@mpfrontend/presentation-server 0.0.0-stage → 1.0.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,67 @@
-# Temporary Holding Version
+# Authenticated presentation sockets
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Development polling-to-WebSocket invalidation adapter for a self-hosted Next custom server.
+It is not a backend event stream, durable replay log or multi-replica relay.
+
+The browser first obtains a single-use 20-second ticket through a same-origin CSRF-protected POST.
+The upgrade requires the exact Origin and a valid opaque BFF session. The first frame redeems the
+ticket bound to that cookie and authority revision. Resources resolve only through product-owned
+allowlists and authenticated BFF reads. No access token, cookie, resource data or tenant is sent in frames.
+
+Admission and every polling tick recheck session and authority. Losing authorization closes the socket.
+Reconnect always requests fresh authoritative snapshots; this profile does not resume missed events.
+Limits: 32 connections/process, 2/session, 6 subscriptions, 4 KiB incoming frames, 64 KiB outgoing
+buffer, 5-second admission timeout, 3-second minimum polling and 30-second ping/pong.
+Network/backend uncertainty sends a resync-required frame, never a fabricated event. Editors keep
+drafts and show a refresh notice; readonly consumers may refetch. Production startup requires the
+production profile below.
+
+Sources: [Next custom servers](https://nextjs.org/docs/app/guides/custom-server),
+[ws authentication and upgrades](https://github.com/websockets/ws#client-authentication),
+[WebSocket protocol](https://www.rfc-editor.org/rfc/rfc6455).
+## Shared admission validation
+
+`SocketConfig.ticketStore` accepts an asynchronous `AdmissionTicketStore` with atomic `consume`.
+The default stays bounded process memory. Consumers can bind Redis-vault issue/consume operations;
+all replicas must use the same app-scoped namespace/keyring. Tickets remain cookie/authority-bound
+and expire after 20 seconds. First-frame authority is checked again before ready/invalidation.
+Storage errors close admission; no local fallback is used. Concurrent subscribe frames are rejected.
+
+## Production profile
+
+`createPresentationRealtime({production: {ticketStore, connectionBudget}, ...})` starts only with an `https`
+public origin, a ticket store that every replica shares (`shared: true`, for example
+`createVaultTicketStore(vault)` of `@mpfrontend/security-bff/session-store`) and a shared connection budget
+(`vault.limits.connections` of a Redis vault); otherwise it refuses with `PRODUCTION_PROFILE_REFUSED:` and
+the names `HTTPS_PUBLIC_ORIGIN_REQUIRED`, `SHARED_TICKET_STORE_REQUIRED` or
+`SHARED_CONNECTION_BUDGET_REQUIRED`. A ticket store over a durable vault (one that declares `security`, as
+`createVaultTicketStore` does) is also refused unless the vault is reached over TLS
+(`TICKET_STORE_TLS_REQUIRED`) and with authentication (`TICKET_STORE_AUTHENTICATION_REQUIRED`). A shared
+store must declare `security` (`durable`, `tls` and `authenticated`, all three): a custom store that declares
+nothing cannot be shown to use TLS and authentication, so it is refused with `TICKET_STORE_SECURITY_REQUIRED`
+rather than accepted for lack of a claim. There is no process-memory default in this profile. The development
+profile (`development: true`) is unchanged and still refused under `NODE_ENV=production`. Retained event
+replay is not part of either profile. See the core shared-runtime acceptance document.
+
+## Transfer relay
+
+`@mpfrontend/presentation-server/relay` relays a streamed route of the Security BFF from a route handler
+of the presentation application (Web `Request` and `Response`, as in Next.js), as streams in both
+directions: it never holds a whole body. `createRelay({bffOrigin, basePath, sessionCookie})` returns
+`relay(request, segments)`, which calls `<bffOrigin><basePath>/<segments>` with the request's query.
+
+- Towards the BFF it forwards only what the BFF checks and the content headers: the session cookie named
+  `sessionCookie` (no other cookie), Origin, `X-CSRF-Token`, `Idempotency-Key`, Accept-Language,
+  Content-Type and Content-Length (`RELAY_REQUEST_HEADERS`). A body without Content-Length is refused by
+  the BFF with 411.
+- Back to the browser it passes the status, the content headers, the BFF's `X-Content-Type-Options`,
+  `Cache-Control`, correlation id and `Idempotency-Replayed` (`RELAY_RESPONSE_HEADERS`), and a
+  `Set-Cookie` only when it sets the session cookie (a rotated session id). Content-Length is dropped
+  when fetch has decoded a content encoding.
+- Each path segment is encoded again, so that a segment cannot leave `basePath`; an empty, `.` or `..`
+  segment is answered 404 without a call. A client that goes away aborts the call to the BFF, which ends
+  the upstream call.
+
+The relay decides nothing itself: the BFF's allowlist, session, Origin, CSRF, media types, sizes and
+timeouts do. The application template wires it in `src/app/api/transfer/[...path]/route.ts` through
+`src/api/server/transfer.ts`, with the session cookie name in `BFF_SESSION_COOKIE`.

package/dist/connection-budget.d.ts

@@ -0,0 +1,9 @@
+export type ConnectionBudget = {
+    /** True for a budget that every replica shares; the production profile refuses any other. */
+    readonly shared?: boolean;
+    reserve: (subject: string, id: string) => Promise<number | undefined>;
+    renew: (subject: string, id: string) => Promise<number | undefined>;
+    release: (subject: string, id: string) => Promise<void>;
+};
+/** Development-only fallback; production composition must provide shared, leased admission. */
+export declare function createMemoryConnectionBudget(): ConnectionBudget;

package/dist/connection-budget.js

@@ -0,0 +1,21 @@
+/** Development-only fallback; production composition must provide shared, leased admission. */
+export function createMemoryConnectionBudget() {
+    const leases = new Map(), duration = 30000;
+    const prune = () => { for (const [id, lease] of leases)
+        if (lease.until <= Date.now())
+            leases.delete(id); };
+    return {
+        async reserve(subject, id) {
+            prune();
+            if (leases.has(id) || leases.size >= 32 || [...leases.values()].filter(v => v.subject === subject).length >= 2)
+                return undefined;
+            leases.set(id, { subject, until: Date.now() + duration });
+            return duration;
+        },
+        async renew(subject, id) { prune(); const lease = leases.get(id); if (!lease || lease.subject !== subject)
+            return undefined; lease.until = Date.now() + duration; return duration; },
+        async release(subject, id) { if (leases.get(id)?.subject === subject)
+            leases.delete(id); }
+    };
+}
+//# sourceMappingURL=connection-budget.js.map

