeError(`WebSocket transport mode must be "client" or "server"`);if(t.mode===`client`){if(!st(t.websocket))throw TypeError(`WebSocket transport client mode requires a websocket with addEventListener/removeEventListener`);return}if(!ct(t.websocket))throw TypeError(`WebSocket transport server mode requires a websocket with on/off listener methods`)}function st(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.send==`function`&&typeof t.close==`function`&&typeof t.addEventListener==`function`&&typeof t.removeEventListener==`function`}function ct(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.on==`function`&&typeof t.off==`function`&&typeof t.close==`function`}var lt=class{secret;algorithm;challengeTimeout;identityId;resolveSecret;resolvePeer;pendingChallenge;pendingResult;queuedChallengeNonce;queuedResult;clientAuthComplete=!1;serverPendingResponses=new Map;serverAuthenticatedSockets=new Set;serverAuthenticatedPeers=new Map;serverAuthenticatedSecrets=new Map;constructor(e){this.secret=e.secret,this.algorithm=e.algorithm??`sha256`,this.challengeTimeout=e.challengeTimeout??5e3,this.identityId=e.identityId,this.resolveSecret=e.resolveSecret,this.resolvePeer=e.resolvePeer}async authenticateServer(e,t){let n=crypto.getRandomValues(new Uint8Array(32)),r=Array.from(n).map(e=>e.toString(16).padStart(2,`0`)).join(``),i=this.waitForAuthResponseWithIdentity(e),a=this.serverPendingResponses.get(e);i.catch(()=>void 0);try{t({type:`auth-challenge`,nonce:r});let{signature:n,identityId:o}=await i;this.assertServerOwner(e,a);let s;if(this.resolveSecret&&o!==void 0){let i=this.resolveSecret(o);if(i===null)throw this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!1,error:`Unknown identity`}),new g(`WS_AUTHENTICATION_REJECTED`,`HMAC authentication failed: Unknown identity '${o}'`);s=await this.computeHmacWithSecret(r,i),this.assertServerOwner(e,a),this.constantTimeEqual(n,s)&&(this.serverAuthenticatedPeers.set(e,o),this.serverAuthenticatedSecrets.set(e,i))}else s=await this.computeHmac(r),this.assertServerOwner(e,a);if(!this.constantTimeEqual(n,s))throw this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!1,error:`Invalid signature`}),new g(`WS_AUTHENTICATION_REJECTED`,`HMAC authentication failed: Invalid signature`);try{t({type:`auth-result`,success:!0}),this.assertServerOwner(e,a)}catch(t){throw this.serverPendingResponses.get(e)===a&&this.cleanupSocket(e),t}this.serverAuthenticatedSockets.add(e)}finally{clearTimeout(a.timeoutHandle),this.serverPendingResponses.get(e)===a&&this.serverPendingResponses.delete(e)}}async authenticateClient(e){this.clientAuthComplete=!1;let t=this.waitForAuthChallenge(),n=this.pendingChallenge;try{let r=await t;this.assertClientOwner(n);let i=await this.computeHmac(r);this.assertClientOwner(n),e({type:`auth-response`,signature:i,...this.identityId!==void 0&&{identityId:this.identityId}}),this.assertClientOwner(n);let a=await this.waitForAuthResult();if(this.assertClientOwner(n),!a.success)throw new g(`WS_AUTHENTICATION_REJECTED`,`HMAC authentication failed: ${a.error??`Unknown error`}`);this.clientAuthComplete=!0}finally{clearTimeout(n.timeoutHandle),this.pendingChallenge===n&&(this.pendingChallenge=void 0)}}assertClientOwner(e){if(this.pendingChallenge!==e)throw new g(`WS_CONNECTION_UNAVAILABLE`,`Socket disconnected during HMAC authentication`)}assertServerOwner(e,t){if(this.serverPendingResponses.get(e)!==t)throw new g(`WS_CONNECTION_UNAVAILABLE`,`Socket disconnected during HMAC authentication`)}handleAuthMessage(e,t){if(typeof e!=`object`||!e||!(`type`in e)||typeof e.type!=`string`)return!1;let n=e;if(n.type===`auth-challenge`)return typeof n.nonce!=`string`||this.clientAuthComplete||(this.pendingChallenge?(clearTimeout(this.pendingChallenge.timeoutHandle),this.pendingChallenge.resolve(n.nonce)):this.queuedChallengeNonce=n.nonce),!0;if(n.type===`auth-result`){if(typeof n.success!=`boolean`||this.clientAuthComplete)return!0;let e={success:n.success,error:typeof n.error==`string`?n.error:void 0};return this.pendingResult?(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.resolve(e),this.pendingResult=void 0):this.queuedResult=e,!0}if(n.type===`auth-response`){if(t){let e=this.serverPendingResponses.get(t);if(e){if(clearTimeout(e.timeoutHandle),n.identityId!==void 0&&typeof n.identityId!=`string`)return e.reject(new g(`WS_AUTHENTICATION_REJECTED`,`Malformed HMAC identity`)),!0;e.resolve({signature:n.signature,identityId:n.identityId})}}return!0}return!1}async waitForAuthChallenge(){return new Promise((e,t)=>{let n=setTimeout(()=>{t(new g(`WS_HANDSHAKE_TIMEOUT`,`Authentication challenge timeout`))},this.challengeTimeout);this.pendingChallenge={resolve:e,reject:t,timeoutHandle:n},this.queuedChallengeNonce!==void 0&&(clearTimeout(n),e(this.queuedChallengeNonce),this.queuedChallengeNonce=void 0)})}async waitForAuthResponseWithIdentity(e){return new Promise((t,n)=>{let r={resolve:t,reject:n,timeoutHandle:setTimeout(()=>{n(new g(`WS_HANDSHAKE_TIMEOUT`,`Authentication response timeout`))},this.challengeTimeout)};this.serverPendingResponses.set(e,r)})}async waitForAuthResult(){if(this.queuedResult!==void 0){let e=this.queuedResult;return this.queuedResult=void 0,e}return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingResult=void 0,t(new g(`WS_HANDSHAKE_TIMEOUT`,`Authentication result timeout`))},this.challengeTimeout);this.pendingResult={resolve:e,reject:t,timeoutHandle:n}})}async computeHmac(e){return this.computeHmacWithSecret(e,this.secret)}async computeHmacWithSecret(e,t){let n=new TextEncoder,r=n.encode(t),i=this.algorithm.replace(/^sha/,`SHA-`),a=await crypto.subtle.importKey(`raw`,r,{name:`HMAC`,hash:i},!1,[`sign`]),o=await crypto.subtle.sign(`HMAC`,a,n.encode(e));return Array.from(new Uint8Array(o)).map(e=>e.toString(16).padStart(2,`0`)).join(``)}getReceiveContext(e){if(!e)return;let t=this.serverAuthenticatedPeers.get(e);if(t===void 0)return;let n=this.resolvePeer?.(t);if(n!=null)return{transportName:``,peer:{...n,id:n.id??t,authenticated:!0}}}isSocketAuthenticated(e){if(!this.serverAuthenticatedSockets.has(e))return!1;if(!this.resolveSecret)return!0;let t=this.serverAuthenticatedPeers.get(e);if(t===void 0)return!0;let n=this.resolveSecret(t);if(n===null)return this.cleanupSocket(e),!1;let r=this.serverAuthenticatedSecrets.get(e);return r!==void 0&&n!==r?(this.cleanupSocket(e),!1):!0}constantTimeEqual(e,t){if(typeof e!=`string`||e.length!==t.length||!/^[0-9a-f]+$/i.test(e))return!1;let n=new Uint8Array(e.length/2),r=new Uint8Array(t.length/2);for(let i=0;i<n.length;i++)n[i]=parseInt(e.slice(i*2,i*2+2),16),r[i]=parseInt(t.slice(i*2,i*2+2),16);let i=0;for(let e=0;e<n.length;e++)i|=n[e]^r[e];return i===0}sendAuthResultBestEffort(e,t){try{e(t)}catch{}}cleanupSocket(e){let t=this.serverPendingResponses.get(e);t&&(clearTimeout(t.timeoutHandle),this.serverPendingResponses.delete(e),t.reject(new g(`WS_CONNECTION_UNAVAILABLE`,`Socket disconnected during HMAC authentication`))),this.serverAuthenticatedPeers.delete(e),this.serverAuthenticatedSecrets.delete(e),this.serverAuthenticatedSockets.delete(e)}cleanup(){this.pendingChallenge&&=(clearTimeout(this.pendingChallenge.timeoutHandle),this.pendingChallenge.reject(new g(`WS_CONNECTION_UNAVAILABLE`,`Socket disconnected during HMAC authentication`)),void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.reject(new g(`WS_CONNECTION_UNAVAILABLE`,`Socket disconnected during HMAC authentication`)),void 0),this.queuedChallengeNonce=void 0,this.queuedResult=void 0,this.clientAuthComplete=!1;for(let e of this.serverPendingResponses.values())clearTimeout(e.timeoutHandle),e.reject(new g(`WS_CONNECTION_UNAVAILABLE`,`Socket disconnected during HMAC authentication`));this.serverPendingResponses.clear(),this.serverAuthenticatedPeers.clear(),this.serverAuthenticatedSecrets.clear(),this.serverAuthenticatedSockets.clear()}};function k(e){let t=Array.from(e,e=>String.fromCharCode(e)).join(``);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``)}function A(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=(4-t.length%4)%4;t+=`=`.repeat(n);let r=atob(t),i=new Uint8Array(r.length);for(let e=0;e<r.length;e++)i[e]=r.charCodeAt(e);return i}function j(e){return new TextEncoder().encode(e)}function M(e){return new TextDecoder().decode(e)}async function ut(e){let t=await crypto.subtle.exportKey(`spki`,e);return k(new Uint8Array(t))}async function N(e){let t=await crypto.subtle.exportKey(`raw`,e);return k(new Uint8Array(t))}async function P(e,t,n=[]){let r=A(e);return crypto.subtle.importKey(`spki`,r,t,!0,n)}async function F(e,t,n=[]){let r=A(e);return crypto.subtle.importKey(`raw`,r,t,!0,n)}async function I(e){let t=await crypto.subtle.exportKey(`pkcs8`,e),n=k(new Uint8Array(t)).replace(/-/g,`+`).replace(/_/g,`/`),r=(4-n.length%4)%4;return n+=`=`.repeat(r),`-----BEGIN PRIVATE KEY-----\n${n.match(/.{1,64}/g)?.join(`
-`)??n}\n-----END PRIVATE KEY-----`}async function L(e,t,n){let r=A(e.replace(/-----BEGIN PRIVATE KEY-----/,``).replace(/-----END PRIVATE KEY-----/,``).replace(/\s/g,``).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``));return crypto.subtle.importKey(`pkcs8`,r,t,!0,n)}const R={name:`ECDH`,namedCurve:`P-256`};async function z(e=!0){return crypto.subtle.generateKey(R,e,[`deriveKey`,`deriveBits`])}async function B(e){return ut(e)}async function dt(e){return N(e)}async function ft(e){return F(e,R)}async function V(e,t=[]){return P(e,R,t)}async function pt(e){return I(e)}async function mt(e){return L(e,R,[`deriveKey`,`deriveBits`])}async function H(e,t){return crypto.subtle.deriveBits({name:`ECDH`,public:t},e,256)}async function U(e,t){let n=crypto.getRandomValues(new Uint8Array(12)),r=await crypto.subtle.encrypt({name:`AES-GCM`,iv:n},e,t);return{ciphertext:new Uint8Array(r),nonce:n}}async function W(e,t,n){let r=await crypto.subtle.decrypt({name:`AES-GCM`,iv:n},e,t);return new Uint8Array(r)}async function ht(e){return crypto.subtle.importKey(`raw`,e,{name:`AES-GCM`},!1,[`encrypt`,`decrypt`])}async function gt(e,t,n){let r=await crypto.subtle.importKey(`raw`,e,{name:`HKDF`},!1,[`deriveKey`]);return crypto.subtle.deriveKey({name:`HKDF`,hash:`SHA-256`,salt:t,info:j(n)},r,{name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`])}const G={name:`ECDSA`,namedCurve:`P-256`};async function _t(e=!0){return crypto.subtle.generateKey(G,e,[`sign`,`verify`])}async function vt(e,t){let n=await crypto.subtle.sign({name:`ECDSA`,hash:{name:`SHA-256`}},e,t);return new Uint8Array(n)}async function yt(e,t,n){return crypto.subtle.verify({name:`ECDSA`,hash:{name:`SHA-256`}},e,t,n)}async function bt(e){return ut(e)}async function xt(e){return P(e,G,[`verify`])}async function St(e){return N(e)}async function Ct(e){return F(e,G,[`verify`])}async function wt(e){return I(e)}async function Tt(e){return L(e,G,[`sign`])}var Et=e({decodeText:()=>M,decrypt:()=>W,deriveSessionKey:()=>gt,deriveSharedSecret:()=>H,encodeText:()=>j,encrypt:()=>U,exportPrivateKeyPEM:()=>pt,exportPublicKey:()=>B,exportPublicKeyRaw:()=>dt,exportSigningPrivateKeyPEM:()=>wt,exportSigningPublicKey:()=>bt,exportSigningPublicKeyRaw:()=>St,fromBase64Url:()=>A,generateECDHKeyPair:()=>z,generateSigningKeyPair:()=>_t,importAESKey:()=>ht,importPrivateKeyPEM:()=>mt,importPublicKey:()=>V,importPublicKeyRaw:()=>ft,importSigningPrivateKeyPEM:()=>Tt,importSigningPublicKey:()=>xt,importSigningPublicKeyRaw:()=>Ct,sign:()=>vt,toBase64Url:()=>k,verify:()=>yt});function Dt(e){let t=e.match(/.{1,2}/g);return new Uint8Array(t?.map(e=>parseInt(e,16))??[])}function K(e){return Array.from(e).map(e=>e.toString(16).padStart(2,`0`)).join(``)}async function q(e,t){let n=await z(!0),r=await B(n.publicKey);return{ephemeralKeyPair:n,ephemeralPublicKey:r,signature:K(await vt(e,j(r+t)))}}function Ot(){return K(crypto.getRandomValues(new Uint8Array(16)))}async function J(e,t,n,r){let i=j(t+r);return yt(e,Dt(n),i)}async function Y(e,t,n,r){let i;try{i=await V(t)}catch(e){throw e instanceof DOMException&&e.name===`DataError`?new g(`WS_AUTHENTICATION_REJECTED`,`Invalid E2E peer public key`,{cause:e}):e}return gt(await H(e,i),Dt(n),r)}async function kt(e,t,n,r){if(e===t)throw Error(`deriveRelaySaltHex: identityId must differ from peerId`);let[i,a]=e<t?[e,t]:[t,e],[o,s]=e<t?[n,r]:[r,n],c=j(`${i}${a}${o}${s}`),l=new Uint8Array(c).buffer,u=await crypto.subtle.digest(`SHA-256`,l);return K(new Uint8Array(u))}function X(e,t){return typeof e==`string`&&/^[A-Za-z0-9_-]+$/.test(e)&&e.length%4!=1&&typeof t==`string`&&/^[0-9a-f]{128}$/i.test(t)}function At(e){return X(e.ephemeralPublicKey,e.signature)&&typeof e.salt==`string`&&/^[0-9a-f]{32}$/i.test(e.salt)}var jt=class{signingKeyPair;identityId;peerId;getPeerSigningKey;timeout;pendingKeyExchange;pendingResult;clientSession;clientEphemeralKeyPair;serverPendingKeyExchange=new Map;serverSessions=new Map;serverEphemeralKeyPairs=new Map;constructor(e){this.signingKeyPair=e.signingKeyPair,this.identityId=e.identityId,this.peerId=e.peerId,this.getPeerSigningKey=e.getPeerSigningKey,this.timeout=e.timeout??1e4}async authenticateClient(e){if(!this.peerId)throw Error(`E2E authentication failed: peerId is required for client authentication`);let t=this.waitForKeyExchangeResponse(),n=this.pendingKeyExchange,r=this.waitForAuthResult();t.catch(()=>void 0),r.catch(()=>void 0);try{let{ephemeralKeyPair:i,ephemeralPublicKey:a,signature:o}=await q(this.signingKeyPair.privateKey,this.identityId);this.assertClientOwner(n),this.clientEphemeralKeyPair=i,e({type:`e2e-key-exchange`,deviceId:this.identityId,ephemeralPublicKey:a,signature:o}),this.assertClientOwner(n);let s=await t;this.assertClientOwner(n);let c=await this.getPeerSigningKey(this.peerId);if(this.assertClientOwner(n),!c)throw new g(`WS_AUTHENTICATION_REJECTED`,`E2E authentication failed: Unknown server`);let l=await J(c,s.ephemeralPublicKey,s.signature,this.peerId);if(this.assertClientOwner(n),!l)throw new g(`WS_AUTHENTICATION_REJECTED`,`E2E authentication failed: Invalid server signature`);let u=await Y(i.privateKey,s.ephemeralPublicKey,s.salt,`makaio-e2e-session-v1`);this.assertClientOwner(n);let d=await r;if(this.assertClientOwner(n),!d.success)throw new g(`WS_AUTHENTICATION_REJECTED`,`E2E authentication failed: ${d.error??`Unknown error`}`);this.clientSession={sessionKey:u,peerId:this.peerId}}catch(e){throw this.pendingKeyExchange===n&&(this.clientSession=void 0,this.clientEphemeralKeyPair=void 0),e}finally{clearTimeout(n.timeoutHandle),this.pendingKeyExchange===n&&(this.pendingKeyExchange=void 0,this.pendingResult&&clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult=void 0)}}async authenticateServer(e,t){let n=this.waitForClientKeyExchange(e),r=this.serverPendingKeyExchange.get(e);try{let i=await n;this.assertServerOwner(e,r);let a=await this.getPeerSigningKey(i.deviceId);if(this.assertServerOwner(e,r),!a)throw new g(`WS_AUTHENTICATION_REJECTED`,`E2E authentication failed: Unknown device ${i.deviceId}`);let o=await J(a,i.ephemeralPublicKey,i.signature,i.deviceId);if(this.assertServerOwner(e,r),!o)throw new g(`WS_AUTHENTICATION_REJECTED`,`E2E authentication failed: Invalid client signature`);let{ephemeralKeyPair:s,ephemeralPublicKey:c,signature:l}=await q(this.signingKeyPair.privateKey,this.identityId);this.assertServerOwner(e,r);let u=Ot();this.serverEphemeralKeyPairs.set(e,s),t({type:`e2e-key-exchange-response`,ephemeralPublicKey:c,signature:l,salt:u}),this.assertServerOwner(e,r);let d=await Y(s.privateKey,i.ephemeralPublicKey,u,`makaio-e2e-session-v1`);this.assertServerOwner(e,r),this.serverSessions.set(e,{sessionKey:d,peerId:i.deviceId}),t({type:`e2e-auth-result`,success:!0}),this.assertServerOwner(e,r)}catch(n){if(this.serverPendingKeyExchange.get(e)===r){this.serverEphemeralKeyPairs.delete(e),this.serverSessions.delete(e);try{n instanceof g&&n.code===`WS_AUTHENTICATION_REJECTED`&&t({type:`e2e-auth-result`,success:!1,error:n.message})}catch{}}throw n}finally{clearTimeout(r.timeoutHandle),this.serverPendingKeyExchange.get(e)===r&&this.serverPendingKeyExchange.delete(e)}}assertClientOwner(e){if(this.pendingKeyExchange!==e)throw new g(`WS_CONNECTION_UNAVAILABLE`,`Connection closed during E2E authentication`)}assertServerOwner(e,t){if(this.serverPendingKeyExchange.get(e)!==t)throw new g(`WS_CONNECTION_UNAVAILABLE`,`Connection closed during E2E authentication`)}handleAuthMessage(e,t){if(typeof e!=`object`||!e||!(`type`in e)||typeof e.type!=`string`)return!1;let n=e;if(n.type===`e2e-key-exchange-response`){if(this.pendingKeyExchange){if(clearTimeout(this.pendingKeyExchange.timeoutHandle),!At(n))return this.pendingKeyExchange.reject(new g(`WS_AUTHENTICATION_REJECTED`,`Malformed E2E key exchange response`)),!0;this.pendingKeyExchange.resolve({ephemeralPublicKey:n.ephemeralPublicKey,signature:n.signature,salt:n.salt})}return!0}if(n.type===`e2e-auth-result`){if(typeof n.success!=`boolean`)return!0;let e=typeof n.error==`string`?n.error:void 0;return!n.success&&this.pendingKeyExchange&&(clearTimeout(this.pendingKeyExchange.timeoutHandle),this.pendingKeyExchange.reject(new g(`WS_AUTHENTICATION_REJECTED`,`E2E authentication failed: ${e??`Unknown error`}`))),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.resolve({success:n.success,error:e}),void 0),!0}if(n.type===`e2e-key-exchange`&&t){let e=this.serverPendingKeyExchange.get(t);if(e){if(clearTimeout(e.timeoutHandle),typeof n.deviceId!=`string`||!X(n.ephemeralPublicKey,n.signature))return e.reject(new g(`WS_AUTHENTICATION_REJECTED`,`Malformed E2E key exchange`)),!0;e.resolve({deviceId:n.deviceId,ephemeralPublicKey:n.ephemeralPublicKey,signature:n.signature})}return!0}return!1}async waitForKeyExchangeResponse(){return new Promise((e,t)=>{let n=setTimeout(()=>{t(new g(`WS_HANDSHAKE_TIMEOUT`,`E2E key exchange timeout`))},this.timeout);this.pendingKeyExchange={resolve:e,reject:t,timeoutHandle:n}})}async waitForAuthResult(){return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingResult=void 0,t(new g(`WS_HANDSHAKE_TIMEOUT`,`E2E authentication result timeout`))},this.timeout);this.pendingResult={resolve:e,reject:t,timeoutHandle:n}})}async waitForClientKeyExchange(e){return new Promise((t,n)=>{let r={resolve:t,reject:n,timeoutHandle:setTimeout(()=>{n(new g(`WS_HANDSHAKE_TIMEOUT`,`E2E key exchange timeout`))},this.timeout)};this.serverPendingKeyExchange.set(e,r)})}getSessionKey(e){return e?this.serverSessions.get(e)?.sessionKey??null:this.clientSession?.sessionKey??null}getPeerId(e){return e?this.serverSessions.get(e)?.peerId??null:this.clientSession?.peerId??null}getReceiveContext(e){let t=this.getPeerId(e);if(t!