@mpfrontend/presentation-server 0.1.0 → 1.1.0

package/dist/core.d.ts

@@ -0,0 +1,60 @@
+import type { IncomingMessage, ServerResponse, Server } from 'node:http';
+import { type ConnectionBudget } from './connection-budget.js';
+export type { ConnectionBudget } from './connection-budget.js';
+export type SocketContext = {
+    subject: string;
+    tenant: string | null;
+    roles: string[];
+    csrf: string;
+};
+export type AdmissionTicket = {
+    cookieHash: string;
+    revision: string;
+    expires: number;
+};
+/**
+ * consume must be atomic across all presentation replicas. `security` describes the vault behind a store that
+ * keeps its tickets in one, as `createVaultTicketStore` of the Security BFF's session store sets it. The
+ * production profile refuses a shared store that does not declare it, all three flags, because a store that
+ * says nothing cannot be shown to be reached over TLS and with authentication.
+ */
+export type AdmissionTicketStore = {
+    readonly shared?: boolean;
+    readonly security?: Readonly<{
+        durable: boolean;
+        tls: boolean;
+        authenticated: boolean;
+    }>;
+    issue: (id: string, ticket: AdmissionTicket) => Promise<void>;
+    consume: (id: string) => Promise<AdmissionTicket | undefined>;
+};
+type CommonSocketConfig = {
+    publicOrigin: string;
+    bffOrigin: string;
+    resolve: (resource: string, context: SocketContext) => string | undefined;
+    pollMs?: number;
+};
+/** Today's single-process development profile, refused when NODE_ENV is production. */
+export type DevelopmentSocketConfig = CommonSocketConfig & {
+    development: true;
+    production?: never;
+    ticketStore?: AdmissionTicketStore;
+    connectionBudget?: ConnectionBudget;
+};
+/** Shared, durable admission across replicas; no process-memory default exists in this profile. */
+export type PresentationProductionProfile = Readonly<{
+    ticketStore: AdmissionTicketStore;
+    connectionBudget: ConnectionBudget;
+}>;
+export type ProductionSocketConfig = CommonSocketConfig & {
+    production: PresentationProductionProfile;
+    development?: never;
+};
+export type SocketConfig = DevelopmentSocketConfig | ProductionSocketConfig;
+/** The unmet conditions of a production configuration; empty when it may start. */
+export declare function presentationProductionRefusals(config: ProductionSocketConfig): string[];
+export declare function createPresentationRealtime(config: SocketConfig): {
+    handleHttp: (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
+    attach: (server: Server) => void;
+    close: () => void;
+};

package/dist/core.js

@@ -0,0 +1,250 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { WebSocketServer, WebSocket } from 'ws';
+import { createMemoryConnectionBudget } from './connection-budget.js';
+/** The unmet conditions of a production configuration; empty when it may start. */
+export function presentationProductionRefusals(config) {
+    const refusals = [];
+    let https = false;
+    try {
+        https = new URL(config.publicOrigin).protocol === 'https:';
+    }
+    catch {
+        https = false;
+    }
+    if (!https)
+        refusals.push('HTTPS_PUBLIC_ORIGIN_REQUIRED');
+    if (config.production?.ticketStore?.shared !== true)
+        refusals.push('SHARED_TICKET_STORE_REQUIRED');
+    // A store that every replica shares is reached over a network, so it must say how: one that declares nothing is
+    // refused, as the Security BFF refuses a session vault that declares nothing, instead of passing for lack of a claim.
+    const declared = (security) => typeof security?.durable === 'boolean' && typeof security.tls === 'boolean' && typeof security.authenticated === 'boolean';
+    if (config.production?.ticketStore?.shared === true && !declared(config.production.ticketStore.security))
+        refusals.push('TICKET_STORE_SECURITY_REQUIRED');
+    // Tickets in a durable vault travel and rest under the vault's own protection, which must be TLS and authentication.
+    const vault = config.production?.ticketStore?.security;
+    if (vault?.durable && vault.tls !== true)
+        refusals.push('TICKET_STORE_TLS_REQUIRED');
+    if (vault?.durable && vault.authenticated !== true)
+        refusals.push('TICKET_STORE_AUTHENTICATION_REQUIRED');
+    if (config.production?.connectionBudget?.shared !== true)
+        refusals.push('SHARED_CONNECTION_BUDGET_REQUIRED');
+    return refusals;
+}
+const digest = (value) => createHash('sha256').update(value).digest('base64url');
+const authority = (c) => digest(JSON.stringify([c.subject, c.tenant, [...c.roles].sort()]));
+function checkedOrigin(value) { const url = new URL(value); if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.pathname !== '/' || url.search || url.hash)
+    throw new Error('INVALID_ORIGIN'); return url.origin; }
+function json(res, status, value) { res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff' }); res.end(JSON.stringify(value)); }
+export function createPresentationRealtime(config) {
+    const production = 'production' in config && config.production !== undefined ? config.production : undefined;
+    if (production) {
+        const refusals = presentationProductionRefusals(config);
+        if (refusals.length)
+            throw new Error('PRODUCTION_PROFILE_REFUSED:' + refusals.join(','));
+    }
+    else if (config.development !== true || process.env.NODE_ENV === 'production')
+        throw new Error('DURABLE_REALTIME_PROFILE_REQUIRED');