package/dist/connection-budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-budget.js","sourceRoot":"","sources":["../src/connection-budget.ts"],"names":[],"mappings":"AAOA,+FAA+F;AAC/F,MAAM,UAAU,4BAA4B;IAC1C,MAAM,MAAM,GAAC,IAAI,GAAG,EAAwC,EAAC,QAAQ,GAAC,KAAK,CAAC;IAC5E,MAAM,KAAK,GAAC,GAAE,EAAE,GAAC,KAAI,MAAK,CAAC,EAAE,EAAC,KAAK,CAAC,IAAG,MAAM;QAAC,IAAG,KAAK,CAAC,KAAK,IAAE,IAAI,CAAC,GAAG,EAAE;YAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA,CAAC,CAAC;IAC7F,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,OAAO,EAAC,EAAE;YACtB,KAAK,EAAE,CAAC;YAAA,IAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAE,MAAM,CAAC,IAAI,IAAE,EAAE,IAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,OAAO,KAAG,OAAO,CAAC,CAAC,MAAM,IAAE,CAAC;gBAAC,OAAO,SAAS,CAAC;YAC3H,MAAM,CAAC,GAAG,CAAC,EAAE,EAAC,EAAC,OAAO,EAAC,KAAK,EAAC,IAAI,CAAC,GAAG,EAAE,GAAC,QAAQ,EAAC,CAAC,CAAC;YAAA,OAAO,QAAQ,CAAC;QACrE,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,OAAO,EAAC,EAAE,IAAE,KAAK,EAAE,CAAC,CAAA,MAAM,KAAK,GAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA,IAAG,CAAC,KAAK,IAAE,KAAK,CAAC,OAAO,KAAG,OAAO;YAAC,OAAO,SAAS,CAAC,CAAA,KAAK,CAAC,KAAK,GAAC,IAAI,CAAC,GAAG,EAAE,GAAC,QAAQ,CAAC,CAAA,OAAO,QAAQ,CAAC,CAAA,CAAC;QAChK,KAAK,CAAC,OAAO,CAAC,OAAO,EAAC,EAAE,IAAE,IAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,KAAG,OAAO;YAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA,CAAC;KACnF,CAAC;AACJ,CAAC"}

package/dist/core.d.ts

@@ -0,0 +1,60 @@
+import type { IncomingMessage, ServerResponse, Server } from 'node:http';
+import { type ConnectionBudget } from './connection-budget.js';
+export type { ConnectionBudget } from './connection-budget.js';
+export type SocketContext = {
+    subject: string;
+    tenant: string | null;
+    roles: string[];
+    csrf: string;
+};
+export type AdmissionTicket = {
+    cookieHash: string;
+    revision: string;
+    expires: number;
+};
+/**
+ * consume must be atomic across all presentation replicas. `security` describes the vault behind a store that
+ * keeps its tickets in one, as `createVaultTicketStore` of the Security BFF's session store sets it. The
+ * production profile refuses a shared store that does not declare it, all three flags, because a store that
+ * says nothing cannot be shown to be reached over TLS and with authentication.
+ */
+export type AdmissionTicketStore = {
+    readonly shared?: boolean;
+    readonly security?: Readonly<{
+        durable: boolean;
+        tls: boolean;
+        authenticated: boolean;
+    }>;
+    issue: (id: string, ticket: AdmissionTicket) => Promise<void>;
+    consume: (id: string) => Promise<AdmissionTicket | undefined>;
+};
+type CommonSocketConfig = {
+    publicOrigin: string;
+    bffOrigin: string;
+    resolve: (resource: string, context: SocketContext) => string | undefined;
+    pollMs?: number;
+};
+/** Today's single-process development profile, refused when NODE_ENV is production. */
+export type DevelopmentSocketConfig = CommonSocketConfig & {
+    development: true;
+    production?: never;
+    ticketStore?: AdmissionTicketStore;
+    connectionBudget?: ConnectionBudget;
+};
+/** Shared, durable admission across replicas; no process-memory default exists in this profile. */
+export type PresentationProductionProfile = Readonly<{
+    ticketStore: AdmissionTicketStore;
+    connectionBudget: ConnectionBudget;
+}>;
+export type ProductionSocketConfig = CommonSocketConfig & {
+    production: PresentationProductionProfile;
+    development?: never;
+};
+export type SocketConfig = DevelopmentSocketConfig | ProductionSocketConfig;
+/** The unmet conditions of a production configuration; empty when it may start. */
+export declare function presentationProductionRefusals(config: ProductionSocketConfig): string[];
+export declare function createPresentationRealtime(config: SocketConfig): {
+    handleHttp: (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
+    attach: (server: Server) => void;
+    close: () => void;
+};