==null)return{transportName:``,peer:{kind:`e2e`,id:t,authenticated:!0,encrypted:!0}}}cleanupSocket(e){let t=this.serverPendingKeyExchange.get(e);t&&(clearTimeout(t.timeoutHandle),t.reject(new g(`WS_CONNECTION_UNAVAILABLE`,`Connection closed during E2E authentication`)),this.serverPendingKeyExchange.delete(e)),this.serverSessions.delete(e),this.serverEphemeralKeyPairs.delete(e)}cleanup(){this.pendingKeyExchange&&=(clearTimeout(this.pendingKeyExchange.timeoutHandle),this.pendingKeyExchange.reject(new g(`WS_CONNECTION_UNAVAILABLE`,`Connection closed during E2E authentication`)),void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.reject(new g(`WS_CONNECTION_UNAVAILABLE`,`Connection closed during E2E authentication`)),void 0),this.clientSession=void 0,this.clientEphemeralKeyPair=void 0;for(let e of this.serverPendingKeyExchange.values())clearTimeout(e.timeoutHandle),e.reject(new g(`WS_CONNECTION_UNAVAILABLE`,`Connection closed during E2E authentication`));this.serverPendingKeyExchange.clear(),this.serverSessions.clear(),this.serverEphemeralKeyPairs.clear()}};const Z=`E2E relay auth session aborted by reconnect`;var Mt=class{signingKeyPair;identityId;getPeerSigningKey;timeout;mode;blocking;pendingPeer;sessionKey;peerId;localEphemeral;localExchangeMessage;sentLocalExchange=!1;earlyPeer;sendAuthMessage;authGeneration=0;processingExchange=!1;constructor(e){this.signingKeyPair=e.signingKeyPair,this.identityId=e.identityId,this.getPeerSigningKey=e.getPeerSigningKey,this.timeout=e.timeout??1e4,this.mode=e.mode??`initiator`,this.blocking=e.blocking??!0}async authenticateClient(e){let t=this.sendAuthMessage===void 0?this.earlyPeer:void 0;this.cleanup();let n=this.authGeneration;if(this.earlyPeer=t,this.sendAuthMessage=e,this.mode===`initiator`){if(await this.ensureLocalExchangeMessage(),n!==this.authGeneration)throw Error(Z);this.sendLocalExchange()}if(!this.blocking){if(this.earlyPeer){let e=this.earlyPeer;this.earlyPeer=void 0,this.dispatchPeerExchange(e,n)}return}let r=await this.waitForPeerExchange();if(await this.processPeerExchange(r,n),n!==this.authGeneration||!this.sessionKey)throw Error(Z)}async authenticateServer(e,t){throw Error(`E2ERelayAuth does not support server authentication`)}handleAuthMessage(e){let t=e;return!t||t.type!==`e2e-relay-key-exchange`?!1:t.identityId===this.identityId?!0:this.pendingPeer?(this.pendingPeer.resolve(t),this.pendingPeer=void 0,!0):(this.earlyPeer=t,!this.blocking&&this.sendAuthMessage&&!this.sessionKey&&!this.processingExchange&&this.dispatchPeerExchange(t,this.authGeneration),!0)}cleanupSocket(e){}cleanup(){this.authGeneration++,this.pendingPeer&&=(this.pendingPeer.reject(Error(Z)),void 0),this.earlyPeer&&=void 0,this.sessionKey=void 0,this.peerId=void 0,this.localEphemeral=void 0,this.localExchangeMessage=void 0,this.sentLocalExchange=!1,this.processingExchange=!1,this.sendAuthMessage=void 0}dispatchPeerExchange(e,t){this.processingExchange=!0,this.processPeerExchange(e,t).catch(e=>{e instanceof Error&&e.message===Z||console.error(`[E2ERelayAuth] Peer exchange failed:`,e)}).finally(()=>{t===this.authGeneration&&(this.processingExchange=!1,this.retryQueuedPeerExchange(t))})}getSessionKey(){return this.sessionKey??null}getPeerId(){return this.peerId??null}getReceiveContext(){let e=this.getPeerId();if(e!==null)return{transportName:``,peer:{kind:`e2e`,id:e,authenticated:!0,encrypted:!0}}}async waitForPeerExchange(){if(this.earlyPeer){let e=this.earlyPeer;return this.earlyPeer=void 0,e}return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingPeer=void 0,t(Error(`E2E relay key exchange timeout`))},this.timeout),r=()=>{clearTimeout(n),this.pendingPeer=void 0};this.pendingPeer={resolve:t=>{r(),e(t)},reject:e=>{r(),t(e)},timeoutHandle:n}})}async ensureLocalExchangeMessage(){if(this.localExchangeMessage&&this.localEphemeral)return this.localExchangeMessage;let{ephemeralKeyPair:e,ephemeralPublicKey:t,signature:n}=await q(this.signingKeyPair.privateKey,this.identityId);return this.localEphemeral=e,this.localExchangeMessage={type:`e2e-relay-key-exchange`,identityId:this.identityId,ephemeralPublicKey:t,signature:n},this.localExchangeMessage}sendLocalExchange(e=!1){!this.sendAuthMessage||!this.localExchangeMessage||!e&&this.sentLocalExchange||(this.sendAuthMessage(this.localExchangeMessage),this.sentLocalExchange=!0)}retryQueuedPeerExchange(e){if(this.blocking||!this.sendAuthMessage||this.sessionKey||this.processingExchange||e!==this.authGeneration)return;let t=this.earlyPeer;t&&(this.earlyPeer=void 0,this.dispatchPeerExchange(t,e))}async processPeerExchange(e,t){if(!this.sendAuthMessage){this.earlyPeer=e;return}let n=await this.ensureLocalExchangeMessage();if(t!==this.authGeneration)return;let r=await this.getPeerSigningKey(e.identityId);if(!r)throw Error(`E2E relay authentication failed: Unknown peer ${e.identityId}`);if(!await J(r,e.ephemeralPublicKey,e.signature,e.identityId))throw Error(`E2E relay authentication failed: Invalid peer signature`);let i=await kt(this.identityId,e.identityId,n.ephemeralPublicKey,e.ephemeralPublicKey);if(!this.localEphemeral)throw Error(`E2E relay authentication failed: Local ephemeral key missing`);let a=await Y(this.localEphemeral.privateKey,e.ephemeralPublicKey,i,`makaio-e2e-relay-v1`);t===this.authGeneration&&(this.sessionKey=a,this.peerId=e.identityId,this.mode===`initiator`?this.sendLocalExchange(!0):this.sendLocalExchange())}},Nt=class{hmac;e2e;socketStrategy=new Map;pendingServerAuth=new Map;hmacCancelled=new Map;constructor(e){this.hmac=e.hmac,this.e2e=e.e2e}setE2EAuth(e){this.e2e=e}async authenticateClient(e){let t=this.hmac??this.e2e;if(!t)throw Error(`DispatchingAuth: no auth strategy configured`);return t.authenticateClient(e)}async authenticateServer(e,t){let n=this.resolveSingleStrategy();if(n)return n.authenticateServer(e,t);if(!this.hmac||!this.e2e)throw Error(`DispatchingAuth: no auth strategy configured`);let r={cancelled:!1};this.hmacCancelled.set(e,r);let i=this.hmac.authenticateServer(e,e=>{r.cancelled||t(e)});return new Promise((n,a)=>{this.pendingServerAuth.set(e,{resolve:n,reject:a,send:t}),i.then(n).catch(e=>{r.cancelled||a(e instanceof Error?e:Error(String(e)))})})}handleAuthMessage(e,t){if(!t)return(this.hmac??this.e2e)?.handleAuthMessage(e)??!1;let n=this.socketStrategy.get(t);if(n)return n.handleAuthMessage(e,t);let r=this.resolveStrategy(e),i=this.pendingServerAuth.get(t);return r?(this.socketStrategy.set(t,r),this.pendingServerAuth.delete(t),r===this.hmac?this.hmacCancelled.delete(t):(this.cancelHmac(t),i&&r.authenticateServer(t,i.send).then(i.resolve).catch(e=>{i.reject(e instanceof Error?e:Error(String(e)))})),r.handleAuthMessage(e,t)):(this.cancelHmac(t),i&&(this.pendingServerAuth.delete(t),i.reject(new g(`WS_POLICY_REJECTED`,`DispatchingAuth: unrecognised auth message type "${this.peekType(e)}" — no matching strategy`))),!1)}cleanupSocket(e){let t=this.socketStrategy.get(e);t&&(t.cleanupSocket(e),this.socketStrategy.delete(e)),this.cancelHmac(e);let n=this.pendingServerAuth.get(e);n&&(this.pendingServerAuth.delete(e),n.reject(Error(`DispatchingAuth: socket disconnected before auth type was determined`)))}cleanup(){this.hmac?.cleanup(),this.e2e?.cleanup(),this.socketStrategy.clear();for(let e of this.pendingServerAuth.values())e.reject(Error(`DispatchingAuth: cleanup called before authentication completed`));this.pendingServerAuth.clear(),this.hmacCancelled.clear()}peekType(e){if(typeof e!=`object`||!e||!(`type`in e))return;let{type:t}=e;return typeof t==`string`?t:void 0}resolveSingleStrategy(){if(this.hmac&&!this.e2e)return this.hmac;if(this.e2e&&!this.hmac)return this.e2e}resolveStrategy(e){let t=this.peekType(e);if(t){if(t===`e2e-key-exchange`&&this.e2e)return this.e2e;if(t===`auth-response`&&this.hmac)return this.hmac}}cancelHmac(e){let t=this.hmacCancelled.get(e);t&&(t.cancelled=!0,this.hmacCancelled.delete(e),this.hmac?.cleanupSocket(e))}};function Pt(e){return`payload`in e}async function Ft(e,t,n){if(e.type!==`response`||e.result===void 0||e.error!==void 0)return;let{ciphertext:r,nonce:i}=await U(n,j(JSON.stringify(e.result)));t.result=k(r),t.e2e={nonce:k(i),v:1}}async function It(e,t,n){if(e.type!==`broadcast-response`||e.results===void 0||e.error!==void 0)return;let{ciphertext:r,nonce:i}=await U(n,j(JSON.stringify(e.results)));t.results=k(r),t.e2e={nonce:k(i),v:1}}async function Lt(e,t,n){if(!Pt(e)||e.payload===void 0)return;let{ciphertext:r,nonce:i}=await U(n,j(JSON.stringify(e.payload)));t.payload=k(r),t.e2e={nonce:k(i),v:1}}async function Rt(e,t,n){if(e.type!==`response`&&e.type!==`broadcast-response`||e.error===void 0)return;let{ciphertext:r,nonce:i}=await U(n,j(JSON.stringify(e.error)));t.error=k(r),t.e2e={nonce:k(i),v:1}}async function zt(e,t,n,r){if(!Pt(e)||typeof e.payload!=`string`)return;let i=M(await W(n,A(e.payload),r));t.payload=JSON.parse(i)}async function Bt(e,t,n,r){if(e.type!==`response`||typeof e.result!=`string`)return;let i=M(await W(n,A(e.result),r));t.result=JSON.parse(i)}async function Vt(e,t,n,r){if(e.type!==`broadcast-response`||typeof e.results!=`string`)return;let i=M(await W(n,A(e.results),r));t.results=JSON.parse(i)}async function Ht(e,t,n,r){if(e.type!==`response`&&e.type!==`broadcast-response`||typeof e.error!=`string`)return;let i=M(await W(n,A(e.error),r));t.error=JSON.parse(i)}async function Ut(e,t){let n={...e};return await Lt(e,n,t),await Ft(e,n,t),await It(e,n,t),await Rt(e,n,t),n}async function Wt(e,t){if(!e.e2e)return e;let n={...e};delete n.e2e;let r=A(e.e2e.nonce);return await zt(e,n,t,r),await Bt(e,n,t,r),await Vt(e,n,t,r),await Ht(e,n,t,r),n}function Gt(e){return e.type===`subscription-ack`&&typeof e.ackId==`string`}function Kt(e){let{e2eAuth:t,websocket:n,...r}=e,i=new C({...r,url:`<pre-connected>`,createWebSocket:()=>n,auth:t,autoReconnect:!1,heartbeat:r.heartbeat??!1,messageTransform:async e=>{let n=t.getSessionKey();if(!n||Gt(e))return e;let r=e;if(!r.e2e)throw Error(`Received plaintext message on E2E-encrypted channel — possible injection`);return Wt(r,n)}});async function a(e,n){let r=t.getSessionKey();if(!r)throw Error(`E2E session key not available - authentication may have failed`);let a=await Ut(e,r);return i.send(a,n)}return{name:i.name,connect:i.connect.bind(i),disconnect:i.disconnect.bind(i),send:a,cancelRequest:i.cancelRequest.bind(i),onReceive:i.onReceive.bind(i),subscribe:i.subscribe.bind(i),unsubscribe:i.unsubscribe.bind(i),getSubscriptions:i.getSubscriptions.bind(i)}}function qt(e){return Kt(e)}function Jt(e){if(!e||typeof e!=`object`)return!1;let t=e;if(t.type!==`e2e-relay-envelope`||typeof t.payload!=`string`)return!1;let n=t.e2e;return!!n&&typeof n.nonce==`string`&&typeof n.v==`number`}async function Yt(e,t){let{ciphertext:n,nonce:r}=await U(t,j(JSON.stringify(e)));return{type:`e2e-relay-envelope`,payload:k(n),e2e:{nonce:k(r),v:1}}}async function Xt(e,t){let n=A(e.e2e.nonce),r=M(await W(t,A(e.payload),n));return JSON.parse(r)}function Zt(e){let t=()=>{if(!e.isFrozen())throw Error(`RelayControlRegistry must be frozen before processing relay control messages`)};function n(t){return typeof t.namespace!=`string`||typeof t.subject!=`string`||!e.isControlEvent(t.namespace,t.subject)||typeof t.messageId!=`string`?!1:t.payload!==void 0}function r(t){return typeof t.namespace!=`string`||typeof t.subject!=`string`||!e.isControlRequest(t.namespace,t.subject)||typeof t.messageId!=`string`||typeof t.correlationId!=`string`?!1:t.payload!==void 0}function i(e){if(t(),!e||typeof e!=`object`)return!1;let i=e;return i.type===`event`?n(i):i.type===`request`?r(i):!1}function a(e){if(t(),!e||typeof e!=`object`)return!1;let n=e;return n.type!==`relay-control`||n.v!==1||!n.payload||typeof n.payload!=`object`?!1:i(n.payload)}function o(e){if(t(),!i(e))throw Error(`Invalid relay control message`);return{type:`relay-control`,v:1,payload:e}}return{createRelayControlEnvelope:o,isRelayControlEnvelopeMessage:a,isRelayControlBusMessage:i}}function Q(e){let t=Date.now()-3e5;for(let[n,r]of e)r>=t||e.delete(n);for(;e.size>2048;){let t=e.keys().next().value;if(!t)break;e.delete(t)}}const Qt=e=>{if(!e||typeof e!=`object`)return!1;let t=e;return t.type===`response`&&typeof t.correlationId==`string`},$t=e=>e.type===`subscribe`||e.type===`unsubscribe`,$=e=>{if(!e||typeof e!=`object`)return!1;let t=e;return t.type===`subscription-ack`&&typeof t.ackId==`string`};function en(e,t,n,r){if(t(e)||e.type===`response`&&n.has(e.correlationId))return!0;let i=r.getSessionKey();return!i&&($t(e)||$(e))?!0:!!i}function tn(e,t,n,r){if(!r.isFrozen())throw Error(`E2ERelay transport requires a frozen relay control registry`);let{createRelayControlEnvelope:i,isRelayControlEnvelopeMessage:a,isRelayControlBusMessage:o}=Zt(r),s=e=>{n.delete(e),n.set(e,Date.now()),Q(n)};return{canEncode:t=>en(t,o,n,e),encode:async t=>{if(o(t))return t.type===`request`&&s(t.correlationId),JSON.stringify(i(t));if(Q(n),t.type===`response`&&n.has(t.correlationId))return n.delete(t.correlationId),JSON.stringify(t);let r=e.getSessionKey();if(!r&&$t(t)||!r&&$(t))return JSON.stringify(t);if(!r)throw Error(`E2E relay session not established`);let a=await Yt(t,r);return JSON.stringify(a)},decode:async r=>{let i=e.getSessionKey();if(a(r)){let e=r.payload;return t&&console.info(`[E2ERelayTransport] Decoded relay control envelope:`,e.type,e.namespace,e.subject),e.type===`request`&&s(e.correlationId),e}if(Q(n),Qt(r)&&n.has(r.correlationId))return n.delete(r.correlationId),r;if(!i&&$(r))return r;if(!i)throw Error(`E2E relay session not established`);if(!Jt(r))throw Error(`Received plaintext message on relay E2E channel — possible injection`);return Xt(r,i)}}}function nn(e,t,n=!1){let r=new Map;return{codec:tn(e,n,r,t),reset:()=>r.clear()}}function rn(e){let{e2eAuth:t,registry:n,websocket:r,...i}=e,a=e.debug??!1,o=new Map,s=tn(t,a,o,n);a&&console.info(`[E2ERelayTransport] Creating inner transport...`);let c=new C({...i,url:`<pre-connected>`,createWebSocket:()=>r,auth:t,codec:s,autoReconnect:!1,heartbeat:i.heartbeat??!1});return a&&console.info(`[E2ERelayTransport] Inner transport created`),{name:c.name,connect:async()=>{if(!n.isFrozen())throw Error(`E2ERelayClientTransport: registry must be frozen before connect()`);o.clear();try{await c.connect()}catch(e){throw o.clear(),e}},disconnect:async()=>{o.clear();try{await c.disconnect()}finally{o.clear()}},send:c.send.bind(c),cancelRequest:c.cancelRequest.bind(c),onReceive:(...e)=>(a&&console.info(`[E2ERelayTransport] onReceive called, delegating to inner transport`),c.onReceive(...e)),subscribe:c.subscribe.bind(c),unsubscribe:c.unsubscribe.bind(c),getSubscriptions:c.getSubscriptions.bind(c),isReady:c.isReady.bind(c),canSend:c.canSend.bind(c)}}function an(){let e=!1,t=new Map,n=new Map,r=()=>{if(e)throw Error(`RelayControlRegistry is frozen and cannot be modified`)};return{registerEventSubjects(e,n){r();let i=t.get(e)??new Set;for(let e of n)i.add(e);t.set(e,i)},registerRequestNamespace(e,t){if(r(),t.length===0)throw Error(`RelayControlRegistry request namespace "${e}" requires at least one subject`);let i=n.get(e)??new Set;for(let e of t)i.add(e);n.set(e,i)},freeze(){e=!0},isFrozen(){return e},isControlEvent(e,n){return t.get(e)?.has(n)??!1},isControlRequest(e,t){return n.get(e)?.has(t)??!1}}}function on(e){if(ot(e),e.mode===`client`){if(e.connectionOptions!==void 0)throw Error(`createWebSocketTransport(client) does not support connectionOptions when wrapping a pre-created WebSocket. Use WebSocketClientTransport for reconnect or dial-time socket options.`);let t=e.websocket;return new C({url:`<pre-connected>`,createWebSocket:()=>t,auth:e.auth,debug:e.debug,autoReconnect:!1,heartbeat:!1})}else return new it({websocket:e.websocket,auth:e.auth,debug:e.debug})}export{Nt as DispatchingAuth,jt as E2EAuth,Mt as E2ERelayAuth,lt as HmacAuth,it as ServerTransport,C as WebSocketClientTransport,g as WebSocketConnectionError,Ie as captureHmacIdentitySecretCleanup,Ve as clearHmacIdentitySecretsForTesting,qt as createE2EClientTransport,rn as createE2ERelayClientTransport,nn as createE2ERelayCodec,Zt as createRelayControlHelpers,an as createRelayControlRegistry,at as createWebSocketCloseEvent,on as createWebSocketTransport,Et as crypto,v as extractSocketErrorMessage,Pe as registerHmacIdentitySecret,ze as resolveHmacIdentityAllowedMessageSubjects,D as resolveHmacIdentityAllowedSubscriptionSubjects,Re as resolveHmacIdentityPeer,Le as resolveHmacIdentitySecret,Fe as rotateHmacIdentitySecret};