+    const development = production ? undefined : config;
+    const publicOrigin = checkedOrigin(config.publicOrigin), bff = checkedOrigin(config.bffOrigin);
+    const interval = Math.max(3000, config.pollMs ?? 3000), tickets = new Map();
+    const connectionBudget = production ? production.connectionBudget : development?.connectionBudget ?? createMemoryConnectionBudget();
+    const ticketStore = production ? production.ticketStore : development?.ticketStore ?? {
+        async issue(id, ticket) {
+            for (const [key, value] of tickets)
+                if (value.expires <= Date.now())
+                    tickets.delete(key);
+            if (tickets.size >= 256)
+                throw Object.assign(new Error('TICKET_LIMIT'), { status: 429 });
+            tickets.set(id, ticket);
+        },
+        async consume(id) { const ticket = tickets.get(id); tickets.delete(id); return ticket; }
+    };
+    const sockets = new WebSocketServer({ noServer: true, maxPayload: 4096, perMessageDeflate: false });
+    async function context(cookie) {
+        const response = await fetch(bff + '/context', { headers: { cookie }, redirect: 'error', signal: AbortSignal.timeout(8000), cache: 'no-store' });
+        if (response.status === 401 || response.status === 403)
+            throw Object.assign(new Error('LOGIN_REQUIRED'), { status: 401 });
+        if (!response.ok)
+            throw new Error('AUTHORITY_UNAVAILABLE');
+        const c = await response.json();
+        if (typeof c.subject !== 'string' || typeof c.csrf !== 'string' || !Array.isArray(c.roles) || !c.roles.every(v => typeof v === 'string') || (c.tenant !== null && typeof c.tenant !== 'string'))
+            throw new Error('INVALID_CONTEXT');
+        return c;
+    }
+    async function handleHttp(req, res) {
+        if (new URL(req.url ?? '/', publicOrigin).pathname !== '/api/realtime/ticket')
+            return false;
+        try {
+            if (req.method !== 'POST') {
+                json(res, 405, { title: 'POST_REQUIRED' });
+                return true;
+            }
+            if (req.headers.origin !== publicOrigin) {
+                json(res, 403, { title: 'ORIGIN_REJECTED' });
+                return true;
+            }
+            const cookie = req.headers.cookie ?? '', c = await context(cookie);
+            if (typeof req.headers['x-csrf-token'] !== 'string' || req.headers['x-csrf-token'] !== c.csrf) {
+                json(res, 403, { title: 'CSRF_REJECTED' });
+                return true;
+            }
+            const ticket = randomBytes(32).toString('base64url');
+            await ticketStore.issue(ticket, { cookieHash: digest(cookie), revision: authority(c), expires: Date.now() + 20000 });
+            json(res, 200, { ticket, expiresIn: 20 });
+        }
+        catch (e) {
+            const status = e.status ?? 503;
+            json(res, status, { title: status === 401 ? 'LOGIN_REQUIRED' : status === 429 ? 'TICKET_LIMIT' : 'AUTHORITY_UNAVAILABLE' });
+        }
+        return true;
+    }
+    function attach(server) {
+        server.on('upgrade', async (req, socket, head) => {
+            const url = new URL(req.url ?? '/', publicOrigin);
+            if (url.pathname !== '/api/realtime' || url.search || req.headers.origin !== publicOrigin) {
+                socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
+                return;
+            }
+            const cookie = req.headers.cookie ?? '', cookieHash = digest(cookie);
+            const connectionId = randomUUID();
+            let reserved = false, upgraded = false;
+            const release = () => connectionBudget.release(cookieHash, connectionId).catch(() => undefined);
+            try {
+                const initial = await context(cookie), revision = authority(initial);
+                if (sockets.clients.size >= 32 || !await connectionBudget.reserve(cookieHash, connectionId)) {
+                    socket.end('HTTP/1.1 429 Too Many Requests\r\nConnection: close\r\n\r\n');
+                    return;
+                }
+                reserved = true;
+                // Includes rejected WebSocket handshakes and clients which disconnect during admission.
+                socket.once('close', () => { if (!upgraded)
+                    void release(); });
+                if (socket.destroyed) {
+                    await release();
+                    return;
+                }
+                sockets.handleUpgrade(req, socket, head, ws => {
+                    upgraded = true;
+                    const contextRef = randomUUID(), resources = new Map();
+                    let admitted = false, admitting = false, busy = false, cursor = 0, alive = true;
+                    async function lease() {
+                        if (ws.readyState !== WebSocket.OPEN)
+                            return false;
+                        const started = performance.now();
+                        try {
+                            const duration = await connectionBudget.renew(cookieHash, connectionId);
+                            if (!duration || performance.now() - started >= duration) {
+                                ws.close(4004, 'LEASE_LOST');
+                                return false;
+                            }
+                            return ws.readyState === WebSocket.OPEN;
+                        }
+                        catch {
+                            ws.close(1013, 'RUNTIME_UNAVAILABLE');
+                            return false;