package/dist/core.js

@@ -0,0 +1,250 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { WebSocketServer, WebSocket } from 'ws';
+import { createMemoryConnectionBudget } from './connection-budget.js';
+/** The unmet conditions of a production configuration; empty when it may start. */
+export function presentationProductionRefusals(config) {
+    const refusals = [];
+    let https = false;
+    try {
+        https = new URL(config.publicOrigin).protocol === 'https:';
+    }
+    catch {
+        https = false;
+    }
+    if (!https)
+        refusals.push('HTTPS_PUBLIC_ORIGIN_REQUIRED');
+    if (config.production?.ticketStore?.shared !== true)
+        refusals.push('SHARED_TICKET_STORE_REQUIRED');
+    // A store that every replica shares is reached over a network, so it must say how: one that declares nothing is
+    // refused, as the Security BFF refuses a session vault that declares nothing, instead of passing for lack of a claim.
+    const declared = (security) => typeof security?.durable === 'boolean' && typeof security.tls === 'boolean' && typeof security.authenticated === 'boolean';
+    if (config.production?.ticketStore?.shared === true && !declared(config.production.ticketStore.security))
+        refusals.push('TICKET_STORE_SECURITY_REQUIRED');
+    // Tickets in a durable vault travel and rest under the vault's own protection, which must be TLS and authentication.
+    const vault = config.production?.ticketStore?.security;
+    if (vault?.durable && vault.tls !== true)
+        refusals.push('TICKET_STORE_TLS_REQUIRED');
+    if (vault?.durable && vault.authenticated !== true)
+        refusals.push('TICKET_STORE_AUTHENTICATION_REQUIRED');
+    if (config.production?.connectionBudget?.shared !== true)
+        refusals.push('SHARED_CONNECTION_BUDGET_REQUIRED');
+    return refusals;
+}
+const digest = (value) => createHash('sha256').update(value).digest('base64url');
+const authority = (c) => digest(JSON.stringify([c.subject, c.tenant, [...c.roles].sort()]));
+function checkedOrigin(value) { const url = new URL(value); if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.pathname !== '/' || url.search || url.hash)
+    throw new Error('INVALID_ORIGIN'); return url.origin; }
+function json(res, status, value) { res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff' }); res.end(JSON.stringify(value)); }
+export function createPresentationRealtime(config) {
+    const production = 'production' in config && config.production !== undefined ? config.production : undefined;
+    if (production) {
+        const refusals = presentationProductionRefusals(config);
+        if (refusals.length)
+            throw new Error('PRODUCTION_PROFILE_REFUSED:' + refusals.join(','));
+    }
+    else if (config.development !== true || process.env.NODE_ENV === 'production')
+        throw new Error('DURABLE_REALTIME_PROFILE_REQUIRED');
+    const development = production ? undefined : config;
+    const publicOrigin = checkedOrigin(config.publicOrigin), bff = checkedOrigin(config.bffOrigin);
+    const interval = Math.max(3000, config.pollMs ?? 3000), tickets = new Map();
+    const connectionBudget = production ? production.connectionBudget : development?.connectionBudget ?? createMemoryConnectionBudget();
+    const ticketStore = production ? production.ticketStore : development?.ticketStore ?? {
+        async issue(id, ticket) {
+            for (const [key, value] of tickets)
+                if (value.expires <= Date.now())
+                    tickets.delete(key);
+            if (tickets.size >= 256)
+                throw Object.assign(new Error('TICKET_LIMIT'), { status: 429 });
+            tickets.set(id, ticket);
+        },
+        async consume(id) { const ticket = tickets.get(id); tickets.delete(id); return ticket; }
+    };
+    const sockets = new WebSocketServer({ noServer: true, maxPayload: 4096, perMessageDeflate: false });
+    async function context(cookie) {
+        const response = await fetch(bff + '/context', { headers: { cookie }, redirect: 'error', signal: AbortSignal.timeout(8000), cache: 'no-store' });
+        if (response.status === 401 || response.status === 403)
+            throw Object.assign(new Error('LOGIN_REQUIRED'), { status: 401 });
+        if (!response.ok)
+            throw new Error('AUTHORITY_UNAVAILABLE');
+        const c = await response.json();
+        if (typeof c.subject !== 'string' || typeof c.csrf !== 'string' || !Array.isArray(c.roles) || !c.roles.every(v => typeof v === 'string') || (c.tenant !== null && typeof c.tenant !== 'string'))
+            throw new Error('INVALID_CONTEXT');
+        return c;
+    }
+    async function handleHttp(req, res) {
+        if (new URL(req.url ?? '/', publicOrigin).pathname !== '/api/realtime/ticket')
+            return false;
+        try {
+            if (req.method !== 'POST') {
+                json(res, 405, { title: 'POST_REQUIRED' });
+                return true;
+            }
+            if (req.headers.origin !== publicOrigin) {
+                json(res, 403, { title: 'ORIGIN_REJECTED' });
+                return true;
+            }
+            const cookie = req.headers.cookie ?? '', c = await context(cookie);
+            if (typeof req.headers['x-csrf-token'] !== 'string' || req.headers['x-csrf-token'] !== c.csrf) {
+                json(res, 403, { title: 'CSRF_REJECTED' });
+                return true;
+            }
+            const ticket = randomBytes(32).toString('base64url');
+            await ticketStore.issue(ticket, { cookieHash: digest(cookie), revision: authority(c), expires: Date.now() + 20000 });
+            json(res, 200, { ticket, expiresIn: 20 });
+        }
+        catch (e) {
+            const status = e.status ?? 503;
+            json(res, status, { title: status === 401 ? 'LOGIN_REQUIRED' : status === 429 ? 'TICKET_LIMIT' : 'AUTHORITY_UNAVAILABLE' });
+        }
+        return true;
+    }
+    function attach(server) {
+        server.on('upgrade', async (req, socket, head) => {
+            const url = new URL(req.url ?? '/', publicOrigin);
+            if (url.pathname !== '/api/realtime' || url.search || req.headers.origin !== publicOrigin) {
+                socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
+                return;
+            }
+            const cookie = req.headers.cookie ?? '', cookieHash = digest(cookie);
+            const connectionId = randomUUID();
+            let reserved = false, upgraded = false;
+            const release = () => connectionBudget.release(cookieHash, connectionId).catch(() => undefined);
+            try {
+                const initial = await context(cookie), revision = authority(initial);
+                if (sockets.clients.size >= 32 || !await connectionBudget.reserve(cookieHash, connectionId)) {
+                    socket.end('HTTP/1.1 429 Too Many Requests\r\nConnection: close\r\n\r\n');
+                    return;
+                }
+                reserved = true;
+                // Includes rejected WebSocket handshakes and clients which disconnect during admission.
+                socket.once('close', () => { if (!upgraded)
+                    void release(); });
+                if (socket.destroyed) {
+                    await release();
+                    return;
+                }
+                sockets.handleUpgrade(req, socket, head, ws => {
+                    upgraded = true;
+                    const contextRef = randomUUID(), resources = new Map();
+                    let admitted = false, admitting = false, busy = false, cursor = 0, alive = true;
+                    async function lease() {
+                        if (ws.readyState !== WebSocket.OPEN)
+                            return false;
+                        const started = performance.now();
+                        try {
+                            const duration = await connectionBudget.renew(cookieHash, connectionId);
+                            if (!duration || performance.now() - started >= duration) {
+                                ws.close(4004, 'LEASE_LOST');
+                                return false;
+                            }
+                            return ws.readyState === WebSocket.OPEN;
+                        }
+                        catch {
+                            ws.close(1013, 'RUNTIME_UNAVAILABLE');
+                            return false;
+                        }
+                    }
+                    const send = async (frame) => { if (!await lease())
+                        return; if (ws.bufferedAmount > 65536) {
+                        ws.close(4008, 'BACKPRESSURE');
+                        return;
+                    } ws.send(JSON.stringify(frame)); };
+                    const admission = setTimeout(() => ws.close(4001, 'ADMISSION_TIMEOUT'), 5000);
+                    ws.on('pong', () => { alive = true; });
+                    ws.on('error', () => ws.close(1011, 'TRANSPORT_ERROR'));
+                    ws.on('message', async (raw, binary) => {
+                        try {
+                            if (binary || admitted || admitting)
+                                throw new Error('INVALID_FRAME');
+                            admitting = true;
+                            const frame = JSON.parse(raw.toString());
+                            if (frame.v !== 1 || frame.type !== 'subscribe' || typeof frame.ticket !== 'string' || !Array.isArray(frame.resources) || frame.resources.length < 1 || frame.resources.length > 6 || frame.resources.some(v => typeof v !== 'string' || v.length > 80))
+                                throw new Error('INVALID_FRAME');
+                            if (!/^[-_a-zA-Z0-9]{43}$/.test(frame.ticket))
+                                throw new Error('INVALID_TICKET');
+                            const saved = await ticketStore.consume(frame.ticket);
+                            if (!saved || saved.expires <= Date.now() || saved.cookieHash !== cookieHash || saved.revision !== revision)
+                                throw new Error('INVALID_TICKET');
+                            if (authority(await context(cookie)) !== revision)
+                                throw new Error('AUTHORITY_CHANGED');
+                            if (ws.readyState !== WebSocket.OPEN)
+                                return;
+                            for (const name of new Set(frame.resources)) {
+                                const path = config.resolve(name, initial);
+                                if (!path || !path.startsWith('/v1/') || path.includes('..') || path.includes('#') || new URL(path, bff).origin !== bff)
+                                    throw new Error('FORBIDDEN_RESOURCE');
+                                resources.set(name, { path });
+                            }
+                            admitted = true;
+                            clearTimeout(admission);
+                            await send({ v: 1, type: 'ready', contextRef, accessRevision: revision, recovery: 'snapshot' });
+                            void tick();
+                        }
+                        catch {
+                            ws.close(4003, 'ADMISSION_REJECTED');
+                        }
+                    });
+                    async function tick() {
+                        if (!admitted || busy || ws.readyState !== WebSocket.OPEN)
+                            return;
+                        busy = true;
+                        try {
+                            if (!await lease())
+                                return;
+                            const current = await context(cookie);
+                            if (authority(current) !== revision) {
+                                ws.close(4003, 'AUTHORITY_CHANGED');
+                                return;
+                            }
+                            for (const [name, value] of resources) {
+                                if (config.resolve(name, current) !== value.path) {
+                                    ws.close(4003, 'RESOURCE_REVOKED');
+                                    return;
+                                }
+                                const result = await fetch(bff + value.path, { headers: { cookie }, redirect: 'error', cache: 'no-store', signal: AbortSignal.timeout(8000) });
+                                if (result.status === 401 || result.status === 403) {
+                                    ws.close(4003, 'RESOURCE_REVOKED');
+                                    return;
+                                }
+                                if (!result.ok && result.status !== 404)
+                                    throw new Error('SNAPSHOT_UNAVAILABLE');
+                                const text = await result.text();
+                                if (text.length > 1048576)
+                                    throw new Error('SNAPSHOT_LIMIT');
+                                const hash = digest(result.status + ':' + text);
+                                if (value.hash !== hash) {
+                                    cursor++;
+                                    await send({ v: 1, type: 'invalidate', eventId: randomUUID(), contextRef, accessRevision: revision, resource: name, cursor: String(cursor) });
+                                    value.hash = hash;
+                                }
+                            }
+                        }
+                        catch (e) {
+                            if (e.status === 401)
+                                ws.close(4003, 'LOGIN_REQUIRED');
+                            else
+                                await send({ v: 1, type: 'resync-required', contextRef, accessRevision: revision });
+                        }
+                        finally {
+                            busy = false;
+                        }
+                    }
+                    const polling = setInterval(() => void tick(), interval), heartbeat = setInterval(() => { if (!alive) {
+                        ws.terminate();
+                        return;
+                    } alive = false; ws.ping(); }, 30000);
+                    ws.on('close', () => { clearTimeout(admission); clearInterval(polling); clearInterval(heartbeat); void release(); });
+                });
+            }
+            catch (e) {
+                if (reserved)
+                    await release();
+                socket.end('HTTP/1.1 ' + (e.status === 401 ? '401 Unauthorized' : '503 Service Unavailable') + '\r\nConnection: close\r\n\r\n');
+            }
+        });
+    }
+    function close() { for (const ws of sockets.clients)
+        ws.terminate(); sockets.close(); tickets.clear(); }
+    return { handleHttp, attach, close };
+}
+//# sourceMappingURL=core.js.map