+import{r as e}from"../../chunk-DTipWd-i.mjs";import{isRecord as t}from"@makaio/framework/utils";import{ConnectionLostError as n,CorrelationTracker as r,DEFAULT_REQUEST_TIMEOUT_MS as i,NoHandlerError as a,TimeoutError as o,buildSubscribeMessage as s,buildUnsubscribeMessage as c,deserializeTransportError as l,getSubjectFromBusMessage as u,handleCorrelationResponse as d,isNoHandlerErrorForSubject as f,matchesFilter as p,matchesSubscription as m,shouldReceiveMessage as h,trackMessageCorrelation as ee}from"@makaio/framework/bus";const g={baseMs:1e3,maxMs:1e4};function te(e,t,n){let r=Math.max(t,100),i=Math.max(n,r);return Math.min(r*2**e,i)}function ne(e,t){return new Promise(n=>{if(t.aborted){n();return}let r=()=>{clearTimeout(i),t.removeEventListener(`abort`,r),n()},i=setTimeout(()=>{t.removeEventListener(`abort`,r),n()},e);t.addEventListener(`abort`,r)})}const re={intervalMs:3e4,timeoutMs:1e4},ie={encode:async e=>JSON.stringify(e),decode:async e=>e};function ae(e){return e===!1?!1:{baseMs:e?.baseMs??g.baseMs,maxMs:e?.maxMs??g.maxMs}}function oe(e){if(e===!1)return!1;let t=e?.intervalMs??re.intervalMs,n=e?.timeoutMs??re.timeoutMs;if(!Number.isFinite(t)||t<=0)throw RangeError(`heartbeat.intervalMs must be a finite number > 0 (got ${String(t)})`);if(!Number.isFinite(n)||n<=0)throw RangeError(`heartbeat.timeoutMs must be a finite number > 0 (got ${String(n)})`);return{intervalMs:t,timeoutMs:n}}var _=class extends Error{code;constructor(e,t,n){super(t,n),this.code=e,this.name=`WebSocketConnectionError`}};function v(e){let t=typeof e==`object`&&!!e&&`code`in e&&e.code===1008;return new _(t?`WS_POLICY_REJECTED`:`WS_CONNECTION_UNAVAILABLE`,t?`WebSocket connection rejected by peer policy`:`WebSocket closed before connection completed`)}function y(e,t=`unknown error`){return`message`in e?String(e.message):t}async function b(e,t,n){let r=await t.encode(e);n.send(r)}function se(e,t,n){return n?.aborted?Promise.reject(n.reason):e.readyState===1?Promise.resolve():e.readyState>=2?Promise.reject(v()):new Promise((r,i)=>{let a=()=>{u!==void 0&&clearTimeout(u),e.removeEventListener(`open`,o),e.removeEventListener(`error`,s),e.removeEventListener(`close`,c),n?.removeEventListener(`abort`,l)},o=()=>{a(),r()},s=e=>{a(),i(new _(`WS_CONNECTION_UNAVAILABLE`,`WebSocket connection failed — ${y(e)}`,{cause:e}))},c=e=>{a(),i(v(e))},l=()=>{a(),i(n?.reason)},u=t===void 0?void 0:setTimeout(()=>{a(),i(new _(`WS_CONNECTION_TIMEOUT`,`WebSocket open timed out after ${t}ms`))},t);e.addEventListener(`open`,o),e.addEventListener(`error`,s),e.addEventListener(`close`,c),n?.addEventListener(`abort`,l)})}function x(e){if(e.readyState!==0&&e.readyState!==1)return;let t=()=>{},n=()=>{e.removeEventListener(`error`,t),e.removeEventListener(`close`,n)};e.addEventListener(`error`,t),e.addEventListener(`close`,n);try{e.close()}catch(e){throw n(),e}}async function ce(e,t,n){let r=await Promise.allSettled(Array.from(t).map(t=>t(e,n.receiveContext)));for(let e of r)e.status===`rejected`&&n.debug&&console.error(`[WebSocketClientTransport:${n.name}] Handler error:`,e.reason);return r.every(e=>e.status===`fulfilled`)}function le(e,t){return{...t?.getReceiveContext?.(),transportName:e}}async function ue(e,t){let{name:n,debug:r,auth:i,codec:a,messageTransform:o,correlations:s}=t,c=JSON.parse(e.toString());if(typeof c!=`object`||!c||typeof c.type!=`string`)return r&&console.error(`[WebSocketClientTransport:${n}] Invalid message structure:`,c),null;let l=c;if(i?.handleAuthMessage(l)||l.type===`heartbeat`)return null;let u=await a.decode(l);return!t.isCurrentSession()||o&&(u=await o(u),!t.isCurrentSession())||u.type===`heartbeat`?null:u.type===`subscribe-sync-complete`?(t.onSyncComplete(),null):u.type===`subscription-ack`?(typeof u.ackId==`string`&&t.onSubscriptionAck(u.ackId),null):d(u,s)?null:u}async function de(e,t){let{name:n,debug:r,auth:i,handlers:a}=t,o=null;try{o=await ue(e,t)}catch(e){r&&console.error(`[WebSocketClientTransport:${n}] Failed to parse message:`,e);return}if(o===null||!t.isCurrentSession())return;let s=le(n,i),c=o;ce(c,a,{debug:r,name:n,receiveContext:s}).then(async e=>{e&&(c.type===`subscribe`||c.type===`unsubscribe`)&&typeof c.ackId==`string`&&await t.sendSubscriptionAck(c.ackId)}).catch(e=>{r&&console.error(`[WebSocketClientTransport:${n}] Handler dispatch error:`,e)})}function fe(e){let t=e;return typeof t.ping==`function`&&typeof t.terminate==`function`&&typeof t.on==`function`&&typeof t.off==`function`}function S(e){e.unref?.()}function pe(e,t,n){if(!fe(e))return()=>{};let r=!1,i=Date.now(),a=null,o=null,s=()=>{if(r)return;let e=Date.now()-i,n=Math.max(0,t.intervalMs-e);a=setTimeout(l,n),S(a)},c=()=>{o=null,f(),n.debug&&console.warn(`[WebSocketClientTransport:${n.name}] ${new Date().toISOString()} Heartbeat deadline expired (no message/pong within ${t.timeoutMs}ms) — terminating socket`),e.terminate()},l=()=>{if(a=null,!r&&o===null){if(Date.now()-i<t.intervalMs){s();return}e.readyState===1&&(e.ping(),o=setTimeout(c,t.timeoutMs),S(o))}},u=()=>{i=Date.now(),o!==null&&(clearTimeout(o),o=null),a===null&&s()},d=()=>{f()},f=()=>{r||(r=!0,a!==null&&(clearTimeout(a),a=null),o!==null&&(clearTimeout(o),o=null),e.removeEventListener(`message`,u),e.removeEventListener(`close`,d),e.off(`pong`,u))};return e.addEventListener(`message`,u),e.on(`pong`,u),e.addEventListener(`close`,d),s(),f}async function me(e,t){await Promise.allSettled(e.inFlightMessages),e.getSocket()===t&&e.correlations.rejectAll(e.getSessionFailure()??new n(e.name))}function he(e,t){let n=n=>{if(t.getSocket()!==e)return;let r=de(n.data,{isCurrentSession:()=>t.getSocket()===e,name:t.name,debug:t.debug,auth:t.auth,codec:t.codec,messageTransform:t.messageTransform,correlations:t.correlations,handlers:t.handlers,onSyncComplete:()=>{t.readiness===`peer-sync`&&t.resolveReady()},onSubscriptionAck:e=>{t.resolveSubscriptionAck(e)},sendSubscriptionAck:async n=>{t.getSocket()!==e||e.readyState!==1||await b({type:`subscription-ack`,ackId:n},t.codec,e)}}).finally(()=>{t.inFlightMessages.delete(r)});t.inFlightMessages.add(r)};t.setMessageListener(n),e.addEventListener(`message`,n)}function C(e,t){if(t.getSocket()!==e)return;let n=t.getMessageListener();n!==null&&(e.removeEventListener(`message`,n),t.setMessageListener(null));let r=t.getCloseListener();r!==null&&(e.removeEventListener(`close`,r),t.setCloseListener(null))}function ge(e,t,n){let r=[n];if(t.getSocket()===e){C(e,t),t.setSocket(null,n instanceof Error?n:Error(`WebSocket connection failed`,{cause:n})),t.setAuthComplete(!1);try{t.auth?.cleanup()}catch(e){r.push(e)}}try{x(e)}catch(e){r.push(e)}return r.length===1?n:AggregateError(r,`WebSocket connection failed and cleanup was incomplete`,{cause:n})}async function _e(e,t){t.throwIfAborted();let n=new AbortController,r=()=>n.abort(new _(`WS_CONNECTION_UNAVAILABLE`,`WebSocket connection cancelled`));t.addEventListener(`abort`,r);let i=setTimeout(()=>n.abort(new _(`WS_CONNECTION_TIMEOUT`,`WebSocket connection timed out after ${e.connectTimeoutMs}ms`)),e.connectTimeoutMs),a=null,o=()=>{},s=()=>{a?.removeEventListener(`close`,c),a?.removeEventListener(`error`,l)},c=e=>n.abort(v(e)),l=e=>n.abort(new _(`WS_CONNECTION_UNAVAILABLE`,`WebSocket connection failed — ${y(e)}`,{cause:e})),u=t=>{if(o(),a===null)return t;let n=a;return s(),a=null,ge(n,e,t)},d=()=>{},f=new Promise((e,t)=>{d=()=>{t(u(n.signal.reason))},n.signal.addEventListener(`abort`,d)});try{let t=ve(e,n.signal,()=>{o=e.resetReadyPromise()},t=>{a=t,e.setSocket(t),e.setAuthComplete(!1),t.addEventListener(`close`,c),t.addEventListener(`error`,l),he(t,e)});await Promise.race([t,f])}catch(e){throw u(e)}finally{clearTimeout(i),t.removeEventListener(`abort`,r),n.signal.removeEventListener(`abort`,d),s()}}async function ve(e,t,r,i){e.inFlightMessages.size>0&&await Promise.allSettled(e.inFlightMessages),t.throwIfAborted();let a=e.getSocket();e.correlations.rejectAll(e.getSessionFailure()??new n(e.name)),e.inFlightMessages.clear(),e.resolveReady(),e.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: reconnecting before subscription ack`)),r(),t.throwIfAborted(),a!==null&&C(a,e);let o=await e.wsFactory(e.url);t.aborted&&(x(o),t.throwIfAborted()),i(o),await ye(o,e,t)}async function ye(e,t,n){if(await se(e,void 0,n),n.throwIfAborted(),t.auth&&(await t.auth.authenticateClient(t=>{if(n.throwIfAborted(),e.readyState!==1)throw v();e.send(JSON.stringify(t))}),n.throwIfAborted()),t.setAuthComplete(!0),t.localSubscriptions.size>0){let r=await t.codec.encode(s(t.localSubscriptions));n.throwIfAborted(),e.send(r)}t.heartbeat!==!1&&pe(e,t.heartbeat,t),t.readiness===`session-established`&&t.resolveReady(),t.debug&&console.info(`[WebSocketClientTransport:${t.name}] Connected to ${t.url}`),t.notifyConnected()}function be(e,t){return new Promise(n=>{if(e.readyState===3||t.aborted){n();return}let r=()=>{t.removeEventListener(`abort`,i),n()},i=()=>{e.removeEventListener(`close`,r),n()};e.addEventListener(`close`,r),t.addEventListener(`abort`,i)})}async function xe(e,t,r,i,a){a(!0);try{for(;!e.aborted;){let a=r.getSocket(),o=a!==null;if(a!==null&&a.readyState!==3&&await be(a,e),e.aborted)break;if(o&&a!==null){if(await me(r,a),e.aborted)break;r.debug&&console.info(`[WebSocketClientTransport:${r.name}] ${new Date().toISOString()} Connection lost, starting reconnect loop (maxMs=${t.maxMs})`),r.notifyDisconnected()}let s=0;for(;!e.aborted;){let a=te(s,t.baseMs,t.maxMs);r.debug&&console.info(`[WebSocketClientTransport:${r.name}] ${new Date().toISOString()} Reconnecting in ${a}ms (attempt ${s+1})`);let o=new AbortController;if(i(o),await ne(a,AbortSignal.any([e,o.signal])),i(null),e.aborted)break;try{if(await _e(r,e),e.aborted)break;s=0;let t=r.getSocket();if(t!==null){let i=async()=>{await Promise.allSettled(r.inFlightMessages),!(e.aborted||r.getSocket()!==t)&&(r.correlations.rejectAll(r.getSessionFailure()??new n(r.name)),r.auth?.cleanup(),r.setAuthComplete(!1),r.debug&&console.info(`[WebSocketClientTransport:${r.name}] ${new Date().toISOString()} Connection closed`),r.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: disconnected before subscription ack`)))};r.setCloseListener(i),t.addEventListener(`close`,i),await be(t,e)}break}catch(e){if(r.debug){let t=e instanceof Error?e.message:String(e);console.warn(`[WebSocketClientTransport:${r.name}] ${new Date().toISOString()} Connect attempt ${s+1} failed: ${t}`)}s++}}}}finally{a(!1)}}function Se(e,t,n){let r=async()=>{t.getSocket()===e&&(C(e,t),t.auth?.cleanup(),t.setAuthComplete(!1),n(),t.resolveReady(),t.notifyDisconnected(),await me(t,e),t.getSocket()===e&&(t.setSocket(null),t.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: disconnected before subscription ack`))))};t.setCloseListener(r),e.addEventListener(`close`,r)}async function Ce(e,t,n,r,i){let a=i.localSubscriptions.get(e),o=a?.filter,c=t??o,l=r??a?.deliveryClass??`relayable`;if(i.localSubscriptions.set(e,{filter:c,priorities:n,deliveryClass:l}),i.socket!==null&&i.socket.readyState===1){let t=i.beginSubscriptionAck?.(),r=s(new Map([[e,{filter:c,priorities:n,deliveryClass:l}]]),t?.ackId);try{await b(r,i.codec,i.socket),await t?.promise}catch(e){throw t?.reject(e),e}}i.debug&&console.info(`[WebSocketClientTransport:${i.name}] Subscribed to ${e}${c?` with filter`:``}`)}async function we(e,t){let n=t.localSubscriptions.get(e);if(t.localSubscriptions.delete(e),t.socket!==null&&t.socket.readyState===1){let r=t.beginSubscriptionAck?.(),i=c({[e]:n?.priorities??[]},r?.ackId);try{await b(i,t.codec,t.socket),await r?.promise}catch(e){throw r?.reject(e),e}}t.debug&&console.info(`[WebSocketClientTransport:${t.name}] Unsubscribed from ${e}`)}var Te=class{name;termination=new AbortController;ownedSocket;onClose;constructor(e,t){this.name=t,this.ownedSocket=e,this.onClose=e=>{let r=v(e);this.end(r.code===`WS_POLICY_REJECTED`?r:new n(t))},e.addEventListener(`close`,this.onClose)}get socket(){return this.ownedSocket}get signal(){return this.termination.signal}get failure(){return this.signal.reason instanceof Error?this.signal.reason:void 0}end(e){this.ownedSocket?.removeEventListener(`close`,this.onClose),this.termination.abort(e)}release(e=new n(this.name)){this.end(e),this.ownedSocket=null}writable(e,t){if(t?.throwIfAborted(),this.signal.throwIfAborted(),e!==this||this.ownedSocket===null)throw new n(this.name);let r=this.ownedSocket;if(r.readyState===2||r.readyState===3){if(t===void 0)throw Error(`WebSocket is closing; uncorrelated message was not sent`);return Ee(new Promise(()=>{}),AbortSignal.any([t,this.signal]))}if(r.readyState!==1)throw new n(this.name);return r}};async function Ee(e,t){let n=()=>{},r=new Promise((e,r)=>{n=()=>r(t.reason),t.addEventListener(`abort`,n,{once:!0}),t.aborted&&n()});try{return await Promise.race([e,r])}finally{t.removeEventListener(`abort`,n)}}async function De(e,t,r){let i=e.session;if(i===null)throw new n(e.name);if(i.signal.throwIfAborted(),t.type!==`request`&&t.type!==`broadcast`)return await Oe(e,i,t),ee(t,e.correlations,r);let a=new AbortController,o=ee(t,e.correlations,r).then(e=>(a.abort(),e),e=>{throw a.abort(e),e});return Oe(e,i,t,a.signal).catch(n=>{if(a.signal.aborted)return;let r=n instanceof Error?n:Error(`WebSocket send failed`,{cause:n});e.correlations.reject(t.correlationId,r)}),o}async function Oe(e,t,n,r){let i=t.writable(e.currentSession(),r);i instanceof Promise&&await i;let a=r===void 0?t.signal:AbortSignal.any([r,t.signal]);a.throwIfAborted();let o=await Ee(e.codec.encode(n),a),s=t.writable(e.currentSession(),r);s instanceof Promise?await s:s.send(o)}var w=class{name;url;auth;codec;messageTransform;autoReconnectConfig;heartbeatConfig;connectTimeoutMs;readiness;wsFactory;debug;onConnectedCallback;onDisconnectedCallback;session=null;authComplete=!1;correlations=new r;handlers=new Set;localSubscriptions=new Map;pendingSubscriptionAcks=new Map;subscriptionAckSeq=0;messageListener=null;closeListener=null;reconnectAbort=null;inFlightMessages=new Set;backoffWakeAbort=null;reconnectLoopRunning=!1;readyResolve=null;ready;onNewReadySession=void 0;onConnected=void 0;onDisconnected=void 0;get socket(){return this.session?.socket??null}constructor(e){this.url=e.url,this.name=e.name??`ws-client`,this.auth=e.auth,this.codec=e.codec??ie,this.messageTransform=e.messageTransform,this.debug=e.debug??!1,this.autoReconnectConfig=ae(e.autoReconnect),this.heartbeatConfig=oe(e.heartbeat),this.connectTimeoutMs=e.connectTimeoutMs??3e4,this.readiness=e.readiness??`peer-sync`,this.wsFactory=e.createWebSocket??this.defaultWsFactory,this.onConnectedCallback=e.onConnected,this.onDisconnectedCallback=e.onDisconnected,this.ready=new Promise(e=>{this.readyResolve=e})}async connect(){if(this.reconnectAbort!==null)throw Error(`WebSocketClientTransport: already connected`);let e=new AbortController;this.reconnectAbort=e;try{await _e(this.connectionDeps(),e.signal)}catch(t){throw this.reconnectAbort===e&&(this.reconnectAbort=null),t}if(e.signal.aborted||this.reconnectAbort!==e)throw new _(`WS_CONNECTION_UNAVAILABLE`,`WebSocket connection cancelled`);this.autoReconnectConfig===!1?this.socket!==null&&this.wireNoReconnectClose(this.socket):this.startReconnectLoop(e.signal)}async disconnect(){let e=this.reconnectAbort,t=this.socket;this.reconnectAbort=null,e?.abort(new _(`WS_CONNECTION_UNAVAILABLE`,`WebSocket connection cancelled`));let r=t===null||this.socket===t;if(this.reconnectLoopRunning=!1,this.backoffWakeAbort=null,this.readyResolve?.(),this.readyResolve=null,this.socket!==null){C(this.socket,this.connectionDeps());let e=this.socket;this.session?.release(),this.authComplete=!1,x(e)}this.correlations.rejectAll(this.session?.failure??new n(this.name)),this.rejectPendingSubscriptionAcks(Error(`WebSocketClientTransport: disconnected before subscription ack`)),r&&this.auth?.cleanup(),this.handlers.clear(),this.debug&&console.info(`[WebSocketClientTransport:${this.name}] Disconnected`)}async send(e,t){return De({session:this.session,currentSession:()=>this.session,name:this.name,codec:this.codec,correlations:this.correlations},e,t??i)}onReceive(e){return this.handlers.add(e),()=>{this.handlers.delete(e)}}async subscribe(e,t,n=[],r){await Ce(e,t,n,r,this.subscriptionDeps())}async unsubscribe(e){await we(e,this.subscriptionDeps())}getSubscriptions(){return new Set(this.localSubscriptions.keys())}cancelRequest(e,t){this.correlations.cancel(e,t)}hasLiveWireSession(){return this.socket!==null&&this.socket.readyState===1&&this.authComplete}isReady(){return this.hasLiveWireSession()}canSend(e){return this.hasLiveWireSession()&&(this.codec.canEncode?.(e)??!0)}async reconnect(){if(!this.hasLiveWireSession()){if(this.backoffWakeAbort!==null){this.backoffWakeAbort.abort(),this.backoffWakeAbort=null;return}if(this.autoReconnectConfig!==!1){if(this.reconnectLoopRunning){let e=this.socket;e!==null&&e.readyState===0&&e.close();return}return}try{this.reconnectAbort===null&&await this.connect()}catch{}}}startReconnectLoop(e){return xe(e,this.autoReconnectConfig,this.connectionDeps(),t=>{e.aborted||(this.backoffWakeAbort=t)},t=>{this.reconnectAbort?.signal===e&&(this.reconnectLoopRunning=t)})}subscriptionDeps(){return{name:this.name,debug:this.debug,codec:this.codec,socket:this.socket,localSubscriptions:this.localSubscriptions,beginSubscriptionAck:()=>this.beginSubscriptionAck()}}beginSubscriptionAck(){let e=`${this.name}:sub:${++this.subscriptionAckSeq}`,t,n,r=new Promise((e,r)=>{t=e,n=r});r.catch(()=>void 0);let i=t=>{this.pendingSubscriptionAcks.has(e)&&(this.pendingSubscriptionAcks.delete(e),t())};return this.pendingSubscriptionAcks.set(e,{resolve:()=>i(t),reject:e=>i(()=>n(e))}),{ackId:e,promise:r,reject:t=>this.rejectSubscriptionAck(e,t)}}resolveSubscriptionAck(e){this.pendingSubscriptionAcks.get(e)?.resolve()}rejectSubscriptionAck(e,t){this.pendingSubscriptionAcks.get(e)?.reject(t)}rejectPendingSubscriptionAcks(e){for(let t of this.pendingSubscriptionAcks.keys())this.rejectSubscriptionAck(t,e)}connectionDeps(){return{name:this.name,debug:this.debug,auth:this.auth,codec:this.codec,messageTransform:this.messageTransform,correlations:this.correlations,handlers:this.handlers,localSubscriptions:this.localSubscriptions,wsFactory:this.wsFactory,url:this.url,connectTimeoutMs:this.connectTimeoutMs,readiness:this.readiness,heartbeat:this.heartbeatConfig,getSocket:()=>this.socket,setSocket:(e,t)=>{this.session?.release(t),e!==null&&(this.session=new Te(e,this.name))},getSessionFailure:()=>this.session?.failure,setAuthComplete:e=>{this.authComplete=e},getMessageListener:()=>this.messageListener,setMessageListener:e=>{this.messageListener=e},getCloseListener:()=>this.closeListener,setCloseListener:e=>{this.closeListener=e},resolveReady:()=>{this.readyResolve?.(),this.readyResolve=null},resetReadyPromise:()=>{let e;this.ready=new Promise(t=>{this.readyResolve=t,e=t});let t=()=>{e(),this.readyResolve===e&&(this.readyResolve=null)};try{this.onNewReadySession?.