+                        }
+                    }
+                    const send = async (frame) => { if (!await lease())
+                        return; if (ws.bufferedAmount > 65536) {
+                        ws.close(4008, 'BACKPRESSURE');
+                        return;
+                    } ws.send(JSON.stringify(frame)); };
+                    const admission = setTimeout(() => ws.close(4001, 'ADMISSION_TIMEOUT'), 5000);
+                    ws.on('pong', () => { alive = true; });
+                    ws.on('error', () => ws.close(1011, 'TRANSPORT_ERROR'));
+                    ws.on('message', async (raw, binary) => {
+                        try {
+                            if (binary || admitted || admitting)
+                                throw new Error('INVALID_FRAME');
+                            admitting = true;
+                            const frame = JSON.parse(raw.toString());
+                            if (frame.v !== 1 || frame.type !== 'subscribe' || typeof frame.ticket !== 'string' || !Array.isArray(frame.resources) || frame.resources.length < 1 || frame.resources.length > 6 || frame.resources.some(v => typeof v !== 'string' || v.length > 80))
+                                throw new Error('INVALID_FRAME');
+                            if (!/^[-_a-zA-Z0-9]{43}$/.test(frame.ticket))
+                                throw new Error('INVALID_TICKET');
+                            const saved = await ticketStore.consume(frame.ticket);
+                            if (!saved || saved.expires <= Date.now() || saved.cookieHash !== cookieHash || saved.revision !== revision)
+                                throw new Error('INVALID_TICKET');
+                            if (authority(await context(cookie)) !== revision)
+                                throw new Error('AUTHORITY_CHANGED');
+                            if (ws.readyState !== WebSocket.OPEN)
+                                return;
+                            for (const name of new Set(frame.resources)) {
+                                const path = config.resolve(name, initial);
+                                if (!path || !path.startsWith('/v1/') || path.includes('..') || path.includes('#') || new URL(path, bff).origin !== bff)
+                                    throw new Error('FORBIDDEN_RESOURCE');
+                                resources.set(name, { path });
+                            }
+                            admitted = true;
+                            clearTimeout(admission);
+                            await send({ v: 1, type: 'ready', contextRef, accessRevision: revision, recovery: 'snapshot' });
+                            void tick();
+                        }
+                        catch {
+                            ws.close(4003, 'ADMISSION_REJECTED');
+                        }
+                    });
+                    async function tick() {
+                        if (!admitted || busy || ws.readyState !== WebSocket.OPEN)
+                            return;
+                        busy = true;
+                        try {
+                            if (!await lease())
+                                return;
+                            const current = await context(cookie);
+                            if (authority(current) !== revision) {
+                                ws.close(4003, 'AUTHORITY_CHANGED');
+                                return;
+                            }
+                            for (const [name, value] of resources) {
+                                if (config.resolve(name, current) !== value.path) {
+                                    ws.close(4003, 'RESOURCE_REVOKED');
+                                    return;
+                                }
+                                const result = await fetch(bff + value.path, { headers: { cookie }, redirect: 'error', cache: 'no-store', signal: AbortSignal.timeout(8000) });
+                                if (result.status === 401 || result.status === 403) {
+                                    ws.close(4003, 'RESOURCE_REVOKED');
+                                    return;
+                                }
+                                if (!result.ok && result.status !== 404)
+                                    throw new Error('SNAPSHOT_UNAVAILABLE');
+                                const text = await result.text();
+                                if (text.length > 1048576)
+                                    throw new Error('SNAPSHOT_LIMIT');
+                                const hash = digest(result.status + ':' + text);
+                                if (value.hash !== hash) {
+                                    cursor++;
+                                    await send({ v: 1, type: 'invalidate', eventId: randomUUID(), contextRef, accessRevision: revision, resource: name, cursor: String(cursor) });
+                                    value.hash = hash;
+                                }
+                            }
+                        }
+                        catch (e) {
+                            if (e.status === 401)
+                                ws.close(4003, 'LOGIN_REQUIRED');
+                            else
+                                await send({ v: 1, type: 'resync-required', contextRef, accessRevision: revision });
+                        }
+                        finally {
+                            busy = false;
+                        }