package/dist/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,UAAU,EAAC,WAAW,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AAE9D,OAAO,EAAC,eAAe,EAAC,SAAS,EAAC,MAAM,IAAI,CAAC;AAC7C,OAAO,EAAC,4BAA4B,EAAuB,MAAM,wBAAwB,CAAC;AAmB1F,mFAAmF;AACnF,MAAM,UAAU,8BAA8B,CAAC,MAA6B;IAC1E,MAAM,QAAQ,GAAU,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAC,KAAK,CAAC;IAAA,IAAG,CAAC;QAAA,KAAK,GAAC,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,KAAG,QAAQ,CAAC;IAAA,CAAC;IAAA,MAAK,CAAC;QAAA,KAAK,GAAC,KAAK,CAAC;IAAA,CAAC;IAC/F,IAAG,CAAC,KAAK;QAAC,QAAQ,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACxD,IAAG,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,KAAG,IAAI;QAAC,QAAQ,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC/F,gHAAgH;IAChH,sHAAsH;IACtH,MAAM,QAAQ,GAAC,CAAC,QAAyC,EAAC,EAAE,CAAA,OAAO,QAAQ,EAAE,OAAO,KAAG,SAAS,IAAE,OAAO,QAAQ,CAAC,GAAG,KAAG,SAAS,IAAE,OAAO,QAAQ,CAAC,aAAa,KAAG,SAAS,CAAC;IAC7K,IAAG,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,KAAG,IAAI,IAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACpJ,qHAAqH;IACrH,MAAM,KAAK,GAAC,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC;IACrD,IAAG,KAAK,EAAE,OAAO,IAAE,KAAK,CAAC,GAAG,KAAG,IAAI;QAAC,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC/E,IAAG,KAAK,EAAE,OAAO,IAAE,KAAK,CAAC,aAAa,KAAG,IAAI;QAAC,QAAQ,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACpG,IAAG,MAAM,CAAC,UAAU,EAAE,gBAAgB,EAAE,MAAM,KAAG,IAAI;QAAC,QAAQ,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACzG,OAAO,QAAQ,CAAC;AAClB,CAAC;AACD,MAAM,MAAM,GAAC,CAAC,KAAY,EAAC,EAAE,CAAA,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACpF,MAAM,SAAS,GAAC,CAAC,CAAe,EAAC,EAAE,CAAA,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,EAAC,CAAC,CAAC,MAAM,EAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACpG,SAAS,aAAa,CAAC,KAAY,IAAE,MAAM,GAAG,GAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA,IAAG,CAAC,CAAC,OAAO,EAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAE,GAAG,CAAC,QAAQ,IAAE,GAAG,CAAC,QAAQ,IAAE,GAAG,CAAC,QAAQ,KAAG,GAAG,IAAE,GAAG,CAAC,MAAM,IAAE,GAAG,CAAC,IAAI;IAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAA,OAAO,GAAG,CAAC,MAAM,CAAC,CAAA,CAAC;AACvO,SAAS,IAAI,CAAC,GAAkB,EAAC,MAAa,EAAC,KAAa,IAAE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAC,EAAC,cAAc,EAAC,kBAAkB,EAAC,eAAe,EAAC,UAAU,EAAC,wBAAwB,EAAC,SAAS,EAAC,CAAC,CAAC,CAAA,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA,CAAC;AAEtN,MAAM,UAAU,0BAA0B,CAAC,MAAmB;IAC5D,MAAM,UAAU,GAAC,YAAY,IAAI,MAAM,IAAE,MAAM,CAAC,UAAU,KAAG,SAAS,CAAA,CAAC,CAAA,MAAM,CAAC,UAAU,CAAA,CAAC,CAAA,SAAS,CAAC;IACnG,IAAG,UAAU,EAAC,CAAC;QACb,MAAM,QAAQ,GAAC,8BAA8B,CAAC,MAAgC,CAAC,CAAC;QAChF,IAAG,QAAQ,CAAC,MAAM;YAAC,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvF,CAAC;SAAK,IAAI,MAAkC,CAAC,WAAW,KAAG,IAAI,IAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAG,YAAY;QAAC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC1J,MAAM,WAAW,GAAC,UAAU,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,MAAiC,CAAC;IACzE,MAAM,YAAY,GAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,EAAC,GAAG,GAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAC,MAAM,CAAC,MAAM,IAAE,IAAI,CAAC,EAAC,OAAO,GAAC,IAAI,GAAG,EAA0B,CAAC;IAC5F,MAAM,gBAAgB,GAAC,UAAU,CAAA,CAAC,CAAA,UAAU,CAAC,gBAAgB,CAAA,CAAC,CAAA,WAAW,EAAE,gBAAgB,IAAE,4BAA4B,EAAE,CAAC;IAC5H,MAAM,WAAW,GAAC,UAAU,CAAA,CAAC,CAAA,UAAU,CAAC,WAAW,CAAA,CAAC,CAAA,WAAW,EAAE,WAAW,IAAE;QAC5E,KAAK,CAAC,KAAK,CAAC,EAAS,EAAC,MAAsB;YAC1C,KAAI,MAAK,CAAC,GAAG,EAAC,KAAK,CAAC,IAAG,OAAO;gBAAC,IAAG,KAAK,CAAC,OAAO,IAAE,IAAI,CAAC,GAAG,EAAE;oBAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChF,IAAG,OAAO,CAAC,IAAI,IAAE,GAAG;gBAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,EAAC,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC,CAAC;YACjF,OAAO,CAAC,GAAG,CAAC,EAAE,EAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,EAAS,IAAE,MAAM,MAAM,GAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA,OAAO,MAAM,CAAC,CAAA,CAAC;KACzF,CAAC;IACF,MAAM,OAAO,GAAC,IAAI,eAAe,CAAC,EAAC,QAAQ,EAAC,IAAI,EAAC,UAAU,EAAC,IAAI,EAAC,iBAAiB,EAAC,KAAK,EAAC,CAAC,CAAC;IAC3F,KAAK,UAAU,OAAO,CAAC,MAAa;QAClC,MAAM,QAAQ,GAAC,MAAM,KAAK,CAAC,GAAG,GAAC,UAAU,EAAC,EAAC,OAAO,EAAC,EAAC,MAAM,EAAC,EAAC,QAAQ,EAAC,OAAO,EAAC,MAAM,EAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,KAAK,EAAC,UAAU,EAAC,CAAC,CAAC;QACjI,IAAG,QAAQ,CAAC,MAAM,KAAG,GAAG,IAAE,QAAQ,CAAC,MAAM,KAAG,GAAG;YAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,EAAC,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC,CAAC;QAC9G,IAAG,CAAC,QAAQ,CAAC,EAAE;YAAC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACzD,MAAM,CAAC,GAAC,MAAM,QAAQ,CAAC,IAAI,EAAmB,CAAC;QAC/C,IAAG,OAAO,CAAC,CAAC,OAAO,KAAG,QAAQ,IAAE,OAAO,CAAC,CAAC,IAAI,KAAG,QAAQ,IAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA,EAAE,CAAA,OAAO,CAAC,KAAG,QAAQ,CAAC,IAAE,CAAC,CAAC,CAAC,MAAM,KAAG,IAAI,IAAE,OAAO,CAAC,CAAC,MAAM,KAAG,QAAQ,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC5M,OAAO,CAAC,CAAC;IACX,CAAC;IACD,KAAK,UAAU,UAAU,CAAC,GAAmB,EAAC,GAAkB;QAC9D,IAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAE,GAAG,EAAC,YAAY,CAAC,CAAC,QAAQ,KAAG,sBAAsB;YAAC,OAAO,KAAK,CAAC;QACrF,IAAG,CAAC;YACF,IAAG,GAAG,CAAC,MAAM,KAAG,MAAM,EAAC,CAAC;gBAAA,IAAI,CAAC,GAAG,EAAC,GAAG,EAAC,EAAC,KAAK,EAAC,eAAe,EAAC,CAAC,CAAC;gBAAA,OAAO,IAAI,CAAC;YAAA,CAAC;YAC3E,IAAG,GAAG,CAAC,OAAO,CAAC,MAAM,KAAG,YAAY,EAAC,CAAC;gBAAA,IAAI,CAAC,GAAG,EAAC,GAAG,EAAC,EAAC,KAAK,EAAC,iBAAiB,EAAC,CAAC,CAAC;gBAAA,OAAO,IAAI,CAAC;YAAA,CAAC;YAC3F,MAAM,MAAM,GAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAE,EAAE,EAAC,CAAC,GAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5D,IAAG,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,KAAG,QAAQ,IAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,KAAG,CAAC,CAAC,IAAI,EAAC,CAAC;gBAAA,IAAI,CAAC,GAAG,EAAC,GAAG,EAAC,EAAC,KAAK,EAAC,eAAe,EAAC,CAAC,CAAC;gBAAA,OAAO,IAAI,CAAC;YAAA,CAAC;YAC3I,MAAM,MAAM,GAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACnD,MAAM,WAAW,CAAC,KAAK,CAAC,MAAM,EAAC,EAAC,UAAU,EAAC,MAAM,CAAC,MAAM,CAAC,EAAC,QAAQ,EAAC,SAAS,CAAC,CAAC,CAAC,EAAC,OAAO,EAAC,IAAI,CAAC,GAAG,EAAE,GAAC,KAAK,EAAC,CAAC,CAAC;YAC3G,IAAI,CAAC,GAAG,EAAC,GAAG,EAAC,EAAC,MAAM,EAAC,SAAS,EAAC,EAAE,EAAC,CAAC,CAAC;QACtC,CAAC;QAAA,OAAM,CAAC,EAAC,CAAC;YAAA,MAAM,MAAM,GAAE,CAAsB,CAAC,MAAM,IAAE,GAAG,CAAC;YAAA,IAAI,CAAC,GAAG,EAAC,MAAM,EAAC,EAAC,KAAK,EAAC,MAAM,KAAG,GAAG,CAAA,CAAC,CAAA,gBAAgB,CAAA,CAAC,CAAA,MAAM,KAAG,GAAG,CAAA,CAAC,CAAA,cAAc,CAAA,CAAC,CAAA,uBAAuB,EAAC,CAAC,CAAC;QAAA,CAAC;QACvK,OAAO,IAAI,CAAC;IACd,CAAC;IACD,SAAS,MAAM,CAAC,MAAa;QAC3B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAC,KAAK,EAAC,GAAG,EAAC,MAAM,EAAC,IAAI,EAAC,EAAE;YAC1C,MAAM,GAAG,GAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAE,GAAG,EAAC,YAAY,CAAC,CAAC;YAC7C,IAAG,GAAG,CAAC,QAAQ,KAAG,eAAe,IAAE,GAAG,CAAC,MAAM,IAAE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAG,YAAY,EAAC,CAAC;gBAAA,MAAM,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;gBAAA,OAAO;YAAA,CAAC;YAC5J,MAAM,MAAM,GAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAE,EAAE,EAAC,UAAU,GAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9D,MAAM,YAAY,GAAC,UAAU,EAAE,CAAC;YAAA,IAAI,QAAQ,GAAC,KAAK,EAAC,QAAQ,GAAC,KAAK,CAAC;YAClE,MAAM,OAAO,GAAC,GAAE,EAAE,CAAA,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAE,EAAE,CAAA,SAAS,CAAC,CAAC;YACzF,IAAG,CAAC;gBACF,MAAM,OAAO,GAAC,MAAM,OAAO,CAAC,MAAM,CAAC,EAAC,QAAQ,GAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAChE,IAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAE,EAAE,IAAE,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAC,YAAY,CAAC,EAAC,CAAC;oBAAA,MAAM,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;oBAAA,OAAO;gBAAA,CAAC;gBACzK,QAAQ,GAAC,IAAI,CAAC;gBACd,wFAAwF;gBACxF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAC,GAAE,EAAE,GAAC,IAAG,CAAC,QAAQ;oBAAC,KAAK,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC;gBACxD,IAAG,MAAM,CAAC,SAAS,EAAC,CAAC;oBAAA,MAAM,OAAO,EAAE,CAAC;oBAAA,OAAO;gBAAA,CAAC;gBAC7C,OAAO,CAAC,aAAa,CAAC,GAAG,EAAC,MAAM,EAAC,IAAI,EAAC,EAAE,CAAA,EAAE;oBACxC,QAAQ,GAAC,IAAI,CAAC;oBACd,MAAM,UAAU,GAAC,UAAU,EAAE,EAAC,SAAS,GAAC,IAAI,GAAG,EAAqC,CAAC;oBAAA,IAAI,QAAQ,GAAC,KAAK,EAAC,SAAS,GAAC,KAAK,EAAC,IAAI,GAAC,KAAK,EAAC,MAAM,GAAC,CAAC,EAAC,KAAK,GAAC,IAAI,CAAC;oBACvJ,KAAK,UAAU,KAAK;wBAClB,IAAG,EAAE,CAAC,UAAU,KAAG,SAAS,CAAC,IAAI;4BAAC,OAAO,KAAK,CAAC;wBAC/C,MAAM,OAAO,GAAC,WAAW,CAAC,GAAG,EAAE,CAAC;wBAChC,IAAG,CAAC;4BACF,MAAM,QAAQ,GAAC,MAAM,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAC,YAAY,CAAC,CAAC;4BACrE,IAAG,CAAC,QAAQ,IAAE,WAAW,CAAC,GAAG,EAAE,GAAC,OAAO,IAAE,QAAQ,EAAC,CAAC;gCAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,YAAY,CAAC,CAAC;gCAAA,OAAO,KAAK,CAAC;4BAAA,CAAC;4BAC7F,OAAO,EAAE,CAAC,UAAU,KAAG,SAAS,CAAC,IAAI,CAAC;wBACxC,CAAC;wBAAA,MAAK,CAAC;4BAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,qBAAqB,CAAC,CAAC;4BAAA,OAAO,KAAK,CAAC;wBAAA,CAAC;oBAC5D,CAAC;oBACD,MAAM,IAAI,GAAC,KAAK,EAAC,KAAa,EAAC,EAAE,GAAC,IAAG,CAAC,MAAM,KAAK,EAAE;wBAAC,OAAO,CAAA,IAAG,EAAE,CAAC,cAAc,GAAC,KAAK,EAAC,CAAC;wBAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,cAAc,CAAC,CAAC;wBAAA,OAAO;oBAAA,CAAC,CAAA,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC;oBAC9J,MAAM,SAAS,GAAC,UAAU,CAAC,GAAE,EAAE,CAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,mBAAmB,CAAC,EAAC,IAAI,CAAC,CAAC;oBACxE,EAAE,CAAC,EAAE,CAAC,MAAM,EAAC,GAAE,EAAE,GAAC,KAAK,GAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC;oBAChC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAC,GAAE,EAAE,CAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,iBAAiB,CAAC,CAAC,CAAC;oBACpD,EAAE,CAAC,EAAE,CAAC,SAAS,EAAC,KAAK,EAAC,GAAG,EAAC,MAAM,EAAC,EAAE;wBACjC,IAAG,CAAC;4BACF,IAAG,MAAM,IAAE,QAAQ,IAAE,SAAS;gCAAC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;4BAChE,SAAS,GAAC,IAAI,CAAC;4BACf,MAAM,KAAK,GAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAA4D,CAAC;4BAClG,IAAG,KAAK,CAAC,CAAC,KAAG,CAAC,IAAE,KAAK,CAAC,IAAI,KAAG,WAAW,IAAE,OAAO,KAAK,CAAC,MAAM,KAAG,QAAQ,IAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAE,KAAK,CAAC,SAAS,CAAC,MAAM,GAAC,CAAC,IAAE,KAAK,CAAC,SAAS,CAAC,MAAM,GAAC,CAAC,IAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,OAAO,CAAC,KAAG,QAAQ,IAAE,CAAC,CAAC,MAAM,GAAC,EAAE,CAAC;gCAAC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;4BAC1P,IAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gCAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;4BAC/E,MAAM,KAAK,GAAC,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;4BACpD,IAAG,CAAC,KAAK,IAAE,KAAK,CAAC,OAAO,IAAE,IAAI,CAAC,GAAG,EAAE,IAAE,KAAK,CAAC,UAAU,KAAG,UAAU,IAAE,KAAK,CAAC,QAAQ,KAAG,QAAQ;gCAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;4BACjI,IAAG,SAAS,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,KAAG,QAAQ;gCAAC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;4BACpF,IAAG,EAAE,CAAC,UAAU,KAAG,SAAS,CAAC,IAAI;gCAAC,OAAO;4BACzC,KAAI,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAC,CAAC;gCAC1C,MAAM,IAAI,GAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAC,OAAO,CAAC,CAAC;gCACxC,IAAG,CAAC,IAAI,IAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAE,IAAI,GAAG,CAAC,IAAI,EAAC,GAAG,CAAC,CAAC,MAAM,KAAG,GAAG;oCAAC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;gCAClJ,SAAS,CAAC,GAAG,CAAC,IAAI,EAAC,EAAC,IAAI,EAAC,CAAC,CAAC;4BAC7B,CAAC;4BACD,QAAQ,GAAC,IAAI,CAAC;4BAAA,YAAY,CAAC,SAAS,CAAC,CAAC;4BAAA,MAAM,IAAI,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,IAAI,EAAC,OAAO,EAAC,UAAU,EAAC,cAAc,EAAC,QAAQ,EAAC,QAAQ,EAAC,UAAU,EAAC,CAAC,CAAC;4BAAA,KAAK,IAAI,EAAE,CAAC;wBAC1I,CAAC;wBAAA,MAAK,CAAC;4BAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,oBAAoB,CAAC,CAAC;wBAAA,CAAC;oBAC9C,CAAC,CAAC,CAAC;oBACH,KAAK,UAAU,IAAI;wBACjB,IAAG,CAAC,QAAQ,IAAE,IAAI,IAAE,EAAE,CAAC,UAAU,KAAG,SAAS,CAAC,IAAI;4BAAC,OAAO;wBAAA,IAAI,GAAC,IAAI,CAAC;wBACpE,IAAG,CAAC;4BACF,IAAG,CAAC,MAAM,KAAK,EAAE;gCAAC,OAAO;4BACzB,MAAM,OAAO,GAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;4BACpC,IAAG,SAAS,CAAC,OAAO,CAAC,KAAG,QAAQ,EAAC,CAAC;gCAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,mBAAmB,CAAC,CAAC;gCAAA,OAAO;4BAAA,CAAC;4BAC7E,KAAI,MAAK,CAAC,IAAI,EAAC,KAAK,CAAC,IAAG,SAAS,EAAC,CAAC;gCACjC,IAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAC,OAAO,CAAC,KAAG,KAAK,CAAC,IAAI,EAAC,CAAC;oCAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,kBAAkB,CAAC,CAAC;oCAAA,OAAO;gCAAA,CAAC;gCACxF,MAAM,MAAM,GAAC,MAAM,KAAK,CAAC,GAAG,GAAC,KAAK,CAAC,IAAI,EAAC,EAAC,OAAO,EAAC,EAAC,MAAM,EAAC,EAAC,QAAQ,EAAC,OAAO,EAAC,KAAK,EAAC,UAAU,EAAC,MAAM,EAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,CAAC,CAAC;gCAC/H,IAAG,MAAM,CAAC,MAAM,KAAG,GAAG,IAAE,MAAM,CAAC,MAAM,KAAG,GAAG,EAAC,CAAC;oCAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,kBAAkB,CAAC,CAAC;oCAAA,OAAO;gCAAA,CAAC;gCACvF,IAAG,CAAC,MAAM,CAAC,EAAE,IAAE,MAAM,CAAC,MAAM,KAAG,GAAG;oCAAC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gCAC3E,MAAM,IAAI,GAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gCAAA,IAAG,IAAI,CAAC,MAAM,GAAC,OAAO;oCAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;gCACxF,MAAM,IAAI,GAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAC,GAAG,GAAC,IAAI,CAAC,CAAC;gCAC1C,IAAG,KAAK,CAAC,IAAI,KAAG,IAAI,EAAC,CAAC;oCAAA,MAAM,EAAE,CAAC;oCAAA,MAAM,IAAI,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,IAAI,EAAC,YAAY,EAAC,OAAO,EAAC,UAAU,EAAE,EAAC,UAAU,EAAC,cAAc,EAAC,QAAQ,EAAC,QAAQ,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,CAAC,EAAC,CAAC,CAAC;oCAAA,KAAK,CAAC,IAAI,GAAC,IAAI,CAAC;gCAAA,CAAC;4BAClL,CAAC;wBACH,CAAC;wBAAA,OAAM,CAAC,EAAC,CAAC;4BAAA,IAAI,CAAsB,CAAC,MAAM,KAAG,GAAG;gCAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,gBAAgB,CAAC,CAAC;;gCAAK,MAAM,IAAI,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,IAAI,EAAC,iBAAiB,EAAC,UAAU,EAAC,cAAc,EAAC,QAAQ,EAAC,CAAC,CAAC;wBAAA,CAAC;gCAC7J,CAAC;4BAAA,IAAI,GAAC,KAAK,CAAC;wBAAA,CAAC;oBACtB,CAAC;oBACD,MAAM,OAAO,GAAC,WAAW,CAAC,GAAE,EAAE,CAAA,KAAK,IAAI,EAAE,EAAC,QAAQ,CAAC,EAAC,SAAS,GAAC,WAAW,CAAC,GAAE,EAAE,GAAC,IAAG,CAAC,KAAK,EAAC,CAAC;wBAAA,EAAE,CAAC,SAAS,EAAE,CAAC;wBAAA,OAAO;oBAAA,CAAC,CAAA,KAAK,GAAC,KAAK,CAAC,CAAA,EAAE,CAAC,IAAI,EAAE,CAAC,CAAA,CAAC,EAAC,KAAK,CAAC,CAAC;oBAChJ,EAAE,CAAC,EAAE,CAAC,OAAO,EAAC,GAAE,EAAE,GAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAA,aAAa,CAAC,OAAO,CAAC,CAAC,CAAA,aAAa,CAAC,SAAS,CAAC,CAAC,CAAA,KAAK,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC;gBAC/G,CAAC,CAAC,CAAC;YACL,CAAC;YAAA,OAAM,CAAC,EAAC,CAAC;gBAAA,IAAG,QAAQ;oBAAC,MAAM,OAAO,EAAE,CAAC;gBAAA,MAAM,CAAC,GAAG,CAAC,WAAW,GAAC,CAAE,CAAsB,CAAC,MAAM,KAAG,GAAG,CAAA,CAAC,CAAA,kBAAkB,CAAA,CAAC,CAAA,yBAAyB,CAAC,GAAC,+BAA+B,CAAC,CAAC;YAAA,CAAC;QACrL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,SAAS,KAAK,KAAG,KAAI,MAAM,EAAE,IAAI,OAAO,CAAC,OAAO;QAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAA,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA,CAAC;IACjG,OAAO,EAAC,UAAU,EAAC,MAAM,EAAC,KAAK,EAAC,CAAC;AACnC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1 @@
+export { type AdmissionTicket, type AdmissionTicketStore, type ConnectionBudget, createPresentationRealtime, type DevelopmentSocketConfig, type PresentationProductionProfile, type ProductionSocketConfig, type SocketConfig, } from './core.js';