(this.ready)}catch(e){throw t(),e}return t},resolveSubscriptionAck:e=>{this.resolveSubscriptionAck(e)},rejectPendingSubscriptionAcks:e=>{this.rejectPendingSubscriptionAcks(e)},notifyConnected:()=>{let e=this.socket;this.onConnectedCallback?.(),this.socket===e&&this.hasLiveWireSession()&&this.onConnected?.()},notifyDisconnected:()=>{this.onDisconnectedCallback?.(),this.onDisconnected?.()},inFlightMessages:this.inFlightMessages}}defaultWsFactory=async e=>new(await(import(`ws`))).WebSocket(e);wireNoReconnectClose(e){Se(e,this.connectionDeps(),()=>{this.reconnectAbort=null})}};function T(e){e.timer!==void 0&&clearTimeout(e.timer)}var ke=class{pendingBroadcasts=new Map;timeout;debug;constructor(e={}){this.timeout=e.timeout??5e3,this.debug=e.debug??!1}startClientBroadcast(e,t,n,r,i){let a=t.correlationId,o=i??this.timeout,s={kind:`client`,sender:e,results:[],pendingClients:new Set(n),nodeResultsReceived:!1,timer:o===0?void 0:setTimeout(()=>{this.debug&&console.warn(`[BroadcastAggregator] Broadcast ${a} timed out`),this.finalizeBroadcast(a)},o)};this.pendingBroadcasts.set(a,s);let c=JSON.stringify(t);for(let e of n)r(e,c);this.debug&&console.info(`[BroadcastAggregator] Broadcast ${a} forwarded to ${n.length} clients`)}startServerBroadcast(e,t,n,r){let i=e.correlationId,a=r??this.timeout;return t.length===0?(this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${i} - no target clients`),Promise.resolve([])):new Promise(r=>{let o={kind:`server`,results:[],pendingClients:new Set(t),timer:a===0?void 0:setTimeout(()=>{this.debug&&console.warn(`[BroadcastAggregator] Server broadcast ${i} timed out`),this.finalizeServerBroadcast(i)},a),resolve:r};this.pendingBroadcasts.set(i,o);let s=JSON.stringify(e);for(let e of t)n(e,s);this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${i} sent to ${t.length} clients`)})}handleResponse(e,t){let n=this.pendingBroadcasts.get(t.correlationId);return n?(t.results&&n.results.push(...t.results),n.pendingClients.delete(e),this.debug&&console.info(`[BroadcastAggregator] Broadcast ${t.correlationId} got response, ${n.pendingClients.size} pending`),this.checkBroadcastComplete(t.correlationId,n),!0):!1}handleNodeResults(e,t,n){let r=this.pendingBroadcasts.get(e);return!r||r.kind!==`client`?!1:(r.results.push(...t),r.nodeResultsReceived=!0,r.nodeError=n,this.debug&&console.info(`[BroadcastAggregator] Broadcast ${e} node results aggregated${n?` (with error)`:``}`),this.checkBroadcastComplete(e,r),!0)}handleClientDisconnect(e){for(let[t,n]of this.pendingBroadcasts)n.kind===`client`&&n.sender===e?(T(n),this.pendingBroadcasts.delete(t)):n.pendingClients.has(e)&&(n.pendingClients.delete(e),this.checkBroadcastComplete(t,n))}cleanup(){for(let e of this.pendingBroadcasts.values())T(e),e.kind===`server`&&e.resolve(e.results);this.pendingBroadcasts.clear()}checkBroadcastComplete(e,t){if(!(t.pendingClients.size>0))if(t.kind===`client`){if(!t.nodeResultsReceived)return;this.finalizeBroadcast(e)}else this.finalizeServerBroadcast(e)}finalizeBroadcast(e){let t=this.pendingBroadcasts.get(e);if(!t||t.kind!==`client`)return;T(t),this.pendingBroadcasts.delete(e);let n=t.nodeError?{type:`broadcast-response`,correlationId:e,error:t.nodeError}:{type:`broadcast-response`,correlationId:e,results:t.results};t.sender.readyState===1&&t.sender.send(JSON.stringify(n)),this.debug&&console.info(`[BroadcastAggregator] Broadcast ${e} finalized with ${t.results.length} results`)}finalizeServerBroadcast(e){let t=this.pendingBroadcasts.get(e);!t||t.kind!==`server`||(T(t),this.pendingBroadcasts.delete(e),t.resolve(t.results),this.debug&&console.info(`[BroadcastAggregator] Server broadcast ${e} finalized with ${t.results.length} results`))}},Ae=class{clients=new Set;clientsByConnectionId=new Map;authenticatingClients=new Set;clientSubscriptions=new Map;clientSubscriptionState=new Map;clientFilters=new Map;requestOrigins=new Map;debug;subscriptionSubjectRestrictionResolver;requiredSubscriptionFilterResolver;socketAuthChecker;constructor(e={}){this.debug=e.debug??!1,this.subscriptionSubjectRestrictionResolver=e.subscriptionSubjectRestrictionResolver,this.requiredSubscriptionFilterResolver=e.requiredSubscriptionFilterResolver,this.socketAuthChecker=e.socketAuthChecker}addAuthenticating(e){this.authenticatingClients.add(e)}removeAuthenticating(e){this.authenticatingClients.delete(e)}isAuthenticating(e){return this.authenticatingClients.has(e)}addClient(e,t){this.clients.add(e),t!==void 0&&this.clientsByConnectionId.set(t,e)}removeClient(e){for(let[t,n]of this.clientsByConnectionId)n===e&&this.clientsByConnectionId.delete(t);let t=new Set(this.clientSubscriptionState.get(e)?.keys()??[]);this.clients.delete(e),this.authenticatingClients.delete(e),this.clientSubscriptions.delete(e),this.clientSubscriptionState.delete(e),this.clientFilters.delete(e);for(let[t,n]of this.requestOrigins)n.socket===e&&this.clearRequestOrigin(t,n);return this.debug&&console.info(`[ClientRegistry] Client removed (${this.clients.size} remaining)`),this.buildAggregateUpdates(t)}get size(){return this.clients.size}getAllSockets(){return new Set([...this.clients,...this.authenticatingClients])}handleSubscribeMessage(e,t){let n=this.clientSubscriptions.get(e);n||(n=new Set,this.clientSubscriptions.set(e,n));let r=this.clientFilters.get(e),i=this.clientSubscriptionState.get(e);i||(i=new Map,this.clientSubscriptionState.set(e,i));for(let[a,o]of Object.entries(t.subjects)){n.add(a),i.set(a,{priorities:o,deliveryClass:t.deliveryClasses?.[a]===`relayable`?`relayable`:`first-hop-only`});let s=t.filters?.[a];s===void 0?r?.delete(a):(r||(r=new Map,this.clientFilters.set(e,r)),r.set(a,s))}if(this.debug){let e=Object.keys(t.subjects).length,n=t.filters?Object.keys(t.filters).length:0;console.info(`[ClientRegistry] Client subscribed to ${e} subjects, ${n} filters`)}return this.buildAggregateUpdates(new Set(Object.keys(t.subjects)))}handleUnsubscribeMessage(e,t){let n=this.clientSubscriptions.get(e),r=this.clientFilters.get(e);for(let i of Object.keys(t))n?.delete(i),this.clientSubscriptionState.get(e)?.delete(i),r?.delete(i);return this.debug&&console.info(`[ClientRegistry] Client unsubscribed from ${Object.keys(t).length} subjects`),this.buildAggregateUpdates(new Set(Object.keys(t)))}getReadyClients(){let e=[];for(let t of this.clients)t.readyState===1&&e.push(t);return e}getClientByConnectionId(e){let t=this.clientsByConnectionId.get(e);return t!==void 0&&this.isReadyAndAuthenticated(t)?t:void 0}trackRequestOrigin(e,t){let{correlationId:n}=t;if(this.requestOrigins.has(n))return;let r=this.getRequestRemainingLifetime(t);if(r!==void 0&&r<=0)return;let i={socket:e,expiration:void 0};r!==void 0&&(i.expiration=setTimeout(()=>{this.requestOrigins.get(n)===i&&this.requestOrigins.delete(n)},r)),this.requestOrigins.set(n,i)}getRequestOrigin(e){return this.requestOrigins.get(e)?.socket}consumeResponseClient(e){let t=this.requestOrigins.get(e);if(t)return this.clearRequestOrigin(e,t),this.isReadyAndAuthenticated(t.socket)?t.socket:void 0}cancelRequestOrigin(e){let t=this.requestOrigins.get(e);t&&this.clearRequestOrigin(e,t)}getInterestedClients(e,t,n){let r=[];for(let i of this.clients)i===n||!this.isReadyAndAuthenticated(i)||this.clientWantsMessage(i,e,t)&&this.isSubjectAllowedForClient(i,e)&&this.isPayloadAllowedForClient(i,e,t)&&r.push(i);return r}getInterestedRequestClients(e,t,n){return this.getInterestedClients(e,t,n).filter(t=>{let n=this.clientSubscriptionState.get(t);return n?[...n].some(([t,n])=>n.priorities.length>0&&m(e,t)):!1})}forwardEventToClients(e,t,n){let r=u(t)??void 0,i=`payload`in t?t.payload:void 0,a=JSON.stringify(t),o=this.getInterestedClients(r,i,e);for(let e of o)n(e,a)}clientWantsMessage(e,t,n){return h(t,n,this.clientSubscriptions.get(e)??new Set,this.clientFilters.get(e)??new Map)}isReadyAndAuthenticated(e){return e.readyState===1?!this.socketAuthChecker||this.socketAuthChecker(e)?!0:(e.close(1008,`Authentication expired`),!1):!1}getRequestRemainingLifetime(e){let t=e.timeout??i;return t>0?t:void 0}clearRequestOrigin(e,t){t.expiration!==void 0&&clearTimeout(t.expiration),this.requestOrigins.delete(e)}isSubjectAllowedForClient(e,t){if(!this.subscriptionSubjectRestrictionResolver||t===void 0)return!0;let n=this.subscriptionSubjectRestrictionResolver(e);return n===null?!0:[...n].some(e=>m(t,e))}isPayloadAllowedForClient(e,t,n){if(!this.requiredSubscriptionFilterResolver||t===void 0)return!0;let r=this.requiredSubscriptionFilterResolver(e)?.[t];return r===void 0||p(n,r)}buildAggregateUpdates(e){let t={},n={},r={};for(let i of e){let e=new Set,a=!1,o=`relayable`;for(let t of this.clientSubscriptionState.values()){let n=t.get(i);if(n){a=!0;for(let t of n.priorities)e.add(t);n.deliveryClass===`first-hop-only`&&(o=`first-hop-only`)}}a?(t[i]=[...e].sort((e,t)=>t-e),n[i]=o):r[i]=[]}let i=[];return Object.keys(t).length>0&&i.push({type:`subscribe`,subjects:t,deliveryClasses:n}),Object.keys(r).length>0&&i.push({type:`unsubscribe`,subjects:r}),i}};const E=new Map;function je(e){if(typeof e==`object`&&e){for(let t of Object.values(e))je(t);Object.freeze(e)}return e}function Me(e){let t=Object.fromEntries(Object.entries(e).map(([e,t])=>[e,je(structuredClone(t))]));return Object.freeze(t)}function D(e,t){let n=!0;return()=>{n&&(n=!1,E.get(e)===t&&E.delete(e))}}function O(e,t,n){if(e.trim().length===0)throw Error(`registerHmacIdentitySecret requires a non-empty identityId`);if(t.length===0)throw Error(`registerHmacIdentitySecret requires a non-empty secret`);if(`allowedSubjects`in n)throw Error(`registerHmacIdentitySecret no longer accepts allowedSubjects; use allowedMessageSubjects and/or allowedSubscriptionSubjects`);let r=n.peerKind.trim();if(r.length===0)throw Error(`registerHmacIdentitySecret requires a non-empty peerKind`);let i=n.allowedMessageSubjects!==void 0||n.allowedSubscriptionSubjects!==void 0;if(n.requiredSubscriptionFilters!==void 0){for(let e of Object.keys(n.requiredSubscriptionFilters))if(e.includes(`*`))throw Error(`registerHmacIdentitySecret requires exact full subjects for requiredSubscriptionFilters`)}let a={secret:t,peerKind:r,...n.claims===void 0?{}:{claims:n.claims},...i?{allowedMessageSubjects:new Set(n.allowedMessageSubjects??[]),allowedSubscriptionSubjects:new Set(n.allowedSubscriptionSubjects??[])}:{},...n.requiredSubscriptionFilters===void 0?{}:{requiredSubscriptionFilters:Me(n.requiredSubscriptionFilters)}};return E.set(e,a),D(e,a)}function Ne(e,t,n={}){if(t.length===0)throw Error(`rotateHmacIdentitySecret requires a non-empty secret`);let r=E.get(e);if(!r)throw Error(`Cannot rotate HMAC identity secret: no registration exists for '${e}'`);let i={secret:t,peerKind:r.peerKind,...n.claims===void 0?r.claims===void 0?{}:{claims:r.claims}:{claims:n.claims},...r.allowedMessageSubjects===void 0?{}:{allowedMessageSubjects:r.allowedMessageSubjects},...r.allowedSubscriptionSubjects===void 0?{}:{allowedSubscriptionSubjects:r.allowedSubscriptionSubjects},...r.requiredSubscriptionFilters===void 0?{}:{requiredSubscriptionFilters:r.requiredSubscriptionFilters}};return E.set(e,i),D(e,i)}function Pe(e){let t=E.get(e);return t===void 0?void 0:D(e,t)}function Fe(e){return E.get(e)?.secret??null}function Ie(e){let t=E.get(e);return t?{kind:t.peerKind,id:e,authenticated:!0,...t.claims===void 0?{}:{claims:t.claims}}:null}function Le(e){return E.get(e)?.allowedMessageSubjects??null}function k(e){return E.get(e)?.allowedSubscriptionSubjects??null}function Re(e){return E.get(e)?.requiredSubscriptionFilters??null}function ze(){E.clear()}function Be(e){return e.type===`request`||e.type===`event`||e.type===`broadcast`}function Ve(e){return t(e)&&Object.values(e).every(e=>Array.isArray(e)&&e.every(e=>typeof e==`number`&&Number.isFinite(e)))}function He(e){return e.endsWith(`*`)}function Ue(e,t,n,r){let i={};for(let[a,o]of Object.entries(e))He(a)?t===null||t.has(a)?i[a]=o:n&&console.debug(`[ServerTransport] Dropping wildcard subscription '${a}': not in allowedSubscriptionSubjects for peer '${r}'`):t===null||[...t].some(e=>m(a,e))?i[a]=o:n&&console.debug(`[ServerTransport] Dropping subscription subject '${a}': not allowed for peer '${r}'`);return Object.keys(i).length>0?i:null}async function A(e,t,n){let r=await Promise.allSettled(Array.from(t).map(t=>t(e,n.receiveContext)));for(let e of r)if(e.status===`rejected`&&n.debug){let t=n.logContext?` ${n.logContext}`:``;console.error(`[ServerTransport] Handler error${t}:`,e.reason)}return r.every(e=>e.status===`fulfilled`)}async function j(e,t,n){let r=!0;for(let i of e)await A(i,t,n)||(r=!1);return r}function We(e,t,n){let{correlations:r,broadcastAggregator:i,debug:a}=t;if(e.type===`heartbeat`)return!0;if(e.type===`response`){let t=e;return typeof t.correlationId==`string`?(t.error?r.reject(t.correlationId,l(t.error)):r.resolve(t.correlationId,t.result),!0):(a&&console.warn(`[ServerTransport] Malformed response message: missing correlationId`),!0)}if(e.type===`broadcast-response`){let t=e;return typeof t.correlationId==`string`?(i.handleResponse(n,t),!0):(a&&console.warn(`[ServerTransport] Malformed broadcast-response: missing correlationId`),!0)}return!1}function Ge(e){let t=e?.peer?.id;if(t===void 0)return null;let n=Le(t),r=k(t);return n===null&&r===null?null:{peerId:t,allowedMessageSubjects:n,allowedSubscriptionSubjects:r}}function Ke(e,t,n,r){if(r===null||!Be(e))return!1;let i=`${e.namespace}.${e.subject}`;return r.allowedMessageSubjects===null||r.allowedMessageSubjects.has(i)?!1:(e.type===`request`&&n.sendSafely(t,JSON.stringify({type:`response`,correlationId:e.correlationId,error:{message:`Subject '${i}' is not allowed for peer '${r.peerId}'`}})),n.debug&&console.warn(`[ServerTransport] Dropping ${e.type} to '${i}': not allowed for peer '${r.peerId}'`),!0)}function qe(e,t,n){if(!Ve(e.subjects))return n&&console.warn(`[ServerTransport] Malformed ${e.type} message: missing subjects record`),null;if(t===null)return e.subjects;let r=Ue(e.subjects,t.allowedSubscriptionSubjects,n,t.peerId);return r===null&&n&&console.debug(`[ServerTransport] Dropping ${e.type} message: all subjects filtered for peer '${t.peerId}'`),r}async function Je(e,t,n,r,i){if(e.type!==`subscribe`&&e.type!==`unsubscribe`)return!1;let a=e,o=qe(a,i,n.debug);return o===null||await j(a.type===`subscribe`?n.registry.handleSubscribeMessage(t,{...a,subjects:o}):n.registry.handleUnsubscribeMessage(t,o),n.handlers,{debug:n.debug,receiveContext:r,logContext:`dispatching ${a.type}`})&&typeof a.ackId==`string`&&n.sendSafely(t,JSON.stringify({type:`subscription-ack`,ackId:a.ackId})),!0}async function Ye(e,t,n,r){if(e.type!==`broadcast`)return!1;let i=e;if(typeof i.correlationId!=`string`||typeof i.subject!=`string`)return n.debug&&console.warn(`[ServerTransport] Malformed broadcast message: missing correlationId or subject`),!0;let a=u(i)??void 0,o=n.registry.getInterestedClients(a,i.payload,t),s=n.normalizeBroadcastTimeout(i.timeout);return n.broadcastAggregator.startClientBroadcast(t,i,o,n.sendSafely,s),await A(e,n.handlers,{debug:n.debug,receiveContext:r}),!0}async function Xe(e,t,n){if(We(e,n,t))return;let r=n.auth?.getReceiveContext?.(t),i=Ge(r);if(!Ke(e,t,n,i)){if(e.type===`subscribe`||e.type===`unsubscribe`){await Je(e,t,n,r,i);return}if(e.type===`broadcast`){await Ye(e,t,n,r);return}e.type===`event`&&n.registry.forwardEventToClients(t,e,n.sendSafely),e.type===`request`&&n.registry.trackRequestOrigin(t,e),await A(e,n.handlers,{debug:n.debug,receiveContext:r})}}function Ze(e,t){let{auth:n,registry:r,debug:i}=t;return async a=>{let o;try{o=JSON.parse(a.toString())}catch(e){i&&console.error(`[ServerTransport] Failed to parse message:`,e);return}let s=o&&typeof o==`object`?o:void 0;if(!s||typeof s.type!=`string`){i&&console.error(`[ServerTransport] Invalid message structure:`,o);return}let c=o;try{if(n?.handleAuthMessage(c,e))return;if(n&&r.isAuthenticating(e)){i&&console.warn(`[ServerTransport] Ignoring message from unauthenticated client`);return}if(n?.isSocketAuthenticated?.(e)===!1){i&&console.warn(`[ServerTransport] Closing socket with expired authentication`),n.cleanupSocket(e),e.close(1008,`Authentication expired`);return}await Xe(c,e,t)}catch(e){i&&console.error(`[ServerTransport] Failed to process message:`,e)}}}function Qe(e){return typeof e!=`number`||!Number.isFinite(e)||e<=0?5e3:Math.min(e,6e4)}async function $e(e,t){let{registry:n,correlations:r,broadcastAggregator:i,handlers:a,auth:o,serverSubscriptions:c,sendSafely:l,debug:u,onConnectionClosed:d}=t;o&&n.addAuthenticating(e);let f=Ze(e,{registry:n,correlations:r,broadcastAggregator:i,handlers:a,auth:o,normalizeBroadcastTimeout:Qe,sendSafely:l,debug:u}),p=e=>{f(e.data)},m=()=>{let t=o?.getReceiveContext?.(e)?.connectionId;o?.cleanupSocket(e);let r=n.removeClient(e);t!==void 0&&d(t),e.removeEventListener(`message`,p),e.removeEventListener(`close`,m),e.removeEventListener(`error`,h),i.handleClientDisconnect(e),j(r,a,{debug:u,logContext:`dispatching disconnected client subscriptions`}),u&&console.info(`[ServerTransport] Client disconnected (${n.size} remaining)`)},h=e=>{u&&console.error(`[ServerTransport] Client socket error:`,e)};e.addEventListener(`message`,p),e.addEventListener(`close`,m),e.addEventListener(`error`,h);try{if(o&&(await o.authenticateServer(e,t=>{if(e.readyState!==1)throw Error(`Cannot send auth message: socket not ready (state: ${e.readyState})`);e.send(JSON.stringify(t))}),n.removeAuthenticating(e)),e.readyState!==1)return;if(n.addClient(e,o?.getReceiveContext?.(e)?.connectionId),c.size>0){let t=s(c);l(e,JSON.stringify(t))}l(e,JSON.stringify({type:`subscribe-sync-complete`})),u&&console.info(`[ServerTransport] Client connected (${n.size} total)`)}catch(t){if(u&&console.error(`[ServerTransport] Client connection setup failed:`,t),e.readyState>=2)return;let n=t instanceof _&&(t.code===`WS_AUTHENTICATION_REJECTED`||t.code===`WS_POLICY_REJECTED`);e.close(n?1008:1011,n?`Authentication failed`:`Connection setup failed`)}}async function et(e,t,n){let{registry:r,correlations:i}=n,s=`${e.namespace}.