+                    }
+                    const polling = setInterval(() => void tick(), interval), heartbeat = setInterval(() => { if (!alive) {
+                        ws.terminate();
+                        return;
+                    } alive = false; ws.ping(); }, 30000);
+                    ws.on('close', () => { clearTimeout(admission); clearInterval(polling); clearInterval(heartbeat); void release(); });
+                });
+            }
+            catch (e) {
+                if (reserved)
+                    await release();
+                socket.end('HTTP/1.1 ' + (e.status === 401 ? '401 Unauthorized' : '503 Service Unavailable') + '\r\nConnection: close\r\n\r\n');
+            }
+        });
+    }
+    function close() { for (const ws of sockets.clients)
+        ws.terminate(); sockets.close(); tickets.clear(); }
+    return { handleHttp, attach, close };
+}
+//# sourceMappingURL=core.js.map

package/dist/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,UAAU,EAAC,WAAW,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AAE9D,OAAO,EAAC,eAAe,EAAC,SAAS,EAAC,MAAM,IAAI,CAAC;AAC7C,OAAO,EAAC,4BAA4B,EAAuB,MAAM,wBAAwB,CAAC;AAmB1F,mFAAmF;AACnF,MAAM,UAAU,8BAA8B,CAAC,MAA6B;IAC1E,MAAM,QAAQ,GAAU,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAC,KAAK,CAAC;IAAA,IAAG,CAAC;QAAA,KAAK,GAAC,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,KAAG,QAAQ,CAAC;IAAA,CAAC;IAAA,MAAK,CAAC;QAAA,KAAK,GAAC,KAAK,CAAC;IAAA,CAAC;IAC/F,IAAG,CAAC,KAAK;QAAC,QAAQ,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACxD,IAAG,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,KAAG,IAAI;QAAC,QAAQ,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC/F,gHAAgH;IAChH,sHAAsH;IACtH,MAAM,QAAQ,GAAC,CAAC,QAAyC,EAAC,EAAE,CAAA,OAAO,QAAQ,EAAE,OAAO,KAAG,SAAS,IAAE,OAAO,QAAQ,CAAC,GAAG,KAAG,SAAS,IAAE,OAAO,QAAQ,CAAC,aAAa,KAAG,SAAS,CAAC;IAC7K,IAAG,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,KAAG,IAAI,IAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACpJ,qHAAqH;IACrH,MAAM,KAAK,GAAC,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC;IACrD,IAAG,KAAK,EAAE,OAAO,IAAE,KAAK,CAAC,GAAG,KAAG,IAAI;QAAC,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC/E,IAAG,KAAK,EAAE,OAAO,IAAE,KAAK,CAAC,aAAa,KAAG,IAAI;QAAC,QAAQ,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACpG,IAAG,MAAM,CAAC,UAAU,EAAE,gBAAgB,EAAE,MAAM,KAAG,IAAI;QAAC,QAAQ,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACzG,OAAO,QAAQ,CAAC;AAClB,CAAC;AACD,MAAM,MAAM,GAAC,CAAC,KAAY,EAAC,EAAE,CAAA,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACpF,MAAM,SAAS,GAAC,CAAC,CAAe,EAAC,EAAE,CAAA,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,EAAC,CAAC,CAAC,MAAM,EAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACpG,SAAS,aAAa,CAAC,KAAY,IAAE,MAAM,GAAG,GAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA,IAAG,CAAC,CAAC,OAAO,EAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAE,GAAG,CAAC,QAAQ,IAAE,GAAG,CAAC,QAAQ,IAAE,GAAG,CAAC,QAAQ,KAAG,GAAG,IAAE,GAAG,CAAC,MAAM,IAAE,GAAG,CAAC,IAAI;IAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAA,OAAO,GAAG,CAAC,MAAM,CAAC,CAAA,CAAC;AACvO,SAAS,IAAI,CAAC,GAAkB,EAAC,MAAa,EAAC,KAAa,IAAE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAC,EAAC,cAAc,EAAC,kBAAkB,EAAC,eAAe,EAAC,UAAU,EAAC,wBAAwB,EAAC,SAAS,EAAC,CAAC,CAAC,CAAA,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA,CAAC;AAEtN,MAAM,UAAU,0BAA0B,CAAC,MAAmB;IAC5D,MAAM,UAAU,GAAC,YAAY,IAAI,MAAM,IAAE,MAAM,CAAC,UAAU,KAAG,SAAS,CAAA,CAAC,CAAA,MAAM,CAAC,UAAU,CAAA,CAAC,CAAA,SAAS,CAAC;IACnG,IAAG,UAAU,EAAC,CAAC;QACb,MAAM,QAAQ,GAAC,8BAA8B,CAAC,MAAgC,CAAC,CAAC;QAChF,IAAG,QAAQ,CAAC,MAAM;YAAC,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvF,CAAC;SAAK,IAAI,MAAkC,CAAC,WAAW,KAAG,IAAI,IAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAG,YAAY;QAAC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC1J,MAAM,WAAW,GAAC,UAAU,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,MAAiC,CAAC;IACzE,MAAM,YAAY,GAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,EAAC,GAAG,GAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAC,MAAM,CAAC,MAAM,IAAE,IAAI,CAAC,EAAC,OAAO,GAAC,IAAI,GAAG,EAA0B,CAAC;IAC5F,MAAM,gBAAgB,GAAC,UAAU,CAAA,CAAC,CAAA,UAAU,CAAC,gBAAgB,CAAA,CAAC,CAAA,WAAW,EAAE,gBAAgB,IAAE,4BAA4B,EAAE,CAAC;IAC5H,MAAM,WAAW,GAAC,UAAU,CAAA,CAAC,CAAA,UAAU,CAAC,WAAW,CAAA,CAAC,CAAA,WAAW,EAAE,WAAW,IAAE;QAC5E,KAAK,CAAC,KAAK,CAAC,EAAS,EAAC,MAAsB;YAC1C,KAAI,MAAK,CAAC,GAAG,EAAC,KAAK,CAAC,IAAG,OAAO;gBAAC,IAAG,KAAK,CAAC,OAAO,IAAE,IAAI,CAAC,GAAG,EAAE;oBAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChF,IAAG,OAAO,CAAC,IAAI,IAAE,GAAG;gBAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,EAAC,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC,CAAC;YACjF,OAAO,CAAC,GAAG,CAAC,EAAE,EAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,EAAS,IAAE,MAAM,MAAM,GAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA,OAAO,MAAM,CAAC,CAAA,CAAC;KACzF,CAAC;IACF,MAAM,OAAO,GAAC,IAAI,eAAe,CAAC,EAAC,QAAQ,EAAC,IAAI,EAAC,UAAU,EAAC,IAAI,EAAC,iBAAiB,EAAC,KAAK,EAAC,CAAC,CAAC;IAC3F,KAAK,UAAU,OAAO,CAAC,MAAa;QAClC,MAAM,QAAQ,GAAC,MAAM,KAAK,CAAC,GAAG,GAAC,UAAU,EAAC,EAAC,OAAO,EAAC,EAAC,MAAM,EAAC,EAAC,QAAQ,EAAC,OAAO,EAAC,MAAM,EAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,KAAK,EAAC,UAAU,EAAC,CAAC,CAAC;QACjI,IAAG,QAAQ,CAAC,MAAM,KAAG,GAAG,IAAE,QAAQ,CAAC,MAAM,KAAG,GAAG;YAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,EAAC,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC,CAAC;QAC9G,IAAG,CAAC,QAAQ,CAAC,EAAE;YAAC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACzD,MAAM,CAAC