package/dist/index.js

@@ -0,0 +1,2 @@
+export { createPresentationRealtime, } from './core.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,0BAA0B,GAK3B,MAAM,WAAW,CAAC"}

package/dist/internal.d.ts

@@ -0,0 +1 @@
+export { presentationProductionRefusals, type SocketContext } from './core.js';

package/dist/internal.js

@@ -0,0 +1,3 @@
+// For the cohort's own packages: outside the compatibility guarantee (README "Versioning").
+export { presentationProductionRefusals } from './core.js';
+//# sourceMappingURL=internal.js.map

package/dist/internal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal.js","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,OAAO,EAAC,8BAA8B,EAAoB,MAAM,WAAW,CAAC"}

package/dist/relay.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The relay of a streamed BFF route for a presentation application's route handlers (Web Request and
+ * Response, as in Next.js). It passes the request body to the BFF and the answer back to the browser as
+ * streams in both directions, never holding a whole body, and it forwards only what the BFF checks and the
+ * content headers. It decides nothing itself: the BFF's allowlist, session, Origin, CSRF and size rules do.
+ */
+/** The request headers the relay forwards: what the BFF checks, and the content headers of a body. */
+export declare const RELAY_REQUEST_HEADERS: readonly ["origin", "x-csrf-token", "idempotency-key", "accept-language", "content-type", "content-length"];
+/** The response headers the relay passes back: the content headers and the BFF's own safety and correlation headers. */
+export declare const RELAY_RESPONSE_HEADERS: readonly ["content-type", "content-length", "content-disposition", "content-security-policy", "x-content-type-options", "cache-control", "x-correlation-id", "idempotency-replayed"];
+export type RelayOptions = Readonly<{
+    /** The BFF's origin on the trusted server-to-server path. */
+    bffOrigin: string;
+    /** The BFF path under which the streamed routes live, for example `/<app>/transfer`. */
+    basePath: string;
+    /** The name of the BFF's session cookie: the only cookie the relay forwards, and the only one it passes back. */
+    sessionCookie: string;
+}>;
+export type Relay = (request: Request, segments: readonly string[]) => Promise<Response>;
+/**
+ * A relay to the BFF routes under `basePath`. Each path segment is encoded again, so that a segment can never
+ * leave the base path; the query string is passed as it is. A body without a length is refused by the BFF.
+ */
+export declare function createRelay(options: RelayOptions): Relay;

package/dist/relay.js

@@ -0,0 +1,77 @@
+/**
+ * The relay of a streamed BFF route for a presentation application's route handlers (Web Request and
+ * Response, as in Next.js). It passes the request body to the BFF and the answer back to the browser as
+ * streams in both directions, never holding a whole body, and it forwards only what the BFF checks and the
+ * content headers. It decides nothing itself: the BFF's allowlist, session, Origin, CSRF and size rules do.
+ */
+/** The request headers the relay forwards: what the BFF checks, and the content headers of a body. */
+export const RELAY_REQUEST_HEADERS = Object.freeze(['origin', 'x-csrf-token', 'idempotency-key', 'accept-language', 'content-type', 'content-length']);
+/** The response headers the relay passes back: the content headers and the BFF's own safety and correlation headers. */
+export const RELAY_RESPONSE_HEADERS = Object.freeze(['content-type', 'content-length', 'content-disposition', 'content-security-policy',
+    'x-content-type-options', 'cache-control', 'x-correlation-id', 'idempotency-replayed']);
+function checkedOrigin(value) {
+    const url = new URL(value);
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.pathname !== '/' || url.search || url.hash)
+        throw new Error('INVALID_ORIGIN');
+    return url.origin;
+}
+function cookieValue(header, name) {
+    return header?.split(';').map(value => value.trim()).find(value => value.startsWith(name + '='))?.slice(name.length + 1);
+}
+function problem(status, title) {
+    return new Response(JSON.stringify({ type: 'about:blank', status, title }), { status, headers: { 'content-type': 'application/json', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff' } });
+}
+/**
+ * A relay to the BFF routes under `basePath`. Each path segment is encoded again, so that a segment can never
+ * leave the base path; the query string is passed as it is. A body without a length is refused by the BFF.
+ */
+export function createRelay(options) {
+    const bff = checkedOrigin(options.bffOrigin);
+    if (!/^(?:\/[A-Za-z0-9._~-]+)+$/.test(options.basePath) || options.basePath.split('/').some(part => part === '.' || part === '..'))
+        throw new Error('INVALID_RELAY_PATH');
+    if (!/^(?:__Host-)?[a-z][a-z0-9_]{1,60}$/.test(options.sessionCookie))
+        throw new Error('INVALID_SESSION_COOKIE');
+    return async function relay(request, segments) {
+        if (!segments.length || segments.length > 32 || segments.some(segment => !segment || segment === '.' || segment === '..' || segment.length > 256))
+            return problem(404, 'OPERATION_NOT_FOUND');
+        const search = new URL(request.url).search;
+        const target = bff + options.basePath + '/' + segments.map(encodeURIComponent).join('/') + search;
+        const headers = new Headers();
+        for (const name of RELAY_REQUEST_HEADERS) {
+            const value = request.headers.get(name);
+            if (value !== null)
+                headers.set(name, value);
+        }
+        const session = cookieValue(request.headers.get('cookie'), options.sessionCookie);
+        if (session !== undefined)
+            headers.set('cookie', options.sessionCookie + '=' + session);
+        const withBody = request.method !== 'GET' && request.method !== 'HEAD' && request.body !== null;
+        let response;
+        try {
+            // A client that goes away aborts the call to the BFF, which ends the upstream call.
+            response = await fetch(target, { method: request.method, headers, ...(withBody ? { body: request.body, duplex: 'half' } : {}),
+                redirect: 'error', cache: 'no-store', signal: request.signal });
+        }
+        catch {
+            return problem(503, 'SERVICE_UNAVAILABLE');
+        }
+        const passed = new Headers();
+        for (const name of RELAY_RESPONSE_HEADERS) {
+            const value = response.headers.get(name);
+            if (value !== null)
+                passed.set(name, value);
+        }
+        // fetch decodes a content encoding, after which the encoded length no longer applies.
+        if (response.headers.has('content-encoding'))
+            passed.delete('content-length');
+        // A rotated session id is the BFF's own cookie; no other cookie is passed back.
+        for (const value of response.headers.getSetCookie())
+            if (value.startsWith(options.sessionCookie + '='))
+                passed.append('set-cookie', value);
+        const empty = [204, 205, 304].includes(response.status);
+        if (empty)
+            await response.body?.cancel().catch(() => undefined);
+        return new Response(empty ? null : response.body, { status: response.status, headers: passed });
+    };
+}
+//# sourceMappingURL=relay.js.map