${e.subject}`,c=r.getRequestOrigin(e.correlationId),l=r.getInterestedRequestClients(s,e.payload,c);if(l.length===0)throw new a(s);for(let[n,r]of l.entries()){let a=`${e.correlationId}:attempt-${n+1}`,c={...e,correlationId:a};try{r.send(JSON.stringify(c))}catch{continue}try{return await i.track(a,t)}catch(e){if(f(e,s)||e instanceof o)continue;throw e}}throw new a(s)}var tt=class{name;wss;auth;debug;handlers=new Set;registry;serverSubscriptions=new Map;broadcastAggregator;correlations=new r;connectionListener=null;connectionClosedHandlers=new Set;constructor(e){let{websocket:t,name:n=`websocket`,auth:r,debug:i=!1}=e;this.wss=t,this.name=n,this.auth=r,this.debug=i,this.registry=new Ae({debug:i,subscriptionSubjectRestrictionResolver:r?e=>{let t=(r.getReceiveContext?.(e))?.peer?.id;return t===void 0?null:k(t)}:void 0,requiredSubscriptionFilterResolver:r?e=>{let t=(r.getReceiveContext?.(e))?.peer?.id;return t===void 0?null:Re(t)}:void 0,socketAuthChecker:r?e=>r.isSocketAuthenticated?.(e)??!0:void 0}),this.broadcastAggregator=new ke({debug:i})}sendToClientSafely(e,t){try{e.send(t)}catch(e){this.debug&&console.warn(`[ServerTransport] Failed to send message to client:`,e)}}async connect(){if(this.connectionListener!==null)throw Error(`ServerTransport.connect() called while already connected`);this.connectionListener=e=>{$e(e,{registry:this.registry,correlations:this.correlations,broadcastAggregator:this.broadcastAggregator,handlers:this.handlers,auth:this.auth,serverSubscriptions:this.serverSubscriptions,sendSafely:(e,t)=>this.sendToClientSafely(e,t),debug:this.debug,onConnectionClosed:e=>{for(let t of this.connectionClosedHandlers)t(e)}})},this.wss.on(`connection`,this.connectionListener),this.debug&&console.info(`[ServerTransport] Listening for connections`)}async disconnect(){this.connectionListener&&=(this.wss.off(`connection`,this.connectionListener),null);let e=this.registry.getAllSockets();for(let t of e)t.close();await new Promise((e,t)=>{this.wss.close(n=>n?t(n):e())}),this.correlations.cleanup(),this.broadcastAggregator.cleanup(),this.auth?.cleanup(),this.handlers.clear(),this.serverSubscriptions.clear(),this.debug&&console.info(`[ServerTransport] Disconnected`)}async send(e,t){if(e.type===`response`){let t=this.registry.consumeResponseClient(e.correlationId);return t?(this.sendToClientSafely(t,JSON.stringify(e)),!0):!1}if(e.type===`broadcast`){let n=u(e)??void 0,r=`payload`in e?e.payload:void 0,i=this.registry.getInterestedClients(n,r);return this.broadcastAggregator.startServerBroadcast(e,i,(e,t)=>{this.sendToClientSafely(e,t)},t)}if(e.type===`request`)return et(e,t??i,{registry:this.registry,correlations:this.correlations});if(this.registry.size===0){if(this.debug){let t=u(e);console.debug(`[ServerTransport] No clients to receive ${e.type}${t?`: ${t}`:``}`)}return!1}let n=u(e)??void 0,r=`payload`in e?e.payload:void 0,a=JSON.stringify(e),o=this.registry.getInterestedClients(n,r);for(let e of o)this.sendToClientSafely(e,a);let s=o.length>0;if(!s&&(n&&this.debug&&console.warn(`[ServerTransport] No interested clients for subject: ${n}`),!n))throw Error(`No connected clients available to receive message`);return s}async sendToConnection(e,t){let n=this.registry.getClientByConnectionId(t);return n===void 0?!1:(this.sendToClientSafely(n,JSON.stringify(e)),!0)}onConnectionClosed(e){return this.connectionClosedHandlers.add(e),()=>this.connectionClosedHandlers.delete(e)}onReceive(e){return this.handlers.add(e),()=>{this.handlers.delete(e)}}cancelRequest(e,t){this.correlations.cancel(e,t),this.registry.cancelRequestOrigin(e)}onBroadcastResults(e,t,n){this.broadcastAggregator.handleNodeResults(e,t,n)}async subscribe(e,t,n=[],r){let i=this.serverSubscriptions.get(e),a=i?.filter,o=t??a,c=r??i?.deliveryClass??`relayable`;if(this.serverSubscriptions.set(e,{filter:o,priorities:n,deliveryClass:c}),this.registry.size>0){let t=s(new Map([[e,{filter:o,priorities:n,deliveryClass:c}]])),r=JSON.stringify(t);for(let e of this.registry.getReadyClients())this.sendToClientSafely(e,r)}}getConnectionCount(){return this.registry.getReadyClients().length}async unsubscribe(e){if(this.serverSubscriptions.delete(e),this.registry.size>0){let t=c({[e]:[]}),n=JSON.stringify(t);for(let e of this.registry.getReadyClients())this.sendToClientSafely(e,n)}}};function nt(e,t){let n=new Event(`close`);return Object.defineProperties(n,{code:{value:e??1e3,enumerable:!0},reason:{value:t??``,enumerable:!0}}),n}function rt(e){if(typeof e!=`object`||!e)throw TypeError(`WebSocket transport options must be an object`);let t=e;if(t.mode!==`client`&&t.mode!==`server`)throw TypeError(`WebSocket transport mode must be "client" or "server"`);if(t.mode===`client`){if(!it(t.websocket))throw TypeError(`WebSocket transport client mode requires a websocket with addEventListener/removeEventListener`);return}if(!at(t.websocket))throw TypeError(`WebSocket transport server mode requires a websocket with on/off listener methods`)}function it(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.send==`function`&&typeof t.close==`function`&&typeof t.addEventListener==`function`&&typeof t.removeEventListener==`function`}function at(e){if(typeof e!=`object`||!e)return!1;let t=e;return typeof t.on==`function`&&typeof t.off==`function`&&typeof t.close==`function`}var ot=class{secret;algorithm;challengeTimeout;identityId;resolveSecret;resolvePeer;pendingChallenge;pendingResult;queuedChallengeNonce;queuedResult;clientAuthComplete=!1;serverPendingResponses=new Map;serverAuthenticatedSockets=new Set;serverAuthenticatedPeers=new Map;serverConnectionIds=new Map;serverAuthenticatedSecrets=new Map;constructor(e){this.secret=e.secret,this.algorithm=e.algorithm??`sha256`,this.challengeTimeout=e.challengeTimeout??5e3,this.identityId=e.identityId,this.resolveSecret=e.resolveSecret,this.resolvePeer=e.resolvePeer}async authenticateServer(e,t){let n=crypto.getRandomValues(new Uint8Array(32)),r=Array.from(n).map(e=>e.toString(16).padStart(2,`0`)).join(``),i=this.waitForAuthResponseWithIdentity(e),a=this.serverPendingResponses.get(e);i.catch(()=>void 0);try{t({type:`auth-challenge`,nonce:r});let{signature:n,identityId:o}=await i;this.assertServerOwner(e,a);let s;if(this.resolveSecret&&o!==void 0){let i=this.resolveSecret(o);if(i===null)throw this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!1,error:`Unknown identity`}),new _(`WS_AUTHENTICATION_REJECTED`,`HMAC authentication failed: Unknown identity '${o}'`);s=await this.computeHmacWithSecret(r,i),this.assertServerOwner(e,a),this.constantTimeEqual(n,s)&&(this.serverAuthenticatedPeers.set(e,o),this.serverAuthenticatedSecrets.set(e,i))}else s=await this.computeHmac(r),this.assertServerOwner(e,a);if(!this.constantTimeEqual(n,s))throw this.sendAuthResultBestEffort(t,{type:`auth-result`,success:!1,error:`Invalid signature`}),new _(`WS_AUTHENTICATION_REJECTED`,`HMAC authentication failed: Invalid signature`);try{t({type:`auth-result`,success:!0}),this.assertServerOwner(e,a)}catch(t){throw this.serverPendingResponses.get(e)===a&&this.cleanupSocket(e),t}this.serverAuthenticatedSockets.add(e),this.serverConnectionIds.set(e,globalThis.crypto.randomUUID())}finally{clearTimeout(a.timeoutHandle),this.serverPendingResponses.get(e)===a&&this.serverPendingResponses.delete(e)}}async authenticateClient(e){this.clientAuthComplete=!1;let t=this.waitForAuthChallenge(),n=this.pendingChallenge;try{let r=await t;this.assertClientOwner(n);let i=await this.computeHmac(r);this.assertClientOwner(n),e({type:`auth-response`,signature:i,...this.identityId!==void 0&&{identityId:this.identityId}}),this.assertClientOwner(n);let a=await this.waitForAuthResult();if(this.assertClientOwner(n),!a.success)throw new _(`WS_AUTHENTICATION_REJECTED`,`HMAC authentication failed: ${a.error??`Unknown error`}`);this.clientAuthComplete=!0}finally{clearTimeout(n.timeoutHandle),this.pendingChallenge===n&&(this.pendingChallenge=void 0)}}assertClientOwner(e){if(this.pendingChallenge!==e)throw new _(`WS_CONNECTION_UNAVAILABLE`,`Socket disconnected during HMAC authentication`)}assertServerOwner(e,t){if(this.serverPendingResponses.get(e)!==t)throw new _(`WS_CONNECTION_UNAVAILABLE`,`Socket disconnected during HMAC authentication`)}handleAuthMessage(e,t){if(typeof e!=`object`||!e||!(`type`in e)||typeof e.type!=`string`)return!1;let n=e;if(n.type===`auth-challenge`)return typeof n.nonce!=`string`||this.clientAuthComplete||(this.pendingChallenge?(clearTimeout(this.pendingChallenge.timeoutHandle),this.pendingChallenge.resolve(n.nonce)):this.queuedChallengeNonce=n.nonce),!0;if(n.type===`auth-result`){if(typeof n.success!=`boolean`||this.clientAuthComplete)return!0;let e={success:n.success,error:typeof n.error==`string`?n.error:void 0};return this.pendingResult?(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.resolve(e),this.pendingResult=void 0):this.queuedResult=e,!0}if(n.type===`auth-response`){if(t){let e=this.serverPendingResponses.get(t);if(e){if(clearTimeout(e.timeoutHandle),n.identityId!==void 0&&typeof n.identityId!=`string`)return e.reject(new _(`WS_AUTHENTICATION_REJECTED`,`Malformed HMAC identity`)),!0;e.resolve({signature:n.signature,identityId:n.identityId})}}return!0}return!1}async waitForAuthChallenge(){return new Promise((e,t)=>{let n=setTimeout(()=>{t(new _(`WS_HANDSHAKE_TIMEOUT`,`Authentication challenge timeout`))},this.challengeTimeout);this.pendingChallenge={resolve:e,reject:t,timeoutHandle:n},this.queuedChallengeNonce!==void 0&&(clearTimeout(n),e(this.queuedChallengeNonce),this.queuedChallengeNonce=void 0)})}async waitForAuthResponseWithIdentity(e){return new Promise((t,n)=>{let r={resolve:t,reject:n,timeoutHandle:setTimeout(()=>{n(new _(`WS_HANDSHAKE_TIMEOUT`,`Authentication response timeout`))},this.challengeTimeout)};this.serverPendingResponses.set(e,r)})}async waitForAuthResult(){if(this.queuedResult!==void 0){let e=this.queuedResult;return this.queuedResult=void 0,e}return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingResult=void 0,t(new _(`WS_HANDSHAKE_TIMEOUT`,`Authentication result timeout`))},this.challengeTimeout);this.pendingResult={resolve:e,reject:t,timeoutHandle:n}})}async computeHmac(e){return this.computeHmacWithSecret(e,this.secret)}async computeHmacWithSecret(e,t){let n=new TextEncoder,r=n.encode(t),i=this.algorithm.replace(/^sha/,`SHA-`),a=await crypto.subtle.importKey(`raw`,r,{name:`HMAC`,hash:i},!1,[`sign`]),o=await crypto.subtle.sign(`HMAC`,a,n.encode(e));return Array.from(new Uint8Array(o)).map(e=>e.toString(16).padStart(2,`0`)).join(``)}getReceiveContext(e){if(!e)return;let t=this.serverAuthenticatedPeers.get(e);if(t===void 0)return;let n=this.resolvePeer?.(t);if(n!=null)return{transportName:``,connectionId:this.serverConnectionIds.get(e),peer:{...n,id:n.id??t,authenticated:!0}}}isSocketAuthenticated(e){if(!this.serverAuthenticatedSockets.has(e))return!1;if(!this.resolveSecret)return!0;let t=this.serverAuthenticatedPeers.get(e);if(t===void 0)return!0;let n=this.resolveSecret(t);if(n===null)return this.cleanupSocket(e),!1;let r=this.serverAuthenticatedSecrets.get(e);return r!==void 0&&n!==r?(this.cleanupSocket(e),!1):!0}constantTimeEqual(e,t){if(typeof e!=`string`||e.length!==t.length||!/^[0-9a-f]+$/i.test(e))return!1;let n=new Uint8Array(e.length/2),r=new Uint8Array(t.length/2);for(let i=0;i<n.length;i++)n[i]=parseInt(e.slice(i*2,i*2+2),16),r[i]=parseInt(t.slice(i*2,i*2+2),16);let i=0;for(let e=0;e<n.length;e++)i|=n[e]^r[e];return i===0}sendAuthResultBestEffort(e,t){try{e(t)}catch{}}cleanupSocket(e){let t=this.serverPendingResponses.get(e);t&&(clearTimeout(t.timeoutHandle),this.serverPendingResponses.delete(e),t.reject(new _(`WS_CONNECTION_UNAVAILABLE`,`Socket disconnected during HMAC authentication`))),this.serverAuthenticatedPeers.delete(e),this.serverConnectionIds.delete(e),this.serverAuthenticatedSecrets.delete(e),this.serverAuthenticatedSockets.delete(e)}cleanup(){this.pendingChallenge&&=(clearTimeout(this.pendingChallenge.timeoutHandle),this.pendingChallenge.reject(new _(`WS_CONNECTION_UNAVAILABLE`,`Socket disconnected during HMAC authentication`)),void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.reject(new _(`WS_CONNECTION_UNAVAILABLE`,`Socket disconnected during HMAC authentication`)),void 0),this.queuedChallengeNonce=void 0,this.queuedResult=void 0,this.clientAuthComplete=!1;for(let e of this.serverPendingResponses.values())clearTimeout(e.timeoutHandle),e.reject(new _(`WS_CONNECTION_UNAVAILABLE`,`Socket disconnected during HMAC authentication`));this.serverPendingResponses.clear(),this.serverAuthenticatedPeers.clear(),this.serverConnectionIds.clear(),this.serverAuthenticatedSecrets.clear(),this.serverAuthenticatedSockets.clear()}};const st=`makaio-cli-local:v1`,ct=`makaio-cli-local`;function lt(e){return O(st,e,{peerKind:ct})}function M(e){let t=Array.from(e,e=>String.fromCharCode(e)).join(``);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``)}function N(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=(4-t.length%4)%4;t+=`=`.repeat(n);let r=atob(t),i=new Uint8Array(r.length);for(let e=0;e<r.length;e++)i[e]=r.charCodeAt(e);return i}function P(e){return new TextEncoder().encode(e)}function F(e){return new TextDecoder().decode(e)}async function I(e){let t=await crypto.subtle.exportKey(`spki`,e);return M(new Uint8Array(t))}async function L(e){let t=await crypto.subtle.exportKey(`raw`,e);return M(new Uint8Array(t))}async function R(e,t,n=[]){let r=N(e);return crypto.subtle.importKey(`spki`,r,t,!0,n)}async function z(e,t,n=[]){let r=N(e);return crypto.subtle.importKey(`raw`,r,t,!0,n)}async function B(e){let t=await crypto.subtle.exportKey(`pkcs8`,e),n=M(new Uint8Array(t)).replace(/-/g,`+`).replace(/_/g,`/`),r=(4-n.length%4)%4;return n+=`=`.repeat(r),`-----BEGIN PRIVATE KEY-----\n${n.match(/.{1,64}/g)?.join(`
+`)??n}\n-----END PRIVATE KEY-----`}async function V(e,t,n){let r=N(e.replace(/-----BEGIN PRIVATE KEY-----/,``).replace(/-----END PRIVATE KEY-----/,``).replace(/\s/g,``).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``));return crypto.subtle.importKey(`pkcs8`,r,t,!0,n)}const H={name:`ECDH`,namedCurve:`P-256`};async function U(e=!0){return crypto.subtle.generateKey(H,e,[`deriveKey`,`deriveBits`])}async function ut(e){return I(e)}async function dt(e){return L(e)}async function ft(e){return z(e,H)}async function pt(e,t=[]){return R(e,H,t)}async function mt(e){return B(e)}async function ht(e){return V(e,H,[`deriveKey`,`deriveBits`])}async function gt(e,t){return crypto.subtle.deriveBits({name:`ECDH`,public:t},e,256)}async function W(e,t){let n=crypto.getRandomValues(new Uint8Array(12)),r=await crypto.subtle.encrypt({name:`AES-GCM`,iv:n},e,t);return{ciphertext:new Uint8Array(r),nonce:n}}async function G(e,t,n){let r=await crypto.subtle.decrypt({name:`AES-GCM`,iv:n},e,t);return new Uint8Array(r)}async function _t(e){return crypto.subtle.importKey(`raw`,e,{name:`AES-GCM`},!1,[`encrypt`,`decrypt`])}async function vt(e,t,n){let r=await crypto.subtle.importKey(`raw`,e,{name:`HKDF`},!1,[`deriveKey`]);return crypto.subtle.deriveKey({name:`HKDF`,hash:`SHA-256`,salt:t,info:P(n)},r,{name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`])}const K={name:`ECDSA`,namedCurve:`P-256`};async function yt(e=!0){return crypto.subtle.generateKey(K,e,[`sign`,`verify`])}async function bt(e,t){let n=await crypto.subtle.sign({name:`ECDSA`,hash:{name:`SHA-256`}},e,t);return new Uint8Array(n)}async function xt(e,t,n){return crypto.subtle.verify({name:`ECDSA`,hash:{name:`SHA-256`}},e,t,n)}async function St(e){return I(e)}async function Ct(e){return R(e,K,[`verify`])}async function wt(e){return L(e)}async function Tt(e){return z(e,K,[`verify`])}async function Et(e){return B(e)}async function Dt(e){return V(e,K,[`sign`])}var Ot=e({decodeText:()=>F,decrypt:()=>G,deriveSessionKey:()=>vt,deriveSharedSecret:()=>gt,encodeText:()=>P,encrypt:()=>W,exportPrivateKeyPEM:()=>mt,exportPublicKey:()=>ut,exportPublicKeyRaw:()=>dt,exportSigningPrivateKeyPEM:()=>Et,exportSigningPublicKey:()=>St,exportSigningPublicKeyRaw:()=>wt,fromBase64Url:()=>N,generateECDHKeyPair:()=>U,generateSigningKeyPair:()=>yt,importAESKey:()=>_t,importPrivateKeyPEM:()=>ht,importPublicKey:()=>pt,importPublicKeyRaw:()=>ft,importSigningPrivateKeyPEM:()=>Dt,importSigningPublicKey:()=>Ct,importSigningPublicKeyRaw:()=>Tt,sign:()=>bt,toBase64Url:()=>M,verify:()=>xt});function kt(e){let t=e.match(/.{1,2}/g);return new Uint8Array(t?.map(e=>parseInt(e,16))??[])}function q(e){return Array.from(e).map(e=>e.toString(16).padStart(2,`0`)).join(``)}async function J(e,t){let n=await U(!0),r=await ut(n.publicKey);return{ephemeralKeyPair:n,ephemeralPublicKey:r,signature:q(await bt(e,P(r+t)))}}function At(){return q(crypto.getRandomValues(new Uint8Array(16)))}async function Y(e,t,n,r){let i=P(t+r);return xt(e,kt(n),i)}async function X(e,t,n,r){let i;try{i=await pt(t)}catch(e){throw e instanceof DOMException&&e.name===`DataError`?new _(`WS_AUTHENTICATION_REJECTED`,`Invalid E2E peer public key`,{cause:e}):e}return vt(await gt(e,i),kt(n),r)}async function jt(e,t,n,r){if(e===t)throw Error(`deriveRelaySaltHex: identityId must differ from peerId`);let[i,a]=e<t?[e,t]:[t,e],[o,s]=e<t?[n,r]:[r,n],c=P(`${i}${a}${o}${s}`),l=new Uint8Array(c).buffer,u=await crypto.subtle.digest(`SHA-256`,l);return q(new Uint8Array(u))}function Mt(e,t){return typeof e==`string`&&/^[A-Za-z0-9_-]+$/.test(e)&&e.length%4!