,GAAC,MAAM,QAAQ,CAAC,IAAI,EAAmB,CAAC;QAC/C,IAAG,OAAO,CAAC,CAAC,OAAO,KAAG,QAAQ,IAAE,OAAO,CAAC,CAAC,IAAI,KAAG,QAAQ,IAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA,EAAE,CAAA,OAAO,CAAC,KAAG,QAAQ,CAAC,IAAE,CAAC,CAAC,CAAC,MAAM,KAAG,IAAI,IAAE,OAAO,CAAC,CAAC,MAAM,KAAG,QAAQ,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC5M,OAAO,CAAC,CAAC;IACX,CAAC;IACD,KAAK,UAAU,UAAU,CAAC,GAAmB,EAAC,GAAkB;QAC9D,IAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAE,GAAG,EAAC,YAAY,CAAC,CAAC,QAAQ,KAAG,sBAAsB;YAAC,OAAO,KAAK,CAAC;QACrF,IAAG,CAAC;YACF,IAAG,GAAG,CAAC,MAAM,KAAG,MAAM,EAAC,CAAC;gBAAA,IAAI,CAAC,GAAG,EAAC,GAAG,EAAC,EAAC,KAAK,EAAC,eAAe,EAAC,CAAC,CAAC;gBAAA,OAAO,IAAI,CAAC;YAAA,CAAC;YAC3E,IAAG,GAAG,CAAC,OAAO,CAAC,MAAM,KAAG,YAAY,EAAC,CAAC;gBAAA,IAAI,CAAC,GAAG,EAAC,GAAG,EAAC,EAAC,KAAK,EAAC,iBAAiB,EAAC,CAAC,CAAC;gBAAA,OAAO,IAAI,CAAC;YAAA,CAAC;YAC3F,MAAM,MAAM,GAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAE,EAAE,EAAC,CAAC,GAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5D,IAAG,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,KAAG,QAAQ,IAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,KAAG,CAAC,CAAC,IAAI,EAAC,CAAC;gBAAA,IAAI,CAAC,GAAG,EAAC,GAAG,EAAC,EAAC,KAAK,EAAC,eAAe,EAAC,CAAC,CAAC;gBAAA,OAAO,IAAI,CAAC;YAAA,CAAC;YAC3I,MAAM,MAAM,GAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACnD,MAAM,WAAW,CAAC,KAAK,CAAC,MAAM,EAAC,EAAC,UAAU,EAAC,MAAM,CAAC,MAAM,CAAC,EAAC,QAAQ,EAAC,SAAS,CAAC,CAAC,CAAC,EAAC,OAAO,EAAC,IAAI,CAAC,GAAG,EAAE,GAAC,KAAK,EAAC,CAAC,CAAC;YAC3G,IAAI,CAAC,GAAG,EAAC,GAAG,EAAC,EAAC,MAAM,EAAC,SAAS,EAAC,EAAE,EAAC,CAAC,CAAC;QACtC,CAAC;QAAA,OAAM,CAAC,EAAC,CAAC;YAAA,MAAM,MAAM,GAAE,CAAsB,CAAC,MAAM,IAAE,GAAG,CAAC;YAAA,IAAI,CAAC,GAAG,EAAC,MAAM,EAAC,EAAC,KAAK,EAAC,MAAM,KAAG,GAAG,CAAA,CAAC,CAAA,gBAAgB,CAAA,CAAC,CAAA,MAAM,KAAG,GAAG,CAAA,CAAC,CAAA,cAAc,CAAA,CAAC,CAAA,uBAAuB,EAAC,CAAC,CAAC;QAAA,CAAC;QACvK,OAAO,IAAI,CAAC;IACd,CAAC;IACD,SAAS,MAAM,CAAC,MAAa;QAC3B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAC,KAAK,EAAC,GAAG,EAAC,MAAM,EAAC,IAAI,EAAC,EAAE;YAC1C,MAAM,GAAG,GAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAE,GAAG,EAAC,YAAY,CAAC,CAAC;YAC7C,IAAG,GAAG,CAAC,QAAQ,KAAG,eAAe,IAAE,GAAG,CAAC,MAAM,IAAE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAG,YAAY,EAAC,CAAC;gBAAA,MAAM,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;gBAAA,OAAO;YAAA,CAAC;YAC5J,MAAM,MAAM,GAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAE,EAAE,EAAC,UAAU,GAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9D,MAAM,YAAY,GAAC,UAAU,EAAE,CAAC;YAAA,IAAI,QAAQ,GAAC,KAAK,EAAC,QAAQ,GAAC,KAAK,CAAC;YAClE,MAAM,OAAO,GAAC,GAAE,EAAE,CAAA,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAE,EAAE,CAAA,SAAS,CAAC,CAAC;YACzF,IAAG,CAAC;gBACF,MAAM,OAAO,GAAC,MAAM,OAAO,CAAC,MAAM,CAAC,EAAC,QAAQ,GAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAChE,IAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAE,EAAE,IAAE,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAC,YAAY,CAAC,EAAC,CAAC;oBAAA,MAAM,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;oBAAA,OAAO;gBAAA,CAAC;gBACzK,QAAQ,GAAC,IAAI,CAAC;gBACd,wFAAwF;gBACxF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAC,GAAE,EAAE,GAAC,IAAG,CAAC,QAAQ;oBAAC,KAAK,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC;gBACxD,IAAG,MAAM,CAAC,SAAS,EAAC,CAAC;oBAAA,MAAM,OAAO,EAAE,CAAC;oBAAA,OAAO;gBAAA,CAAC;gBAC7C,OAAO,CAAC,aAAa,CAAC,GAAG,EAAC,MAAM,EAAC,IAAI,EAAC,EAAE,CAAA,EAAE;oBACxC,QAAQ,GAAC,IAAI,CAAC;oBACd,MAAM,UAAU,GAAC,UAAU,EAAE,EAAC,SAAS,GAAC,IAAI,GAAG,EAAqC,CAAC;oBAAA,IAAI,QAAQ,GAAC,KAAK,EAAC,SAAS,GAAC,KAAK,EAAC,IAAI,GAAC,KAAK,EAAC,MAAM,GAAC,CAAC,EAAC,KAAK,GAAC,IAAI,CAAC;oBACvJ,KAAK,UAAU,KAAK;wBAClB,IAAG,EAAE,CAAC,UAAU,KAAG,SAAS,CAAC,IAAI;4BAAC,OAAO,KAAK,CAAC;wBAC/C,MAAM,OAAO,GAAC,WAAW,CAAC,GAAG,EAAE,CAAC;wBAChC,IAAG,CAAC;4BACF,MAAM,QAAQ,GAAC,MAAM,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAC,YAAY,CAAC,CAAC;4BACrE,IAAG,CAAC,QAAQ,IAAE,WAAW,CAAC,GAAG,EAAE,GAAC,OAAO,IAAE,QAAQ,EAAC,CAAC;gCAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,YAAY,CAAC,CAAC;gCAAA,OAAO,KAAK,CAAC;4BAAA,CAAC;4BAC7F,OAAO,EAAE,CAAC,UAAU,KAAG,SAAS,CAAC,IAAI,CAAC;wBACxC,CAAC;wBAAA,MAAK,CAAC;4BAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,qBAAqB,CAAC,CAAC;4BAAA,OAAO,KAAK,CAAC;wBAAA,CAAC;oBAC5D,CAAC;oBACD,MAAM,IAAI,GAAC,KAAK,EAAC,KAAa,EAAC,EAAE,GAAC,IAAG,CAAC,MAAM,KAAK,EAAE;wBAAC,OAAO,CAAA,IAAG,EAAE,CAAC,cAAc,GAAC,KAAK,EAAC,CAAC;wBAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,cAAc,CAAC,CAAC;wBAAA,OAAO;oBAAA,CAAC,CAAA,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC;oBAC9J,MAAM,SAAS,GAAC,UAAU,CAAC,GAAE,EAAE,CAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,mBAAmB,CAAC,EAAC,IAAI,CAAC,CAAC;oBACxE,EAAE,CAAC,EAAE,CAAC,MAAM,EAAC,GAAE,EAAE,GAAC,KAAK,GAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC;oBAChC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAC,GAAE,EAAE,CAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,iBAAiB,CAAC,CAAC,CAAC;oBACpD,EAAE,CAAC,EAAE,CAAC,SAAS,EAAC,KAAK,EAAC,GAAG,EAAC,MAAM,EAAC,EAAE;wBACjC,IAAG,CAAC;4BACF,IAAG,MAAM,IAAE,QAAQ,IAAE,SAAS;gCAAC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;4BAChE,SAAS,GAAC,IAAI,CAAC;4BACf,MAAM,KAAK,GAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAA4D,CAAC;4BAClG,IAAG,KAAK,CAAC,CAAC,KAAG,CAAC,IAAE,KAAK,CAAC,IAAI,KAAG,WAAW,IAAE,OAAO,KAAK,CAAC,MAAM,KAAG,QAAQ,IAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAE,KAAK,CAAC,SAAS,CAAC,MAAM,GAAC,CAAC,IAAE,KAAK,CAAC,SAAS,CAAC,MAAM,GAAC,CAAC,IAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,OAAO,CAAC,KAAG,QAAQ,IAAE,CAAC,CAAC,MAAM,GAAC,