package/dist/relay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay.js","sourceRoot":"","sources":["../src/relay.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,sGAAsG;AACtG,MAAM,CAAC,MAAM,qBAAqB,GAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAC,cAAc,EAAC,iBAAiB,EAAC,iBAAiB,EAAC,cAAc,EAAC,gBAAgB,CAAU,CAAC,CAAC;AACzJ,wHAAwH;AACxH,MAAM,CAAC,MAAM,sBAAsB,GAAC,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,EAAC,gBAAgB,EAAC,qBAAqB,EAAC,yBAAyB;IAChI,wBAAwB,EAAC,eAAe,EAAC,kBAAkB,EAAC,sBAAsB,CAAU,CAAC,CAAC;AAYhG,SAAS,aAAa,CAAC,KAAY;IACjC,MAAM,GAAG,GAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAG,CAAC,CAAC,OAAO,EAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAE,GAAG,CAAC,QAAQ,IAAE,GAAG,CAAC,QAAQ,IAAE,GAAG,CAAC,QAAQ,KAAG,GAAG,IAAE,GAAG,CAAC,MAAM,IAAE,GAAG,CAAC,IAAI;QAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtJ,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AACD,SAAS,WAAW,CAAC,MAAkB,EAAC,IAAW;IACjD,OAAO,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,UAAU,CAAC,IAAI,GAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,GAAC,CAAC,CAAC,CAAC;AACnH,CAAC;AACD,SAAS,OAAO,CAAC,MAAa,EAAC,KAAY;IACzC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,IAAI,EAAC,aAAa,EAAC,MAAM,EAAC,KAAK,EAAC,CAAC,EACnE,EAAC,MAAM,EAAC,OAAO,EAAC,EAAC,cAAc,EAAC,kBAAkB,EAAC,eAAe,EAAC,UAAU,EAAC,wBAAwB,EAAC,SAAS,EAAC,EAAC,CAAC,CAAC;AACxH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAoB;IAC9C,MAAM,GAAG,GAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAG,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA,EAAE,CAAA,IAAI,KAAG,GAAG,IAAE,IAAI,KAAG,IAAI,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC9J,IAAG,CAAC,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC/G,OAAO,KAAK,UAAU,KAAK,CAAC,OAAO,EAAC,QAAQ;QAC1C,IAAG,CAAC,QAAQ,CAAC,MAAM,IAAE,QAAQ,CAAC,MAAM,GAAC,EAAE,IAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAA,EAAE,CAAA,CAAC,OAAO,IAAE,OAAO,KAAG,GAAG,IAAE,OAAO,KAAG,IAAI,IAAE,OAAO,CAAC,MAAM,GAAC,GAAG,CAAC;YAAC,OAAO,OAAO,CAAC,GAAG,EAAC,qBAAqB,CAAC,CAAC;QACvK,MAAM,MAAM,GAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACzC,MAAM,MAAM,GAAC,GAAG,GAAC,OAAO,CAAC,QAAQ,GAAC,GAAG,GAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAC,MAAM,CAAC;QACxF,MAAM,OAAO,GAAC,IAAI,OAAO,EAAE,CAAC;QAC5B,KAAI,MAAM,IAAI,IAAI,qBAAqB,EAAC,CAAC;YAAA,MAAM,KAAK,GAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAAA,IAAG,KAAK,KAAG,IAAI;gBAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAC,KAAK,CAAC,CAAC;QAAA,CAAC;QACxH,MAAM,OAAO,GAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC/E,IAAG,OAAO,KAAG,SAAS;YAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAC,OAAO,CAAC,aAAa,GAAC,GAAG,GAAC,OAAO,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAC,OAAO,CAAC,MAAM,KAAG,KAAK,IAAE,OAAO,CAAC,MAAM,KAAG,MAAM,IAAE,OAAO,CAAC,IAAI,KAAG,IAAI,CAAC;QACpF,IAAI,QAAiB,CAAC;QACtB,IAAG,CAAC;YACF,oFAAoF;YACpF,QAAQ,GAAC,MAAM,KAAK,CAAC,MAAM,EAAC,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,OAAO,EAAC,GAAG,CAAC,QAAQ,CAAA,CAAC,CAAA,EAAC,IAAI,EAAC,OAAO,CAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC;gBAC3G,QAAQ,EAAC,OAAO,EAAC,KAAK,EAAC,UAAU,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAgB,CAAC,CAAC;QAC7E,CAAC;QAAA,MAAK,CAAC;YAAA,OAAO,OAAO,CAAC,GAAG,EAAC,qBAAqB,CAAC,CAAC;QAAA,CAAC;QAClD,MAAM,MAAM,GAAC,IAAI,OAAO,EAAE,CAAC;QAC3B,KAAI,MAAM,IAAI,IAAI,sBAAsB,EAAC,CAAC;YAAA,MAAM,KAAK,GAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAAA,IAAG,KAAK,KAAG,IAAI;gBAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAC,KAAK,CAAC,CAAC;QAAA,CAAC;QACzH,sFAAsF;QACtF,IAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC5E,gFAAgF;QAChF,KAAI,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE;YAAC,IAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,aAAa,GAAC,GAAG,CAAC;gBAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAC,KAAK,CAAC,CAAC;QACpI,MAAM,KAAK,GAAC,CAAC,GAAG,EAAC,GAAG,EAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,IAAG,KAAK;YAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAE,EAAE,CAAA,SAAS,CAAC,CAAC;QAC5D,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAA,CAAC,CAAA,IAAI,CAAA,CAAC,CAAA,QAAQ,CAAC,IAAI,EAAC,EAAC,MAAM,EAAC,QAAQ,CAAC,MAAM,EAAC,OAAO,EAAC,MAAM,EAAC,CAAC,CAAC;IACxF,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,38 @@
 {
   "name": "@mpfrontend/presentation-server",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "1.0.0",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/panahister/mpfrontend.git",
+    "directory": "packages/presentation-server"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./relay": {
+      "types": "./dist/relay.d.ts",
+      "import": "./dist/relay.js"
+    },
+    "./internal": {
+      "types": "./dist/internal.d.ts",
+      "import": "./dist/internal.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "dependencies": {
+    "ws": "8.22.0"
+  }
 }