=1&&typeof t==`string`&&/^[0-9a-f]{128}$/i.test(t)}function Nt(e){return Mt(e.ephemeralPublicKey,e.signature)&&typeof e.salt==`string`&&/^[0-9a-f]{32}$/i.test(e.salt)}var Pt=class{signingKeyPair;identityId;peerId;getPeerSigningKey;timeout;pendingKeyExchange;pendingResult;clientSession;clientEphemeralKeyPair;serverPendingKeyExchange=new Map;serverSessions=new Map;serverEphemeralKeyPairs=new Map;constructor(e){this.signingKeyPair=e.signingKeyPair,this.identityId=e.identityId,this.peerId=e.peerId,this.getPeerSigningKey=e.getPeerSigningKey,this.timeout=e.timeout??1e4}async authenticateClient(e){if(!this.peerId)throw Error(`E2E authentication failed: peerId is required for client authentication`);let t=this.waitForKeyExchangeResponse(),n=this.pendingKeyExchange,r=this.waitForAuthResult();t.catch(()=>void 0),r.catch(()=>void 0);try{let{ephemeralKeyPair:i,ephemeralPublicKey:a,signature:o}=await J(this.signingKeyPair.privateKey,this.identityId);this.assertClientOwner(n),this.clientEphemeralKeyPair=i,e({type:`e2e-key-exchange`,deviceId:this.identityId,ephemeralPublicKey:a,signature:o}),this.assertClientOwner(n);let s=await t;this.assertClientOwner(n);let c=await this.getPeerSigningKey(this.peerId);if(this.assertClientOwner(n),!c)throw new _(`WS_AUTHENTICATION_REJECTED`,`E2E authentication failed: Unknown server`);let l=await Y(c,s.ephemeralPublicKey,s.signature,this.peerId);if(this.assertClientOwner(n),!l)throw new _(`WS_AUTHENTICATION_REJECTED`,`E2E authentication failed: Invalid server signature`);let u=await X(i.privateKey,s.ephemeralPublicKey,s.salt,`makaio-e2e-session-v1`);this.assertClientOwner(n);let d=await r;if(this.assertClientOwner(n),!d.success)throw new _(`WS_AUTHENTICATION_REJECTED`,`E2E authentication failed: ${d.error??`Unknown error`}`);this.clientSession={sessionKey:u,peerId:this.peerId}}catch(e){throw this.pendingKeyExchange===n&&(this.clientSession=void 0,this.clientEphemeralKeyPair=void 0),e}finally{clearTimeout(n.timeoutHandle),this.pendingKeyExchange===n&&(this.pendingKeyExchange=void 0,this.pendingResult&&clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult=void 0)}}async authenticateServer(e,t){let n=this.waitForClientKeyExchange(e),r=this.serverPendingKeyExchange.get(e);try{let i=await n;this.assertServerOwner(e,r);let a=await this.getPeerSigningKey(i.deviceId);if(this.assertServerOwner(e,r),!a)throw new _(`WS_AUTHENTICATION_REJECTED`,`E2E authentication failed: Unknown device ${i.deviceId}`);let o=await Y(a,i.ephemeralPublicKey,i.signature,i.deviceId);if(this.assertServerOwner(e,r),!o)throw new _(`WS_AUTHENTICATION_REJECTED`,`E2E authentication failed: Invalid client signature`);let{ephemeralKeyPair:s,ephemeralPublicKey:c,signature:l}=await J(this.signingKeyPair.privateKey,this.identityId);this.assertServerOwner(e,r);let u=At();this.serverEphemeralKeyPairs.set(e,s),t({type:`e2e-key-exchange-response`,ephemeralPublicKey:c,signature:l,salt:u}),this.assertServerOwner(e,r);let d=await X(s.privateKey,i.ephemeralPublicKey,u,`makaio-e2e-session-v1`);this.assertServerOwner(e,r),this.serverSessions.set(e,{sessionKey:d,peerId:i.deviceId}),t({type:`e2e-auth-result`,success:!0}),this.assertServerOwner(e,r)}catch(n){if(this.serverPendingKeyExchange.get(e)===r){this.serverEphemeralKeyPairs.delete(e),this.serverSessions.delete(e);try{n instanceof _&&n.code===`WS_AUTHENTICATION_REJECTED`&&t({type:`e2e-auth-result`,success:!1,error:n.message})}catch{}}throw n}finally{clearTimeout(r.timeoutHandle),this.serverPendingKeyExchange.get(e)===r&&this.serverPendingKeyExchange.delete(e)}}assertClientOwner(e){if(this.pendingKeyExchange!==e)throw new _(`WS_CONNECTION_UNAVAILABLE`,`Connection closed during E2E authentication`)}assertServerOwner(e,t){if(this.serverPendingKeyExchange.get(e)!==t)throw new _(`WS_CONNECTION_UNAVAILABLE`,`Connection closed during E2E authentication`)}handleAuthMessage(e,t){if(typeof e!=`object`||!e||!(`type`in e)||typeof e.type!=`string`)return!1;let n=e;if(n.type===`e2e-key-exchange-response`){if(this.pendingKeyExchange){if(clearTimeout(this.pendingKeyExchange.timeoutHandle),!Nt(n))return this.pendingKeyExchange.reject(new _(`WS_AUTHENTICATION_REJECTED`,`Malformed E2E key exchange response`)),!0;this.pendingKeyExchange.resolve({ephemeralPublicKey:n.ephemeralPublicKey,signature:n.signature,salt:n.salt})}return!0}if(n.type===`e2e-auth-result`){if(typeof n.success!=`boolean`)return!0;let e=typeof n.error==`string`?n.error:void 0;return!n.success&&this.pendingKeyExchange&&(clearTimeout(this.pendingKeyExchange.timeoutHandle),this.pendingKeyExchange.reject(new _(`WS_AUTHENTICATION_REJECTED`,`E2E authentication failed: ${e??`Unknown error`}`))),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.resolve({success:n.success,error:e}),void 0),!0}if(n.type===`e2e-key-exchange`&&t){let e=this.serverPendingKeyExchange.get(t);if(e){if(clearTimeout(e.timeoutHandle),typeof n.deviceId!=`string`||!Mt(n.ephemeralPublicKey,n.signature))return e.reject(new _(`WS_AUTHENTICATION_REJECTED`,`Malformed E2E key exchange`)),!0;e.resolve({deviceId:n.deviceId,ephemeralPublicKey:n.ephemeralPublicKey,signature:n.signature})}return!0}return!1}async waitForKeyExchangeResponse(){return new Promise((e,t)=>{let n=setTimeout(()=>{t(new _(`WS_HANDSHAKE_TIMEOUT`,`E2E key exchange timeout`))},this.timeout);this.pendingKeyExchange={resolve:e,reject:t,timeoutHandle:n}})}async waitForAuthResult(){return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingResult=void 0,t(new _(`WS_HANDSHAKE_TIMEOUT`,`E2E authentication result timeout`))},this.timeout);this.pendingResult={resolve:e,reject:t,timeoutHandle:n}})}async waitForClientKeyExchange(e){return new Promise((t,n)=>{let r={resolve:t,reject:n,timeoutHandle:setTimeout(()=>{n(new _(`WS_HANDSHAKE_TIMEOUT`,`E2E key exchange timeout`))},this.timeout)};this.serverPendingKeyExchange.set(e,r)})}getSessionKey(e){return e?this.serverSessions.get(e)?.sessionKey??null:this.clientSession?.sessionKey??null}getPeerId(e){return e?this.serverSessions.get(e)?.peerId??null:this.clientSession?.peerId??null}getReceiveContext(e){let t=this.getPeerId(e);if(t!==null)return{transportName:``,peer:{kind:`e2e`,id:t,authenticated:!0,encrypted:!0}}}cleanupSocket(e){let t=this.serverPendingKeyExchange.get(e);t&&(clearTimeout(t.timeoutHandle),t.reject(new _(`WS_CONNECTION_UNAVAILABLE`,`Connection closed during E2E authentication`)),this.serverPendingKeyExchange.delete(e)),this.serverSessions.delete(e),this.serverEphemeralKeyPairs.delete(e)}cleanup(){this.pendingKeyExchange&&=(clearTimeout(this.pendingKeyExchange.timeoutHandle),this.pendingKeyExchange.reject(new _(`WS_CONNECTION_UNAVAILABLE`,`Connection closed during E2E authentication`)),void 0),this.pendingResult&&=(clearTimeout(this.pendingResult.timeoutHandle),this.pendingResult.reject(new _(`WS_CONNECTION_UNAVAILABLE`,`Connection closed during E2E authentication`)),void 0),this.clientSession=void 0,this.clientEphemeralKeyPair=void 0;for(let e of this.serverPendingKeyExchange.values())clearTimeout(e.timeoutHandle),e.reject(new _(`WS_CONNECTION_UNAVAILABLE`,`Connection closed during E2E authentication`));this.serverPendingKeyExchange.clear(),this.serverSessions.clear(),this.serverEphemeralKeyPairs.clear()}};const Z=`E2E relay auth session aborted by reconnect`;var Ft=class{signingKeyPair;identityId;getPeerSigningKey;timeout;mode;blocking;pendingPeer;sessionKey;peerId;localEphemeral;localExchangeMessage;sentLocalExchange=!1;earlyPeer;sendAuthMessage;authGeneration=0;processingExchange=!1;constructor(e){this.signingKeyPair=e.signingKeyPair,this.identityId=e.identityId,this.getPeerSigningKey=e.getPeerSigningKey,this.timeout=e.timeout??1e4,this.mode=e.mode??`initiator`,this.blocking=e.blocking??!0}async authenticateClient(e){let t=this.sendAuthMessage===void 0?this.earlyPeer:void 0;this.cleanup();let n=this.authGeneration;if(this.earlyPeer=t,this.sendAuthMessage=e,this.mode===`initiator`){if(await this.ensureLocalExchangeMessage(),n!==this.authGeneration)throw Error(Z);this.sendLocalExchange()}if(!this.blocking){if(this.earlyPeer){let e=this.earlyPeer;this.earlyPeer=void 0,this.dispatchPeerExchange(e,n)}return}let r=await this.waitForPeerExchange();if(await this.processPeerExchange(r,n),n!==this.authGeneration||!this.sessionKey)throw Error(Z)}async authenticateServer(e,t){throw Error(`E2ERelayAuth does not support server authentication`)}handleAuthMessage(e){let t=e;return!t||t.type!==`e2e-relay-key-exchange`?!1:t.identityId===this.identityId?!0:this.pendingPeer?(this.pendingPeer.resolve(t),this.pendingPeer=void 0,!0):(this.earlyPeer=t,!this.blocking&&this.sendAuthMessage&&!this.sessionKey&&!this.processingExchange&&this.dispatchPeerExchange(t,this.authGeneration),!0)}cleanupSocket(e){}cleanup(){this.authGeneration++,this.pendingPeer&&=(this.pendingPeer.reject(Error(Z)),void 0),this.earlyPeer&&=void 0,this.sessionKey=void 0,this.peerId=void 0,this.localEphemeral=void 0,this.localExchangeMessage=void 0,this.sentLocalExchange=!1,this.processingExchange=!1,this.sendAuthMessage=void 0}dispatchPeerExchange(e,t){this.processingExchange=!0,this.processPeerExchange(e,t).catch(e=>{e instanceof Error&&e.message===Z||console.error(`[E2ERelayAuth] Peer exchange failed:`,e)}).finally(()=>{t===this.authGeneration&&(this.processingExchange=!1,this.retryQueuedPeerExchange(t))})}getSessionKey(){return this.sessionKey??null}getPeerId(){return this.peerId??null}getReceiveContext(){let e=this.getPeerId();if(e!==null)return{transportName:``,peer:{kind:`e2e`,id:e,authenticated:!0,encrypted:!0}}}async waitForPeerExchange(){if(this.earlyPeer){let e=this.earlyPeer;return this.earlyPeer=void 0,e}return new Promise((e,t)=>{let n=setTimeout(()=>{this.pendingPeer=void 0,t(Error(`E2E relay key exchange timeout`))},this.timeout),r=()=>{clearTimeout(n),this.pendingPeer=void 0};this.pendingPeer={resolve:t=>{r(),e(t)},reject:e=>{r(),t(e)},timeoutHandle:n}})}async ensureLocalExchangeMessage(){if(this.localExchangeMessage&&this.localEphemeral)return this.localExchangeMessage;let{ephemeralKeyPair:e,ephemeralPublicKey:t,signature:n}=await J(this.signingKeyPair.privateKey,this.identityId);return this.localEphemeral=e,this.localExchangeMessage={type:`e2e-relay-key-exchange`,identityId:this.identityId,ephemeralPublicKey:t,signature:n},this.localExchangeMessage}sendLocalExchange(e=!1){!this.sendAuthMessage||!this.localExchangeMessage||!e&&this.sentLocalExchange||(this.sendAuthMessage(this.localExchangeMessage),this.sentLocalExchange=!0)}retryQueuedPeerExchange(e){if(this.blocking||!this.sendAuthMessage||this.sessionKey||this.processingExchange||e!==this.authGeneration)return;let t=this.earlyPeer;t&&(this.earlyPeer=void 0,this.dispatchPeerExchange(t,e))}async processPeerExchange(e,t){if(!this.sendAuthMessage){this.earlyPeer=e;return}let n=await this.ensureLocalExchangeMessage();if(t!==this.authGeneration)return;let r=await this.getPeerSigningKey(e.identityId);if(!r)throw Error(`E2E relay authentication failed: Unknown peer ${e.identityId}`);if(!await Y(r,e.ephemeralPublicKey,e.signature,e.identityId))throw Error(`E2E relay authentication failed: Invalid peer signature`);let i=await jt(this.identityId,e.identityId,n.ephemeralPublicKey,e.ephemeralPublicKey);if(!this.localEphemeral)throw Error(`E2E relay authentication failed: Local ephemeral key missing`);let a=await X(this.localEphemeral.privateKey,e.ephemeralPublicKey,i,`makaio-e2e-relay-v1`);t===this.authGeneration&&(this.sessionKey=a,this.peerId=e.identityId,this.mode===`initiator`?this.sendLocalExchange(!0):this.sendLocalExchange())}},It=class{hmac;e2e;socketStrategy=new Map;pendingServerAuth=new Map;hmacCancelled=new Map;constructor(e){this.hmac=e.hmac,this.e2e=e.e2e}setE2EAuth(e){this.e2e=e}async authenticateClient(e){let t=this.hmac??this.e2e;if(!t)throw Error(`DispatchingAuth: no auth strategy configured`);return t.authenticateClient(e)}async authenticateServer(e,t){let n=this.resolveSingleStrategy();if(n)return n.authenticateServer(e,t);if(!this.hmac||!this.e2e)throw Error(`DispatchingAuth: no auth strategy configured`);let r={cancelled:!1};this.hmacCancelled.set(e,r);let i=this.hmac.authenticateServer(e,e=>{r.cancelled||t(e)});return new Promise((n,a)=>{this.pendingServerAuth.set(e,{resolve:n,reject:a,send:t}),i.then(n).catch(e=>{r.cancelled||a(e instanceof Error?e:Error(String(e)))})})}handleAuthMessage(e,t){if(!t)return(this.hmac??this.e2e)?.handleAuthMessage(e)??!1;let n=this.socketStrategy.get(t);if(n)return n.handleAuthMessage(e,t);let r=this.resolveStrategy(e),i=this.pendingServerAuth.get(t);return r?(this.socketStrategy.set(t,r),this.pendingServerAuth.delete(t),r===this.hmac?this.hmacCancelled.delete(t):(this.cancelHmac(t),i&&r.authenticateServer(t,i.send).then(i.resolve).catch(e=>{i.reject(e instanceof Error?e:Error(String(e)))})),r.handleAuthMessage(e,t)):(this.cancelHmac(t),i&&(this.pendingServerAuth.delete(t),i.reject(new _(`WS_POLICY_REJECTED`,`DispatchingAuth: unrecognised auth message type "${this.peekType(e)}" — no matching strategy`))),!1)}getReceiveContext(e){return this.resolveSocketStrategy(e)?.getReceiveContext?.(e)}isSocketAuthenticated(e){return this.resolveSocketStrategy(e)?.isSocketAuthenticated?.(e)??!0}cleanupSocket(e){let t=this.socketStrategy.get(e);t&&(t.cleanupSocket(e),this.socketStrategy.delete(e)),this.cancelHmac(e);let n=this.pendingServerAuth.get(e);n&&(this.pendingServerAuth.delete(e),n.reject(Error(`DispatchingAuth: socket disconnected before auth type was determined`)))}cleanup(){this.hmac?.cleanup(),this.e2e?.cleanup(),this.socketStrategy.clear();for(let e of this.pendingServerAuth.values())e.reject(Error(`DispatchingAuth: cleanup called before authentication completed`));this.pendingServerAuth.clear(),this.hmacCancelled.clear()}peekType(e){if(typeof e!=`object`||!e||!(`type`in e))return;let{type:t}=e;return typeof t==`string`?t:void 0}resolveSingleStrategy(){if(this.hmac&&!this.e2e)return this.hmac;if(this.e2e&&!this.hmac)return this.e2e}resolveSocketStrategy(e){return e===void 0?this.resolveSingleStrategy():this.socketStrategy.get(e)??this.resolveSingleStrategy()}resolveStrategy(e){let t=this.peekType(e);if(t){if(t===`e2e-key-exchange`&&this.e2e)return this.e2e;if(t===`auth-response`&&this.hmac)return this.hmac}}cancelHmac(e){let t=this.hmacCancelled.get(e);t&&(t.cancelled=!0,this.hmacCancelled.delete(e),this.hmac?.cleanupSocket(e))}};function Lt(e){return`payload`in e}async function Rt(e,t,n){if(e.type!==`response`||e.result===void 0||e.error!==void 0)return;let{ciphertext:r,nonce:i}=await W(n,P(JSON.stringify(e.result)));t.result=M(r),t.e2e={nonce:M(i),v:1}}async function zt(e,t,n){if(e.type!==`broadcast-response`||e.results===void 0||e.error!==void 0)return;let{ciphertext:r,nonce:i}=await W(n,P(JSON.stringify(e.results)));t.results=M(r),t.e2e={nonce:M(i),v:1}}async function Bt(e,t,n){if(!Lt(e)||e.payload===void 0)return;let{ciphertext:r,nonce:i}=await W(n,P(JSON.stringify(e.payload)));t.payload=M(r),t.e2e={nonce:M(i),v:1}}async function Vt(e,t,n){if(e.type!==`response`&&e.type!==`broadcast-response`||e.error===void 0)return;let{ciphertext:r,nonce:i}=await W(n,P(JSON.stringify(e.error)));t.error=M(r),t.e2e={nonce:M(i),v:1}}async function Ht(e,t,n,r){if(!Lt(e)||typeof e.payload!=`string`)return;let i=F(await G(n,N(e.payload),r));t.payload=JSON.parse(i)}async function Ut(e,t,n,r){if(e.type!==`response`||typeof e.result!=`string`)return;let i=F(await G(n,N(e.result),r));t.result=JSON.parse(i)}async function Wt(e,t,n,r){if(e.type!==`broadcast-response`||typeof e.results!=`string`)return;let i=F(await G(n,N(e.results),r));t.results=JSON.parse(i)}async function Gt(e,t,n,r){if(e.type!==`response`&&e.type!==`broadcast-response`||typeof e.error!=`string`)return;let i=F(await G(n,N(e.error),r));t.error=JSON.parse(i)}async function Kt(e,t){let n={...e};return await Bt(e,n,t),await Rt(e,n,t),await zt(e,n,t),await Vt(e,n,t),n}async function qt(e,t){if(!e.e2e)return e;let n={...e};delete n.e2e;let r=N(e.e2e.nonce);return await Ht(e,n,t,r),await Ut(e,n,t,r),await Wt(e,n,t,r),await Gt(e,n,t,r),n}function Jt(e){return e.type===`subscription-ack`&&typeof e.ackId==`string`}function Yt(e){let{e2eAuth:t,websocket:n,...r}=e,i=new w({...r,url:`<pre-connected>`,createWebSocket:()=>n,auth:t,autoReconnect:!1,heartbeat:r.heartbeat??!1,messageTransform:async e=>{let n=t.getSessionKey();if(!n||Jt(e))return e;let r=e;if(!r.e2e)throw Error(`Received plaintext message on E2E-encrypted channel — possible injection`);return qt(r,n)}});async function a(e,n){let r=t.getSessionKey();if(!r)throw Error(`E2E session key not available - authentication may have failed`);let a=await Kt(e,r);return i.send(a,n)}return{name:i.name,connect:i.connect.bind(i),disconnect:i.disconnect.bind(i),send:a,cancelRequest:i.cancelRequest.bind(i),onReceive:i.onReceive.bind(i),subscribe:i.subscribe.bind(i),unsubscribe:i.unsubscribe.bind(i),getSubscriptions:i.getSubscriptions.bind(i)}}function Xt(e){return Yt(e)}function Zt(e){if(!e||typeof e!=`object`)return!1;let t=e;if(t.type!==`e2e-relay-envelope`||typeof t.payload!=`string`)return!1;let n=t.e2e;return!!n&&typeof n.nonce==`string`&&typeof n.v==`number`}async function Qt(e,t){let{ciphertext:n,nonce:r}=await W(t,P(JSON.stringify(e)));return{type:`e2e-relay-envelope`,payload:M(n),e2e:{nonce:M(r),v:1}}}async function $t(e,t){let n=N(e.e2e.nonce),r=F(await G(t,N(e.payload),n));return JSON.parse(r)}function en(e){let t=()=>{if(!e.isFrozen())throw Error(`RelayControlRegistry must be frozen before processing relay control messages`)};function n(t){return typeof t.namespace!=`string`||typeof t.subject!=`string`||!e.isControlEvent(t.namespace,t.subject)||typeof t.messageId!=`string`?!1:t.payload!==void 0}function r(t){return typeof t.namespace!=`string`||typeof t.subject!=`string`||!e.isControlRequest(t.namespace,t.subject)||typeof t.messageId!=`string`||typeof t.correlationId!=`string`?!1:t.payload!==void 0}function i(e){if(t(),!e||typeof e!=`object`)return!1;let i=e;return i.type===`event`?n(i):i.type===`request`?r(i):!1}function a(e){if(t(),!e||typeof e!=`object`)return!1;let n=e;return n.type!==`relay-control`||n.v!==1||!n.payload||typeof n.payload!=`object`?!1:i(n.payload)}function o(e){if(t(),!i(e))throw Error(`Invalid relay control message`);return{type:`relay-control`,v:1,payload:e}}return{createRelayControlEnvelope:o,isRelayControlEnvelopeMessage:a,isRelayControlBusMessage:i}}function Q(e){let t=Date.now()-3e5;for(let[n,r]of e)r>=t||e.delete(n);for(;e.size>2048;){let t=e.keys().next().value;if(!t)break;e.delete(t)}}const tn=e=>{if(!e||typeof e!=`object`)return!1;let t=e;return t.type===`response`&&typeof t.correlationId==`string`},nn=e=>e.type===`subscribe`||e.type===`unsubscribe`,$=e=>{if(!e||typeof e!