EAAE,CAAC;gCAAC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;4BAC1P,IAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gCAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;4BAC/E,MAAM,KAAK,GAAC,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;4BACpD,IAAG,CAAC,KAAK,IAAE,KAAK,CAAC,OAAO,IAAE,IAAI,CAAC,GAAG,EAAE,IAAE,KAAK,CAAC,UAAU,KAAG,UAAU,IAAE,KAAK,CAAC,QAAQ,KAAG,QAAQ;gCAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;4BACjI,IAAG,SAAS,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,KAAG,QAAQ;gCAAC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;4BACpF,IAAG,EAAE,CAAC,UAAU,KAAG,SAAS,CAAC,IAAI;gCAAC,OAAO;4BACzC,KAAI,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAC,CAAC;gCAC1C,MAAM,IAAI,GAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAC,OAAO,CAAC,CAAC;gCACxC,IAAG,CAAC,IAAI,IAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAE,IAAI,GAAG,CAAC,IAAI,EAAC,GAAG,CAAC,CAAC,MAAM,KAAG,GAAG;oCAAC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;gCAClJ,SAAS,CAAC,GAAG,CAAC,IAAI,EAAC,EAAC,IAAI,EAAC,CAAC,CAAC;4BAC7B,CAAC;4BACD,QAAQ,GAAC,IAAI,CAAC;4BAAA,YAAY,CAAC,SAAS,CAAC,CAAC;4BAAA,MAAM,IAAI,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,IAAI,EAAC,OAAO,EAAC,UAAU,EAAC,cAAc,EAAC,QAAQ,EAAC,QAAQ,EAAC,UAAU,EAAC,CAAC,CAAC;4BAAA,KAAK,IAAI,EAAE,CAAC;wBAC1I,CAAC;wBAAA,MAAK,CAAC;4BAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,oBAAoB,CAAC,CAAC;wBAAA,CAAC;oBAC9C,CAAC,CAAC,CAAC;oBACH,KAAK,UAAU,IAAI;wBACjB,IAAG,CAAC,QAAQ,IAAE,IAAI,IAAE,EAAE,CAAC,UAAU,KAAG,SAAS,CAAC,IAAI;4BAAC,OAAO;wBAAA,IAAI,GAAC,IAAI,CAAC;wBACpE,IAAG,CAAC;4BACF,IAAG,CAAC,MAAM,KAAK,EAAE;gCAAC,OAAO;4BACzB,MAAM,OAAO,GAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;4BACpC,IAAG,SAAS,CAAC,OAAO,CAAC,KAAG,QAAQ,EAAC,CAAC;gCAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,mBAAmB,CAAC,CAAC;gCAAA,OAAO;4BAAA,CAAC;4BAC7E,KAAI,MAAK,CAAC,IAAI,EAAC,KAAK,CAAC,IAAG,SAAS,EAAC,CAAC;gCACjC,IAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAC,OAAO,CAAC,KAAG,KAAK,CAAC,IAAI,EAAC,CAAC;oCAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,kBAAkB,CAAC,CAAC;oCAAA,OAAO;gCAAA,CAAC;gCACxF,MAAM,MAAM,GAAC,MAAM,KAAK,CAAC,GAAG,GAAC,KAAK,CAAC,IAAI,EAAC,EAAC,OAAO,EAAC,EAAC,MAAM,EAAC,EAAC,QAAQ,EAAC,OAAO,EAAC,KAAK,EAAC,UAAU,EAAC,MAAM,EAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,CAAC,CAAC;gCAC/H,IAAG,MAAM,CAAC,MAAM,KAAG,GAAG,IAAE,MAAM,CAAC,MAAM,KAAG,GAAG,EAAC,CAAC;oCAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,kBAAkB,CAAC,CAAC;oCAAA,OAAO;gCAAA,CAAC;gCACvF,IAAG,CAAC,MAAM,CAAC,EAAE,IAAE,MAAM,CAAC,MAAM,KAAG,GAAG;oCAAC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gCAC3E,MAAM,IAAI,GAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gCAAA,IAAG,IAAI,CAAC,MAAM,GAAC,OAAO;oCAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;gCACxF,MAAM,IAAI,GAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAC,GAAG,GAAC,IAAI,CAAC,CAAC;gCAC1C,IAAG,KAAK,CAAC,IAAI,KAAG,IAAI,EAAC,CAAC;oCAAA,MAAM,EAAE,CAAC;oCAAA,MAAM,IAAI,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,IAAI,EAAC,YAAY,EAAC,OAAO,EAAC,UAAU,EAAE,EAAC,UAAU,EAAC,cAAc,EAAC,QAAQ,EAAC,QAAQ,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,CAAC,EAAC,CAAC,CAAC;oCAAA,KAAK,CAAC,IAAI,GAAC,IAAI,CAAC;gCAAA,CAAC;4BAClL,CAAC;wBACH,CAAC;wBAAA,OAAM,CAAC,EAAC,CAAC;4BAAA,IAAI,CAAsB,CAAC,MAAM,KAAG,GAAG;gCAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,gBAAgB,CAAC,CAAC;;gCAAK,MAAM,IAAI,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,IAAI,EAAC,iBAAiB,EAAC,UAAU,EAAC,cAAc,EAAC,QAAQ,EAAC,CAAC,CAAC;wBAAA,CAAC;gCAC7J,CAAC;4BAAA,IAAI,GAAC,KAAK,CAAC;wBAAA,CAAC;oBACtB,CAAC;oBACD,MAAM,OAAO,GAAC,WAAW,CAAC,GAAE,EAAE,CAAA,KAAK,IAAI,EAAE,EAAC,QAAQ,CAAC,EAAC,SAAS,GAAC,WAAW,CAAC,GAAE,EAAE,GAAC,IAAG,CAAC,KAAK,EAAC,CAAC;wBAAA,EAAE,CAAC,SAAS,EAAE,CAAC;wBAAA,OAAO;oBAAA,CAAC,CAAA,KAAK,GAAC,KAAK,CAAC,CAAA,EAAE,CAAC,IAAI,EAAE,CAAC,CAAA,CAAC,EAAC,KAAK,CAAC,CAAC;oBAChJ,EAAE,CAAC,EAAE,CAAC,OAAO,EAAC,GAAE,EAAE,GAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAA,aAAa,CAAC,OAAO,CAAC,CAAC,CAAA,aAAa,CAAC,SAAS,CAAC,CAAC,CAAA,KAAK,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC;gBAC/G,CAAC,CAAC,CAAC;YACL,CAAC;YAAA,OAAM,CAAC,EAAC,CAAC;gBAAA,IAAG,QAAQ;oBAAC,MAAM,OAAO,EAAE,CAAC;gBAAA,MAAM,CAAC,GAAG,CAAC,WAAW,GAAC,CAAE,CAAsB,CAAC,MAAM,KAAG,GAAG,CAAA,CAAC,CAAA,kBAAkB,CAAA,CAAC,CAAA,yBAAyB,CAAC,GAAC,+BAA+B,CAAC,CAAC;YAAA,CAAC;QACrL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,SAAS,KAAK,KAAG,KAAI,MAAM,EAAE,IAAI,OAAO,CAAC,OAAO;QAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAA,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA,CAAC;IACjG,OAAO,EAAC,UAAU,EAAC,MAAM,EAAC,KAAK,EAAC,CAAC;AACnC,CAAC"}

package/dist/index.d.ts

@@ -1,60 +1 @@
-import type { IncomingMessage, ServerResponse, Server } from 'node:http';
-import { type ConnectionBudget } from './connection-budget.js';
-export type { ConnectionBudget } from './connection-budget.js';
-export type SocketContext = {
-    subject: string;
-    tenant: string | null;
-    roles: string[];
-    csrf: string;
-};
-export type AdmissionTicket = {
-    cookieHash: string;
-    revision: string;
-    expires: number;
-};
-/**
- * consume must be atomic across all presentation replicas. `security` describes the vault behind a store that
- * keeps its tickets in one, as `createVaultTicketStore` of the Security BFF's session store sets it. The
- * production profile refuses a shared store that does not declare it, all three flags, because a store that
- * says nothing cannot be shown to be reached over TLS and with authentication.