=`object`)return!1;let t=e;return t.type===`subscription-ack`&&typeof t.ackId==`string`};function rn(e,t,n,r){if(t(e)||e.type===`response`&&n.has(e.correlationId))return!0;let i=r.getSessionKey();return!i&&(nn(e)||$(e))?!0:!!i}function an(e,t,n,r){if(!r.isFrozen())throw Error(`E2ERelay transport requires a frozen relay control registry`);let{createRelayControlEnvelope:i,isRelayControlEnvelopeMessage:a,isRelayControlBusMessage:o}=en(r),s=e=>{n.delete(e),n.set(e,Date.now()),Q(n)};return{canEncode:t=>rn(t,o,n,e),encode:async t=>{if(o(t))return t.type===`request`&&s(t.correlationId),JSON.stringify(i(t));if(Q(n),t.type===`response`&&n.has(t.correlationId))return n.delete(t.correlationId),JSON.stringify(t);let r=e.getSessionKey();if(!r&&nn(t)||!r&&$(t))return JSON.stringify(t);if(!r)throw Error(`E2E relay session not established`);let a=await Qt(t,r);return JSON.stringify(a)},decode:async r=>{let i=e.getSessionKey();if(a(r)){let e=r.payload;return t&&console.info(`[E2ERelayTransport] Decoded relay control envelope:`,e.type,e.namespace,e.subject),e.type===`request`&&s(e.correlationId),e}if(Q(n),tn(r)&&n.has(r.correlationId))return n.delete(r.correlationId),r;if(!i&&$(r))return r;if(!i)throw Error(`E2E relay session not established`);if(!Zt(r))throw Error(`Received plaintext message on relay E2E channel — possible injection`);return $t(r,i)}}}function on(e,t,n=!1){let r=new Map;return{codec:an(e,n,r,t),reset:()=>r.clear()}}function sn(e){let{e2eAuth:t,registry:n,websocket:r,...i}=e,a=e.debug??!1,o=new Map,s=an(t,a,o,n);a&&console.info(`[E2ERelayTransport] Creating inner transport...`);let c=new w({...i,url:`<pre-connected>`,createWebSocket:()=>r,auth:t,codec:s,autoReconnect:!1,heartbeat:i.heartbeat??!1});return a&&console.info(`[E2ERelayTransport] Inner transport created`),{name:c.name,connect:async()=>{if(!n.isFrozen())throw Error(`E2ERelayClientTransport: registry must be frozen before connect()`);o.clear();try{await c.connect()}catch(e){throw o.clear(),e}},disconnect:async()=>{o.clear();try{await c.disconnect()}finally{o.clear()}},send:c.send.bind(c),cancelRequest:c.cancelRequest.bind(c),onReceive:(...e)=>(a&&console.info(`[E2ERelayTransport] onReceive called, delegating to inner transport`),c.onReceive(...e)),subscribe:c.subscribe.bind(c),unsubscribe:c.unsubscribe.bind(c),getSubscriptions:c.getSubscriptions.bind(c),isReady:c.isReady.bind(c),canSend:c.canSend.bind(c)}}function cn(){let e=!1,t=new Map,n=new Map,r=()=>{if(e)throw Error(`RelayControlRegistry is frozen and cannot be modified`)};return{registerEventSubjects(e,n){r();let i=t.get(e)??new Set;for(let e of n)i.add(e);t.set(e,i)},registerRequestNamespace(e,t){if(r(),t.length===0)throw Error(`RelayControlRegistry request namespace "${e}" requires at least one subject`);let i=n.get(e)??new Set;for(let e of t)i.add(e);n.set(e,i)},freeze(){e=!0},isFrozen(){return e},isControlEvent(e,n){return t.get(e)?.has(n)??!1},isControlRequest(e,t){return n.get(e)?.has(t)??!1}}}function ln(e){if(rt(e),e.mode===`client`){if(e.connectionOptions!==void 0)throw Error(`createWebSocketTransport(client) does not support connectionOptions when wrapping a pre-created WebSocket. Use WebSocketClientTransport for reconnect or dial-time socket options.`);let t=e.websocket;return new w({url:`<pre-connected>`,createWebSocket:()=>t,auth:e.auth,debug:e.debug,autoReconnect:!1,heartbeat:!1})}else return new tt({websocket:e.websocket,auth:e.auth,debug:e.debug})}export{It as DispatchingAuth,Pt as E2EAuth,Ft as E2ERelayAuth,ot as HmacAuth,st as MAKAIO_LOCAL_CLI_HMAC_IDENTITY_ID,ct as MAKAIO_LOCAL_CLI_PEER_KIND,tt as ServerTransport,w as WebSocketClientTransport,_ as WebSocketConnectionError,Pe as captureHmacIdentitySecretCleanup,ze as clearHmacIdentitySecretsForTesting,Xt as createE2EClientTransport,sn as createE2ERelayClientTransport,on as createE2ERelayCodec,en as createRelayControlHelpers,cn as createRelayControlRegistry,nt as createWebSocketCloseEvent,ln as createWebSocketTransport,Ot as crypto,y as extractSocketErrorMessage,O as registerHmacIdentitySecret,lt as registerMakaioLocalCliHmacIdentity,Le as resolveHmacIdentityAllowedMessageSubjects,k as resolveHmacIdentityAllowedSubscriptionSubjects,Ie as resolveHmacIdentityPeer,Fe as resolveHmacIdentitySecret,Ne as rotateHmacIdentitySecret};

package/dist/node-bridge-backend-DtRT--yn.mjs

@@ -0,0 +1 @@
+import{fileURLToPath as e}from"node:url";import*as t from"node:path";import{Readable as n}from"node:stream";import*as r from"node:readline";var i=class{ptyId;sendCommand;pid;process;_cols;_rows;closed=!1;pendingData=[];exitEvent;dataListeners=new Set;exitListeners=new Set;constructor(e,t,n,r,i,a){this.ptyId=n,this.sendCommand=a,this.pid=e,this.process=t,this._cols=r,this._rows=i}get cols(){return this._cols}get rows(){return this._rows}write(e){this.closed||this.sendCommand({id:0,cmd:`input`,ptyId:this.ptyId,data:Buffer.from(e,`utf8`).toString(`base64`)})}resize(e,t){this.closed||(this._cols=e,this._rows=t,this.sendCommand({id:0,cmd:`resize`,ptyId:this.ptyId,cols:e,rows:t}))}kill(e){this.closed||this.sendCommand({id:0,cmd:`kill`,ptyId:this.ptyId,signal:e})}onData(e){this.dataListeners.add(e);let t=this.pendingData;if(t!==null){this.pendingData=null;for(let n of t)e(n)}return{dispose:()=>this.dataListeners.delete(e)}}onExit(e){return this.exitEvent===void 0?(this.exitListeners.add(e),{dispose:()=>this.exitListeners.delete(e)}):(e(this.exitEvent),{dispose:()=>{}})}pushData(e){if(!this.closed){if(this.pendingData!==null){this.pendingData.push(e);return}for(let t of this.dataListeners)t(e)}}pushExit(e,t){if(!this.closed){this.closed=!0,this.exitEvent={exitCode:e,...t!==0&&{signal:t}};for(let e of this.exitListeners)e(this.exitEvent);this.exitListeners.clear()}}};function a(){let e=globalThis.Bun;return typeof e==`object`&&e?e:null}function o(e){let t=e.getReader();return new n({read(){t.read().then(({done:e,value:t})=>{e?this.push(null):this.push(Buffer.from(t))}).catch(e=>{this.destroy(e instanceof Error?e:Error(String(e)))})}})}function s(){let n=t.dirname(e(import.meta.url));return t.resolve(n,`./bridge/pty-bridge.cjs`)}function c(e){if(e===null)return process.execPath;let t=process.env.MAKAIO_NODE_EXECUTABLE?.trim();if(t)return t;let n=e.which?.(`node`)?.trim();if(n)return n;throw Error(`NodeBridgeBackend requires MAKAIO_NODE_EXECUTABLE or a discoverable node executable on PATH when running under Bun.`)}function l(e,t){let n=e.spawn([c(e),t],{stdin:`pipe`,stdout:`pipe`,stderr:`inherit`});return{writeStdin:e=>{try{let t=n.stdin.write(e),r=n.stdin.flush();t instanceof Promise&&t.catch(()=>void 0),r instanceof Promise&&r.catch(()=>void 0)}catch{}},stdout:o(n.stdout),kill:e=>n.kill(e===`SIGTERM`?15:9)}}async function u(e){let{spawn:t}=await import(`node:child_process`),n=t(c(null),[e],{stdio:[`pipe`,`pipe`,`inherit`]});return{writeStdin:e=>{n.stdin.write(e)},stdout:n.stdout,kill:e=>n.kill(e??`SIGTERM`)}}async function d(e){let t=a();return t===null?u(e):l(t,e)}var f=class{bridge=null;rl=null;disposed=!1;bridgeStarting=null;pendingSpawns=new Map;sessions=new Map;nextCmdId=1;ensureBridge(){return this.bridge===null?(this.bridgeStarting===null&&(this.bridgeStarting=(async()=>{try{let e=await d(s());if(this.disposed){e.kill(`SIGTERM`);return}this.bridge=e,this.rl=r.createInterface({input:this.bridge.stdout,crlfDelay:1/0}),this.rl.on(`line`,e=>this.handleLine(e)),this.rl.on(`close`,()=>this.handleBridgeClosed())}finally{this.bridgeStarting=null}})()),this.bridgeStarting):Promise.resolve()}handleLine(e){let t=e.trim();if(!t)return;let n;try{n=JSON.parse(t)}catch{return}this.dispatch(n)}dispatch(e){switch(e.event){case`spawned`:{let t=this.pendingSpawns.get(e.id);if(!t)return;this.pendingSpawns.delete(e.id);let n=new i(e.pid,e.process,e.ptyId,t.cols,t.rows,e=>this.sendCommand(e));this.sessions.set(e.ptyId,n),t.resolve(n);return}case`error`:{let t=this.pendingSpawns.get(e.id);t&&(this.pendingSpawns.delete(e.id),t.reject(Error(e.message)));return}case`data`:{let t=this.sessions.get(e.ptyId);if(!t)return;let n=Buffer.from(e.data,`base64`).toString(`utf8`);t.pushData(n);return}case`exit`:{let t=this.sessions.get(e.ptyId);if(!t)return;this.sessions.delete(e.ptyId),t.pushExit(e.exitCode,e.signal);return}}}handleBridgeClosed(){this.bridge=null,this.rl=null;for(let[,e]of this.pendingSpawns)e.reject(Error(`PTY bridge process closed unexpectedly`));this.pendingSpawns.clear();for(let[,e]of this.sessions)e.pushExit(1,0);this.sessions.clear()}sendCommand(e){if(this.bridge)try{this.bridge.writeStdin(`${JSON.stringify(e)}\n`)}catch{}}async spawn(e,t,n){if(this.disposed)return Promise.reject(Error(`NodeBridgeBackend has been disposed`));if(await this.ensureBridge(),this.disposed||this.bridge===null)return Promise.reject(Error(`NodeBridgeBackend is not available`));let r=this.nextCmdId++,i=n.cols??80,a=n.rows??24;return new Promise((o,s)=>{this.pendingSpawns.set(r,{resolve:o,reject:s,cols:i,rows:a}),this.sendCommand({id:r,cmd:`spawn`,file:e,args:t,options:n})})}async dispose(){this.disposed=!0;for(let[,e]of this.pendingSpawns)e.reject(Error(`NodeBridgeBackend disposed`));this.pendingSpawns.clear();for(let[,e]of this.sessions)e.pushExit(1,0);this.sessions.clear();let e=this.bridge;this.bridge=null,this.bridgeStarting=null,e?.kill(`SIGTERM`),this.rl?.close(),this.rl=null}};export{f as NodeBridgeBackend};

package/dist/node-pty-backend-C72EgRws.mjs

@@ -0,0 +1 @@
+import{i as e,o as t,t as n}from"./chunk-DTipWd-i.mjs";var r=n((t=>{Object.defineProperty(t,`__esModule`,{value:!0}),t.loadNativeModule=t.assign=void 0;function n(e){return[...arguments].slice(1).forEach(function(t){return Object.keys(t).forEach(function(n){return e[n]=t[n]})}),e}t.assign=n;function r(t){for(var n=[`build/Release`,`build/Debug`,`prebuilds/`+process.platform+`-`+process.arch],r=[`..`,`.`],i,a=0,o=n;a<o.length;a++)for(var s=o[a],c=0,l=r;c<l.length;c++){var u=l[c]+`/`+s;try{return{dir:u,module:e(u+`/`+t+`.node`)}}catch(e){i=e}}throw Error(`Failed to load native module: `+t+`.node, checked: `+n.join(`, `)+`: `+i)}t.loadNativeModule=r})),i=n((e=>{Object.defineProperty(e,`__esModule`,{value:!0}),e.EventEmitter2=void 0,e.EventEmitter2=function(){function e(){this._listeners=[]}return Object.defineProperty(e.prototype,`event`,{get:function(){var e=this;return this._event||=function(t){return e._listeners.push(t),{dispose:function(){for(var n=0;n<e._listeners.length;n++)if(e._listeners[n]===t){e._listeners.splice(n,1);return}}}},this._event},enumerable:!1,configurable:!0}),e.prototype.fire=function(e){for(var t=[],n=0;n<this._listeners.length;n++)t.push(this._listeners[n]);for(var n=0;n<t.length;n++)t[n].call(void 0,e)},e}()})),a=n((t=>{Object.defineProperty(t,`__esModule`,{value:!0}),t.Terminal=t.DEFAULT_ROWS=t.DEFAULT_COLS=void 0;var n=e(`events`),r=i();t.DEFAULT_COLS=80,t.DEFAULT_ROWS=24;var a=``,o=``;t.Terminal=function(){function e(e){this._pid=0,this._fd=0,this._cols=0,this._rows=0,this._readable=!1,this._writable=!1,this._onData=new r.EventEmitter2,this._onExit=new r.EventEmitter2,this._internalee=new n.EventEmitter,this.handleFlowControl=!!e?.handleFlowControl,this._flowControlPause=e?.flowControlPause||a,this._flowControlResume=e?.flowControlResume||o,e&&(this._checkType(`name`,e.name?e.name:void 0,`string`),this._checkType(`cols`,e.cols?e.cols:void 0,`number`),this._checkType(`rows`,e.rows?e.rows:void 0,`number`),this._checkType(`cwd`,e.cwd?e.cwd:void 0,`string`),this._checkType(`env`,e.env?e.env:void 0,`object`),this._checkType(`uid`,e.uid?e.uid:void 0,`number`),this._checkType(`gid`,e.gid?e.gid:void 0,`number`),this._checkType(`encoding`,e.encoding?e.encoding:void 0,`string`))}return Object.defineProperty(e.prototype,`onData`,{get:function(){return this._onData.event},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,`onExit`,{get:function(){return this._onExit.event},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,`pid`,{get:function(){return this._pid},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,`cols`,{get:function(){return this._cols},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,`rows`,{get:function(){return this._rows},enumerable:!1,configurable:!0}),e.prototype.write=function(e){if(this.handleFlowControl){if(e===this._flowControlPause){this.pause();return}if(e===this._flowControlResume){this.resume();return}}this._write(e)},e.prototype._forwardEvents=function(){var e=this;this.on(`data`,function(t){return e._onData.fire(t)}),this.on(`exit`,function(t,n){return e._onExit.fire({exitCode:t,signal:n})})},e.prototype._checkType=function(e,t,n,r){if(r===void 0&&(r=!1),t!==void 0){if(r&&Array.isArray(t)){t.forEach(function(t,r){if(typeof t!==n)throw Error(e+`[`+r+`] must be a `+n+` (not a `+typeof t[r]+`)`)});return}if(typeof t!==n)throw Error(e+` must be a `+n+` (not a `+typeof t+`)`)}},e.prototype.end=function(e){this._socket.end(e)},e.prototype.pipe=function(e,t){return this._socket.pipe(e,t)},e.prototype.pause=function(){return this._socket.pause()},e.prototype.resume=function(){return this._socket.resume()},e.prototype.setEncoding=function(e){this._socket._decoder&&delete this._socket._decoder,e&&this._socket.setEncoding(e)},e.prototype.addListener=function(e,t){this.on(e,t)},e.prototype.on=function(e,t){if(e===`close`){this._internalee.on(`close`,t);return}this._socket.on(e,t)},e.prototype.emit=function(e){return e===`close`?this._internalee.emit.apply(this._internalee,arguments):this._socket.emit.apply(this._socket,arguments)},e.prototype.listeners=function(e){return this._socket.listeners(e)},e.prototype.removeListener=function(e,t){this._socket.removeListener(e,t)},e.prototype.removeAllListeners=function(e){this._socket.removeAllListeners(e)},e.prototype.once=function(e,t){this._socket.once(e,t)},e.prototype._close=function(){this._socket.readable=!1,this.write=function(){},this.end=function(){},this._writable=!1,this._readable=!1},e.prototype._parseEnv=function(e){for(var t=Object.keys(e||{}),n=[],r=0;r<t.length;r++)t[r]!==void 0&&n.push(t[r]+`=`+e[t[r]]);return n},e}()})),o=n((e=>{Object.defineProperty(e,`__esModule`,{value:!0}),e.getWorkerPipeName=void 0;function t(e){return e+`-worker`}e.getWorkerPipeName=t})),s=n((t=>{var n=t&&t.__awaiter||function(e,t,n,r){function i(e){return e instanceof n?e:new n(function(t){t(e)})}return new(n||=Promise)(function(n,a){function o(e){try{c(r.next(e))}catch(e){a(e)}}function s(e){try{c(r.throw(e))}catch(e){a(e)}}function c(e){e.done?n(e.value):i(e.value).then(o,s)}c((r=r.apply(e,t||[])).next())})},r=t&&t.__generator||function(e,t){var n={label:0,sent:function(){if(a[0]&1)throw a[1];return a[1]},trys:[],ops:[]},r,i,a,o;return o={next:s(0),throw:s(1),return:s(2)},typeof Symbol==`function`&&(o[Symbol.iterator]=function(){return this}),o;function s(e){return function(t){return c([e,t])}}function c(o){if(r)throw TypeError(`Generator is already executing.`);for(;n;)try{if(r=1,i&&(a=o[0]&2?i.return:o[0]?i.throw||((a=i.return)&&a.call(i),0):i.next)&&!(a=a.call(i,o[1])).done)return a;switch(i=0,a&&(o=[o[0]&2,a.value]),o[0]){case 0:case 1:a=o;break;case 4:return n.label++,{value:o[1],done:!1};case 5:n.label++,i=o[1],o=[0];continue;case 7:o=n.ops.pop(),n.trys.pop();continue;default:if((a=n.trys,!(a=a.length>0&&a[a.length-1]))&&(o[0]===6||o[0]===2)){n=0;continue}if(o[0]===3&&(!a||o[1]>a[0]&&o[1]<a[3])){n.label=o[1];break}if(o[0]===6&&n.label<a[1]){n.label=a[1],a=o;break}if(a&&n.label<a[2]){n.label=a[2],n.ops.push(o);break}a[2]&&n.ops.pop(),n.trys.pop();continue}o=t.call(e,n)}catch(e){o=[6,e],i=0}finally{r=a=0}if(o[0]&5)throw o[1];return{value:o[0]?o[1]:void 0,done:!0}}};Object.defineProperty(t,`__esModule`,{value:!0}),t.ConoutConnection=void 0;var a=e(`worker_threads`),s=o(),c=e(`path`),l=i(),u=1e3;t.ConoutConnection=function(){function e(e,t){var n=this;this._conoutPipeName=e,this._useConptyDll=t,this._isDisposed=!1,this._onReady=new l.EventEmitter2;var r={conoutPipeName:e},i=__dirname.replace(`node_modules.asar`,`node_modules.asar.unpacked`);this._worker=new a.Worker(c.join(i,`worker/conoutSocketWorker.js`),{workerData:r}),this._worker.on(`message`,function(e){switch(e){case 1:n._onReady.fire();return;default:console.warn(`Unexpected ConoutWorkerMessage`,e)}})}return Object.defineProperty(e.prototype,`onReady`,{get:function(){return this._onReady.event},enumerable:!1,configurable:!0}),e.prototype.dispose=function(){!this._useConptyDll&&this._isDisposed||(this._isDisposed=!0,this._drainDataAndClose())},e.prototype.connectSocket=function(e){e.connect(s.getWorkerPipeName(this._conoutPipeName))},e.prototype._drainDataAndClose=function(){var e=this;this._drainTimeout&&clearTimeout(this._drainTimeout),this._drainTimeout=setTimeout(function(){return e._destroySocket()},u)},e.prototype._destroySocket=function(){return n(this,void 0,void 0,function(){return r(this,function(e){switch(e.label){case 0:return[4,this._worker.terminate()];case 1:return e.sent(),[2]}})})},e}()})),c=n((t=>{Object.defineProperty(t,`__esModule`,{value:!0}),t.argsToCommandLine=t.WindowsPtyAgent=void 0;var n=e(`fs`),i=e(`path`),a=e(`child_process`),o=e(`net`),c=s(),l=r(),u,d=1e3;t.WindowsPtyAgent=function(){function e(e,t,r,a,s,d,p,m,h){var g=this;m===void 0&&(m=!1),h===void 0&&(h=!1),this._useConptyDll=m,this._innerPid=0,u||=l.loadNativeModule(`conpty`).module,this._ptyNative=u,a=i.resolve(a);var _=f(e,t),v=u.startProcess(e,s,d,p,this._generatePipeName(),h,this._useConptyDll);this._fd=v.fd,this._pty=v.pty,this._outSocket=new o.Socket,this._outSocket.setEncoding(`utf8`),this._conoutSocketWorker=new c.ConoutConnection(v.conout,this._useConptyDll),this._pendingPtyInfo={pty:this._pty,commandLine:_,cwd:a,env:r};var y=setTimeout(function(){g._pendingPtyInfo&&g._completePtyConnection()},5e3);this._conoutSocketWorker.onReady(function(){clearTimeout(y),g._conoutSocketWorker.connectSocket(g._outSocket),g._completePtyConnection()}),this._outSocket.on(`connect`,function(){g._outSocket.emit(`ready_datapipe`)});var b=n.openSync(v.conin,`w`);this._inSocket=new o.Socket({fd:b,readable:!1,writable:!0}),this._inSocket.setEncoding(`utf8`)}return Object.defineProperty(e.prototype,`inSocket`,{get:function(){return this._inSocket},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,`outSocket`,{get:function(){return this._outSocket},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,`fd`,{get:function(){return this._fd},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,`innerPid`,{get:function(){return this._innerPid},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,`pty`,{get:function(){return this._pty},enumerable:!1,configurable:!0}),e.prototype._completePtyConnection=function(){var e=this;if(this._pendingPtyInfo){var t=this._pendingPtyInfo,n=t.pty,r=t.commandLine,i=t.cwd,a=t.env;this._pendingPtyInfo=void 0;var o=u.connect(n,r,i,a,this._useConptyDll,function(t){return e._$onProcessExit(t)});this._innerPid=o.pid}},e.prototype.resize=function(e,t){if(this._exitCode!==void 0)throw Error(`Cannot resize a pty that has already exited`);this._ptyNative.resize(this._pty,e,t,this._useConptyDll)},e.prototype.clear=function(){this._ptyNative.clear(this._pty,this._useConptyDll)},e.prototype.kill=function(){var e=this;this._pendingPtyInfo=void 0,this._useConptyDll?(this._inSocket.destroy(),this._ptyNative.kill(this._pty,this._useConptyDll),this._outSocket.on(`data`,function(){e._conoutSocketWorker.dispose()})):(this._inSocket.readable=!1,this._outSocket.readable=!1,this._getConsoleProcessList().then(function(e){e.forEach(function(e){try{process.kill(e)}catch{}})}),this._ptyNative.kill(this._pty,this._useConptyDll),this._conoutSocketWorker.dispose())},e.prototype._getConsoleProcessList=function(){var e=this;return this._innerPid<=0?Promise.resolve([]):new Promise(function(t){var n=a.fork(i.join(__dirname,`conpty_console_list_agent`),[e._innerPid.toString()]);n.on(`message`,function(e){clearTimeout(r),t(e.consoleProcessList)});var r=setTimeout(function(){n.kill(),t([e._innerPid])},5e3)})},Object.defineProperty(e.prototype,`exitCode`,{get:function(){return this._exitCode},enumerable:!1,configurable:!0}),e.prototype._generatePipeName=function(){return`conpty-`+Math.random()*1e7},e.prototype._$onProcessExit=function(e){var t=this;this._exitCode=e,this._useConptyDll||(this._flushDataAndCleanUp(),this._outSocket.on(`data`,function(){return t._flushDataAndCleanUp()}))},e.prototype._flushDataAndCleanUp=function(){var e=this;this._useConptyDll||(this._closeTimeout&&clearTimeout(this._closeTimeout),this._closeTimeout=setTimeout(function(){return e._cleanUpProcess()},d))},e.prototype._cleanUpProcess=function(){this._useConptyDll||(this._inSocket.readable=!1,this._outSocket.readable=!1,this._outSocket.destroy())},e}();function f(e,t){if(p(t))return t.length===0?e:f(e,[])+` `+t;var n=[e];Array.prototype.push.apply(n,t);for(var r=``,i=0;i<n.length;i++){i>0&&(r+=` `);var a=n[i],o=h(a[0]!==`"`,a[a.length-1]!==`"`),s=a[0]!==`"`&&a[a.length-1]!==`"`,c=a===``||(a.indexOf(` `)!==-1||a.indexOf(`	`)!==-1)&&a.length>1&&(o||s);c&&(r+=`"`);for(var l=0,u=0;u<a.length;u++){var d=a[u];d===`\\`?l++:d===`"`?(r+=m(`\\`,l*2+1),r+=`"`,l=0):(r+=m(`\\`,l),l=0,r+=d)}c?(r+=m(`\\`,l*2),r+=`"`):r+=m(`\\`,l)}return r}t.argsToCommandLine=f;function p(e){return typeof e==`string`}function m(e,t){for(var n=``,r=0;r<t;r++)n+=e;return n}function h(e,t){return e&&!t||!e&&t}})),l=n((e=>{var t=e&&e.__extends||(function(){var e=function(t,n){return e=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var n in t)t.hasOwnProperty(n)&&(e[n]=t[n])},e(t,n)};return function(t,n){e(t,n);function r(){this.constructor=t}t.prototype=n===null?Object.create(n):(r.prototype=n.prototype,new r)}})();Object.defineProperty(e,`__esModule`,{value:!0}),e.WindowsTerminal=void 0;var n=a(),i=c(),o=r(),s=`cmd.exe`,l=`Windows Shell`;e.WindowsTerminal=function(e){t(r,e);function r(t,r,a){var c=e.call(this,a)||this;c._checkType(`args`,r,`string`,!0),r||=[],t||=s,a||={},a.env=a.env||process.env,a.encoding&&console.warn(`Setting encoding on Windows is not supported`);var u=o.assign({},a.env);c._cols=a.cols||n.DEFAULT_COLS,c._rows=a.rows||n.DEFAULT_ROWS;var d=a.cwd||process.cwd(),f=a.name||u.TERM||l,p=c._parseEnv(u);return c._isReady=!1,c._deferreds=[],c._agent=new i.WindowsPtyAgent(t,r,p,d,c._cols,c._rows,!1,a.useConptyDll,a.conptyInheritCursor),c._socket=c._agent.outSocket,c._pid=c._agent.innerPid,c._fd=c._agent.fd,c._pty=c._agent.pty,c._socket.on(`ready_datapipe`,function(){c._pid=c._agent.innerPid,c._socket.once(`data`,function(){c._isReady||(c._isReady=!0,c._deferreds.forEach(function(e){e.run()}),c._deferreds=[])}),c._socket.on(`error`,function(e){if(c._close(),!(e.code&&(~e.code.indexOf(`errno 5`)||~e.code.indexOf(`EIO`)))&&c.listeners(`error`).length<2)throw e}),c._socket.on(`close`,function(){c.emit(`exit`,c._agent.exitCode),c._close()})}),c._file=t,c._name=f,c._readable=!0,c._writable=!0,c._forwardEvents(),c}return r.prototype._write=function(e){this._defer(this._doWrite,e)},r.prototype._doWrite=function(e){this._agent.inSocket.write(e)},r.open=function(e){throw Error(`open() not supported on windows, use Fork() instead.`)},r.prototype.resize=function(e,t,n){var r=this;if(e<=0||t<=0||isNaN(e)||isNaN(t)||e===1/0||t===1/0)throw Error(`resizing must be done using positive cols and rows`);this._deferNoArgs(function(){r._agent.resize(e,t),r._cols=e,r._rows=t})},r.prototype.clear=function(){var e=this;this._deferNoArgs(function(){e._agent.clear()})},r.prototype.destroy=function(){var e=this;this._deferNoArgs(function(){e.kill()})},r.prototype.kill=function(e){var t=this;this._deferNoArgs(function(){if(e)throw Error(`Signals not supported on windows.`);t._close(),t._agent.kill()})},r.prototype._deferNoArgs=function(e){var t=this;if(this._isReady){e.call(this);return}this._deferreds.push({run:function(){return e.call(t)}})},r.prototype._defer=function(e,t){var n=this;if(this._isReady){e.call(this,t);return}this._deferreds.push({run:function(){return e.call(n,t)}})},Object.defineProperty(r.prototype,`process`,{get:function(){return this._name},enumerable:!1,configurable:!0}),Object.defineProperty(r.prototype,`master`,{get:function(){throw Error(`master is not supported on Windows`)},enumerable:!1,configurable:!0}),Object.defineProperty(r.prototype,`slave`,{get:function(){throw Error(`slave is not supported on Windows`)},enumerable:!1,configurable:!0}),r}(n.Terminal)})),u=n((t=>{var n=t&&t.__extends||(function(){var e=function(t,n){return e=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var n in t)t.hasOwnProperty(n)&&(e[n]=t[n])},e(t,n)};return function(t,n){e(t,n);function r(){this.constructor=t}t.prototype=n===null?Object.create(n):(r.prototype=n.prototype,new r)}})();Object.defineProperty(t,`__esModule`,{value:!0}),t.UnixTerminal=void 0;var i=e(`fs`),o=e(`path`),s=e(`tty`),c=a(),l=r(),u=l.loadNativeModule(`pty`),d=u.module,f=u.dir+`/spawn-helper`;f=o.resolve(__dirname,f),f=f.replace(`app.asar`,`app.asar.unpacked`),f=f.replace(`node_modules.asar`,`node_modules.asar.unpacked`);var p=`sh`,m=`xterm`,h=200;t.UnixTerminal=function(e){n(t,e);function t(t,n,r){var i=e.call(this,r)||this;if(i._boundClose=!1,i._emittedClose=!1,typeof n==`string`)throw Error(`args as a string is not supported on unix.`);n||=[],t||=p,r||={},r.env=r.env||process.env,i._cols=r.cols||c.DEFAULT_COLS,i._rows=r.rows||c.DEFAULT_ROWS;var a=r.uid??-1,o=r.gid??-1,u=l.assign({},r.env);r.env===process.env&&i._sanitizeEnv(u);var _=r.cwd||process.cwd();u.PWD=_;var v=r.name||u.TERM||m;u.TERM=v;var y=i._parseEnv(u),b=r.encoding===void 0?`utf8`:r.encoding,x=d.fork(t,n,y,_,i._cols,i._rows,a,o,b===`utf8`,f,function(e,t){if(!i._emittedClose){if(i._boundClose)return;i._boundClose=!0;var n=setTimeout(function(){n=null,i._socket.destroy()},h);i.once(`close`,function(){n!==null&&clearTimeout(n),i.emit(`exit`,e,t)});return}i.emit(`exit`,e,t)});return i._socket=new s.ReadStream(x.fd),b!==null&&i._socket.setEncoding(b),i._writeStream=new g(x.fd,b||void 0),i._socket.on(`error`,function(e){if(!(e.code&&~e.code.indexOf(`EAGAIN`))&&(i._close(),i._emittedClose||(i._emittedClose=!0,i.emit(`close`)),!(e.code&&(~e.code.indexOf(`errno 5`)||~e.code.indexOf(`EIO`)))&&i.listeners(`error`).length<2))throw e}),i._pid=x.pid,i._fd=x.fd,i._pty=x.pty,i._file=t,i._name=v,i._readable=!0,i._writable=!0,i._socket.on(`close`,function(){i._emittedClose||(i._emittedClose=!0,i._close(),i.emit(`close`))}),i._forwardEvents(),i}return Object.defineProperty(t.prototype,`master`,{get:function(){return this._master},enumerable:!1,configurable:!0}),Object.defineProperty(t.prototype,`slave`,{get:function(){return this._slave},enumerable:!1,configurable:!0}),t.prototype._write=function(e){this._writeStream.write(e)},Object.defineProperty(t.prototype,`fd`,{get:function(){return this._fd},enumerable:!1,configurable:!0}),Object.defineProperty(t.prototype,`ptsName`,{get:function(){return this._pty},enumerable:!1,configurable:!0}),t.open=function(e){var n=Object.create(t.prototype);e||={},arguments.length>1&&(e={cols:arguments[1],rows:arguments[2]});var r=e.cols||c.DEFAULT_COLS,i=e.rows||c.DEFAULT_ROWS,a=e.encoding===void 0?`utf8`:e.encoding,o=d.open(r,i);return n._master=new s.ReadStream(o.master),a!==null&&n._master.setEncoding(a),n._master.resume(),n._slave=new s.ReadStream(o.slave),a!==null&&n._slave.setEncoding(a),n._slave.resume(),n._socket=n._master,n._pid=-1,n._fd=o.master,n._pty=o.pty,n._file=process.argv[0]||`node`,n._name=process.env.TERM||``,n._readable=!0,n._writable=!0,n._socket.on(`error`,function(e){if(n._close(),n.listeners(`error`).length<2)throw e}),n._socket.on(`close`,function(){n._close()}),n},t.prototype.destroy=function(){var e=this;this._close(),this._socket.once(`close`,function(){e.kill(`SIGHUP`)}),this._socket.destroy(),this._writeStream.dispose()},t.prototype.kill=function(e){try{process.kill(this.pid,e||`SIGHUP`)}catch{}},Object.defineProperty(t.prototype,`process`,{get:function(){if(process.platform===`darwin`){var e=d.process(this._fd);return e!==`kernel_task`&&e!==`spawn_helper`?e:this._file}return d.process(this._fd,this._pty)||this._file},enumerable:!1,configurable:!0}),t.prototype.resize=function(e,t,n){if(e<=0||t<=0||isNaN(e)||isNaN(t)||e===1/0||t===1/0)throw Error(`resizing must be done using positive cols and rows`);var r=n?.width??0,i=n?.height??0;d.resize(this._fd,e,t,r,i),this._cols=e,this._rows=t},t.prototype.clear=function(){},t.prototype._sanitizeEnv=function(e){delete e.TMUX,delete e.TMUX_PANE,delete e.STY,delete e.WINDOW,delete e.WINDOWID,delete e.TERMCAP,delete e.COLUMNS,delete e.LINES},t}(c.Terminal);var g=function(){function e(e,t){this._fd=e,this._encoding=t,this._writeQueue=[]}return e.prototype.dispose=function(){clearImmediate(this._writeImmediate),this._writeImmediate=void 0},e.prototype.write=function(e){var t=typeof e==`string`?Buffer.from(e,this._encoding):Buffer.from(e);t.byteLength!==0&&(this._writeQueue.push({buffer:t,offset:0}),this._writeQueue.length===1&&this._processWriteQueue())},e.prototype._processWriteQueue=function(){var e=this;if(this._writeImmediate=void 0,this._writeQueue.length!==0){var t=this._writeQueue[0];i.write(this._fd,t.buffer,t.offset,function(n,r){if(n){`code`in n&&n.code===`EAGAIN`?e._writeImmediate=setImmediate(function(){return e._processWriteQueue()}):(e._writeQueue.length=0,console.error(`Unhandled pty write error`,n));return}t.offset+=r,t.offset>=t.buffer.byteLength&&e._writeQueue.shift(),e._processWriteQueue()})}},e}()})),d=t(n((e=>{Object.defineProperty(e,`__esModule`,{value:!0}),e.native=e.open=e.createTerminal=e.fork=e.spawn=void 0;var t=r(),n=process.platform===`win32`?l().WindowsTerminal:u().UnixTerminal;function i(e,t,r){return new n(e,t,r)}e.spawn=i;function a(e,t,r){return new n(e,t,r)}e.fork=a;function o(e,t,r){return new n(e,t,r)}e.createTerminal=o;function s(e){return n.open(e)}e.open=s,e.native=process.platform===`win32`?null:t.loadNativeModule(`pty`).module}))(),1),f=class{spawn(e,t,n){try{let{inheritEnvironment:r,...i}=n,a=i.env===void 0||!r?i:{...i,env:{...process.env,...i.env}},o=d.spawn(e,t,a);return Promise.resolve({get pid(){return o.pid},get process(){return o.process},get cols(){return o.cols},get rows(){return o.rows},write:e=>o.write(e),resize:(e,t)=>o.resize(e,t),kill:e=>o.kill(e),onData:e=>o.onData(e),onExit:e=>o.onExit(e)})}catch(e){return Promise.reject(e)}}};export{f as NodePtyBackend};

package/dist/{package-Bz938q5F.d.mts → package-BswWlFSn.d.mts}

@@ -1,4 +1,4 @@
-import { A as OperationReportDecision, B as RecordProvisioningAbsentInput, D as MarkRuntimeReadyInput, E as InfrastructureFailureDecision, F as ReadBootstrapStartStateInput, Ft as RequestAttemptCancellationInput, G as RuntimeRegistrationDecision, Gt as ReadAttemptCancellationControlInput, H as RegisterRuntimeInput, I as RecordAllocationInput, It as RequestExecutionCancellationInput, Kt as RecordAttemptControlReceiptInput, L as RecordAllocationTerminatedInput, M as PendingAttemptAbandonmentDecision, Nt as ExecutionAttemptCancellationDecision, O as OperationAdmissionDecision, P as ProvisioningClaimDecision, Pt as ExecutionAttemptCancellationIntent$1, Qt as AttemptSettlementRead, R as RecordInfrastructureFailureInput, St as RuntimeOutcomeFence, T as GetInstructionInput, U as ReportOperationInput, Ut as AttemptControlEvidenceDecision, V as RecoverableAttemptRecord, Vt as AttemptCancellationControlState, W as RuntimeReadinessDecision, X as CompleteProviderOperationInput, Z as HandoffProviderOperationInput, a as AllocationRefEvolutionDecision, at as ProviderOperationClaimDecision, dt as ProviderOperationOwnershipRecord, en as EnsureExecutionAttemptDecision, et as ListOpenProviderOperationsInput, f as CompleteOperationInput, ft as ProvisionerIncarnationLossDecision, gt as TakeOverProviderOperationInput, h as DurableOutcome, ht as RenewProviderOperationClaimInput, i as AllocationRefEvolution, j as OutcomeCodec, k as OperationCompletionDecision, lt as ProviderOperationMutationDecision, mt as RecordProviderOperationUncertaintyInput, n as AdmitOperationInput, o as AllocationTerminationDecision, ot as ProviderOperationCompletionDecision, p as DiscoveredAllocationDecision, pt as ProvisioningAbsenceDecision, qt as ReportAttemptControlInput, r as AllocationRecordingDecision, rn as ReadAttemptSettlementInput, s as AttemptControlState, tn as EnsureExecutionAttemptInput, tt as OpenProviderOperationRecord, u as BeginProvisioningInput, w as ExecutionOwnerId, x as ExecutionAttemptRepository, y as ExecutionAttemptRecord, yt as ExecutionAttemptOutcomeDecision, z as RecordProvisionerIncarnationLostInput } from "./execution-attempt-repository-DOb5V4N2.mjs";
+import { A as OperationReportDecision, B as RecordProvisioningAbsentInput, D as MarkRuntimeReadyInput, E as InfrastructureFailureDecision, F as ReadBootstrapStartStateInput, Ft as RequestAttemptCancellationInput, G as RuntimeRegistrationDecision, Gt as ReadAttemptCancellationControlInput, H as RegisterRuntimeInput, I as RecordAllocationInput, It as RequestExecutionCancellationInput, Kt as RecordAttemptControlReceiptInput, L as RecordAllocationTerminatedInput, M as PendingAttemptAbandonmentDecision, Nt as ExecutionAttemptCancellationDecision, O as OperationAdmissionDecision, P as ProvisioningClaimDecision, Pt as ExecutionAttemptCancellationIntent$1, Qt as AttemptSettlementRead, R as RecordInfrastructureFailureInput, St as RuntimeOutcomeFence, T as GetInstructionInput, U as ReportOperationInput, Ut as AttemptControlEvidenceDecision, V as RecoverableAttemptRecord, Vt as AttemptCancellationControlState, W as RuntimeReadinessDecision, X as CompleteProviderOperationInput, Z as HandoffProviderOperationInput, a as AllocationRefEvolutionDecision, at as ProviderOperationClaimDecision, dt as ProviderOperationOwnershipRecord, en as EnsureExecutionAttemptDecision, et as ListOpenProviderOperationsInput, f as CompleteOperationInput, ft as ProvisionerIncarnationLossDecision, gt as TakeOverProviderOperationInput, h as DurableOutcome, ht as RenewProviderOperationClaimInput, i as AllocationRefEvolution, j as OutcomeCodec, k as OperationCompletionDecision, lt as ProviderOperationMutationDecision, mt as RecordProviderOperationUncertaintyInput, n as AdmitOperationInput, o as AllocationTerminationDecision, ot as ProviderOperationCompletionDecision, p as DiscoveredAllocationDecision, pt as ProvisioningAbsenceDecision, qt as ReportAttemptControlInput, r as AllocationRecordingDecision, rn as ReadAttemptSettlementInput, s as AttemptControlState, tn as EnsureExecutionAttemptInput, tt as OpenProviderOperationRecord, u as BeginProvisioningInput, w as ExecutionOwnerId, x as ExecutionAttemptRepository, y as ExecutionAttemptRecord, yt as ExecutionAttemptOutcomeDecision, z as RecordProvisionerIncarnationLostInput } from "./execution-attempt-repository-C2XKRZ3O.mjs";
 import { z } from "zod";
 import * as _$_makaio_contracts0 from "@makaio/framework/contracts";
 import { AcceptedAttemptOutcome, AcceptedAttemptOutcome as AcceptedAttemptOutcome$1, AttemptOutcomeControlObservation, ExecutionAttemptBootstrapAwaitStartResponse, ExecutionAttemptInstruction, ExecutionAttemptOutcome, IWorkflowRunner, LoopGateHandler, MakaioNodeExtension, OutcomeAcceptance, OutcomeAcceptance as OutcomeAcceptance$1, StationHandler, StepRunnerBusAuth, StepRunnerPlatformDefaults, WorkerMaterializationSpec, WorkflowAttemptCancellation, WorkflowAttemptOutcome, WorkflowAttemptOutcome as WorkflowAttemptOutcome$1, WorkflowAttemptTechnicalFailure, WorkflowDefinition, WorkflowExecution, WorkflowRunContext, WorkflowRunResult, WorkflowRunnerCompletion } from "@makaio/framework/contracts";
@@ -865,9 +865,9 @@ declare const WorkflowAttemptOutcomeSchema: z.ZodUnion<readonly [z.ZodDiscrimina
     confidence: z.ZodOptional<z.ZodObject<{
       level: z.ZodEnum<{
         inferred: "inferred";
+        confirmed: "confirmed";
         assumed: "assumed";
         stated: "stated";
-        confirmed: "confirmed";
         verified: "verified";
       }>;
       basis: z.ZodArray<z.ZodObject<{