- */
-export type AdmissionTicketStore = {
-    readonly shared?: boolean;
-    readonly security?: Readonly<{
-        durable: boolean;
-        tls: boolean;
-        authenticated: boolean;
-    }>;
-    issue: (id: string, ticket: AdmissionTicket) => Promise<void>;
-    consume: (id: string) => Promise<AdmissionTicket | undefined>;
-};
-type CommonSocketConfig = {
-    publicOrigin: string;
-    bffOrigin: string;
-    resolve: (resource: string, context: SocketContext) => string | undefined;
-    pollMs?: number;
-};
-/** Today's single-process development profile, refused when NODE_ENV is production. */
-export type DevelopmentSocketConfig = CommonSocketConfig & {
-    development: true;
-    production?: never;
-    ticketStore?: AdmissionTicketStore;
-    connectionBudget?: ConnectionBudget;
-};
-/** Shared, durable admission across replicas; no process-memory default exists in this profile. */
-export type PresentationProductionProfile = Readonly<{
-    ticketStore: AdmissionTicketStore;
-    connectionBudget: ConnectionBudget;
-}>;
-export type ProductionSocketConfig = CommonSocketConfig & {
-    production: PresentationProductionProfile;
-    development?: never;
-};
-export type SocketConfig = DevelopmentSocketConfig | ProductionSocketConfig;
-/** The unmet conditions of a production configuration; empty when it may start. */
-export declare function presentationProductionRefusals(config: ProductionSocketConfig): string[];
-export declare function createPresentationRealtime(config: SocketConfig): {
-    handleHttp: (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
-    attach: (server: Server) => void;
-    close: () => void;
-};
+export { type AdmissionTicket, type AdmissionTicketStore, type ConnectionBudget, createPresentationRealtime, type DevelopmentSocketConfig, type PresentationProductionProfile, type ProductionSocketConfig, type SocketConfig, } from './core.js';

package/dist/index.js

@@ -1,250 +1,2 @@
-import { createHash, randomBytes, randomUUID } from 'node:crypto';
-import { WebSocketServer, WebSocket } from 'ws';
-import { createMemoryConnectionBudget } from './connection-budget.js';
-/** The unmet conditions of a production configuration; empty when it may start. */
-export function presentationProductionRefusals(config) {
-    const refusals = [];
-    let https = false;
-    try {
-        https = new URL(config.publicOrigin).protocol === 'https:';
-    }
-    catch {
-        https = false;
-    }
-    if (!https)
-        refusals.push('HTTPS_PUBLIC_ORIGIN_REQUIRED');
-    if (config.production?.ticketStore?.shared !== true)
-        refusals.push('SHARED_TICKET_STORE_REQUIRED');
-    // A store that every replica shares is reached over a network, so it must say how: one that declares nothing is
-    // refused, as the Security BFF refuses a session vault that declares nothing, instead of passing for lack of a claim.
-    const declared = (security) => typeof security?.durable === 'boolean' && typeof security.tls === 'boolean' && typeof security.authenticated === 'boolean';
-    if (config.production?.ticketStore?.shared === true && !declared(config.production.ticketStore.security))
-        refusals.push('TICKET_STORE_SECURITY_REQUIRED');
-    // Tickets in a durable vault travel and rest under the vault's own protection, which must be TLS and authentication.
-    const vault = config.production?.ticketStore?.security;
-    if (vault?.durable && vault.tls !== true)
-        refusals.push('TICKET_STORE_TLS_REQUIRED');
-    if (vault?.durable && vault.authenticated !== true)
-        refusals.push('TICKET_STORE_AUTHENTICATION_REQUIRED');
-    if (config.production?.connectionBudget?.shared !== true)
-        refusals.push('SHARED_CONNECTION_BUDGET_REQUIRED');
-    return refusals;
-}
-const digest = (value) => createHash('sha256').update(value).digest('base64url');
-const authority = (c) => digest(JSON.stringify([c.subject, c.tenant, [...c.roles].sort()]));
-function checkedOrigin(value) { const url = new URL(value); if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.pathname !== '/' || url.search || url.hash)
-    throw new Error('INVALID_ORIGIN'); return url.origin; }
-function json(res, status, value) { res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff' }); res.end(JSON.stringify(value)); }
-export function createPresentationRealtime(config) {
-    const production = 'production' in config && config.production !== undefined ? config.production : undefined;
-    if (production) {
-        const refusals = presentationProductionRefusals(config);
-        if (refusals.length)
-            throw new Error('PRODUCTION_PROFILE_REFUSED:' + refusals.join(','));
-    }
-    else if (config.development !== true || process.env.NODE_ENV === 'production')
-        throw new Error('DURABLE_REALTIME_PROFILE_REQUIRED');
-    const development = production ? undefined : config;
-    const publicOrigin = checkedOrigin(config.publicOrigin), bff = checkedOrigin(config.bffOrigin);
-    const interval = Math.max(3000, config.pollMs ?? 3000), tickets = new Map();
-    const connectionBudget = production ? production.connectionBudget : development?.connectionBudget ?? createMemoryConnectionBudget();
-    const ticketStore = production ? production.ticketStore : development?.ticketStore ?? {
-        async issue(id, ticket) {
-            for (const [key, value] of tickets)
-                if (value.expires <= Date.now())
-                    tickets.delete(key);
-            if (tickets.size >= 256)
-                throw Object.assign(new Error('TICKET_LIMIT'), { status: 429 });
-            tickets.set(id, ticket);
-        },
-        async consume(id) { const ticket = tickets.get(id); tickets.delete(id); return ticket; }
-    };
-    const sockets = new WebSocketServer({ noServer: true, maxPayload: 4096, perMessageDeflate: false });
-    async function context(cookie) {
-        const response = await fetch(bff + '/context', { headers: { cookie }, redirect: 'error', signal: AbortSignal.timeout(8000), cache: 'no-store' });
-        if (response.status === 401 || response.status === 403)
-            throw Object.assign(new Error('LOGIN_REQUIRED'), { status: 401 });
-        if (!response.ok)
-            throw new Error('AUTHORITY_UNAVAILABLE');
-        const c = await response.json();
-        if (typeof c.subject !== 'string' || typeof c.csrf !== 'string' || !Array.isArray(c.roles) || !c.roles.every(v => typeof v === 'string') || (c.tenant !== null && typeof c.tenant !== 'string'))
-            throw new Error('INVALID_CONTEXT');
-        return c;
-    }
-    async function handleHttp(req, res) {
-        if (new URL(req.url ?? '/', publicOrigin).pathname !== '/api/realtime/ticket')
-            return false;
-        try {
-            if (req.method !== 'POST') {
-                json(res, 405, { title: 'POST_REQUIRED' });
-                return true;
-            }
-            if (req.headers.origin !== publicOrigin) {
-                json(res, 403, { title: 'ORIGIN_REJECTED' });
-                return true;
-            }
-            const cookie = req.headers.cookie ?? '', c = await context(cookie);
-            if (typeof req.headers['x-csrf-token'] !== 'string' || req.headers['x-csrf-token'] !== c.csrf) {
-                json(res, 403, { title: 'CSRF_REJECTED' });
-                return true;
-            }
-            const ticket = randomBytes(32).toString('base64url');
-            await ticketStore.issue(ticket, { cookieHash: digest(cookie), revision: authority(c), expires: Date.now() + 20000 });
-            json(res, 200, { ticket, expiresIn: 20 });
-        }
-        catch (e) {
-            const status = e.status ?? 503;
-            json(res, status, { title: status === 401 ? 'LOGIN_REQUIRED' : status === 429 ? 'TICKET_LIMIT' : 'AUTHORITY_UNAVAILABLE' });
-        }
-        return true;
-    }
-    function attach(server) {
-        server.on('upgrade', async (req, socket, head) => {
-            const url = new URL(req.url ?? '/', publicOrigin);
-            if (url.pathname !== '/api/realtime' || url.search || req.headers.origin !== publicOrigin) {
-                socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
-                return;
-            }
-            const cookie = req.headers.cookie ?? '', cookieHash = digest(cookie);
-            const connectionId = randomUUID();
-            let reserved = false, upgraded = false;
-            const release = () => connectionBudget.release(cookieHash, connectionId).catch(() => undefined);
-            try {
-                const initial = await context(cookie), revision = authority(initial);
-                if (sockets.clients.size >= 32 || !await connectionBudget.reserve(cookieHash, connectionId)) {
-                    socket.end('HTTP/1.1 429 Too Many Requests\r\nConnection: close\r\n\r\n');
-                    return;
-                }
-                reserved = true;
-                // Includes rejected WebSocket handshakes and clients which disconnect during admission.
-                socket.once('close', () => { if (!upgraded)
-                    void release(); });
-                if (socket.destroyed) {
-                    await release();
-                    return;
-                }
-                sockets.handleUpgrade(req, socket, head, ws => {
-                    upgraded = true;
-                    const contextRef = randomUUID(), resources = new Map();
-                    let admitted = false, admitting = false, busy = false, cursor = 0, alive = true;
-                    async function lease() {
-                        if (ws.readyState !== WebSocket.OPEN)
-                            return false;
-                        const started = performance.now();
-                        try {
-                            const duration = await connectionBudget.renew(cookieHash, connectionId);
-                            if (!duration || performance.now() - started >= duration) {
-                                ws.close(4004, 'LEASE_LOST');
-                                return false;
-                            }
-                            return ws.readyState === WebSocket.OPEN;
-                        }
-                        catch {
-                            ws.close(1013, 'RUNTIME_UNAVAILABLE');
-                            return false;
-                        }
-                    }
-                    const send = async (frame) => { if (!await lease())
-                        return; if (ws.bufferedAmount > 65536) {
-                        ws.close(4008, 'BACKPRESSURE');
-                        return;
-                    } ws.send(JSON.stringify(frame)); };
-                    const admission = setTimeout(() => ws.close(4001, 'ADMISSION_TIMEOUT'), 5000);
-                    ws.on('pong', () => { alive = true; });
-                    ws.on('error', () => ws.close(1011, 'TRANSPORT_ERROR'));
-                    ws.on('message', async (raw, binary) => {
-                        try {
-                            if (binary || admitted || admitting)
-                                throw new Error('INVALID_FRAME');
-                            admitting = true;
-                            const frame = JSON.parse(raw.toString());
-                            if (frame.v !== 1 || frame.type !== 'subscribe' || typeof frame.ticket !== 'string' || !Array.isArray(frame.resources) || frame.resources.length < 1 || frame.resources.length > 6 || frame.resources.some(v => typeof v !== 'string' || v.length > 80))
-                                throw new Error('INVALID_FRAME');
-                            if (!/^[-_a-zA-Z0-9]{43}$/.test(frame.ticket))
-                                throw new Error('INVALID_TICKET');
-                            const saved = await ticketStore.consume(frame.ticket);
-                            if (!saved || saved.expires <= Date.now() || saved.cookieHash !== cookieHash || saved.revision !== revision)
-                                throw new Error('INVALID_TICKET');
-                            if (authority(await context(cookie)) !== revision)
-                                throw new Error('AUTHORITY_CHANGED');
-                            if (ws.readyState !== WebSocket.OPEN)
-                                return;
-                            for (const name of new Set(frame.resources)) {
-                                const path = config.resolve(name, initial);
-                                if (!path || !path.startsWith('/v1/') || path.includes('..') || path.includes('#') || new URL(path, bff).origin !== bff)
-                                    throw new Error('FORBIDDEN_RESOURCE');
-                                resources.set(name, { path });
-                            }
-                            admitted = true;
-                            clearTimeout(admission);
-                            await send({ v: 1, type: 'ready', contextRef, accessRevision: revision, recovery: 'snapshot' });
-                            void tick();
-                        }
-                        catch {
-                            ws.close(4003, 'ADMISSION_REJECTED');
-                        }
-                    });
-                    async function tick() {
-                        if (!admitted || busy || ws.readyState !== WebSocket.OPEN)
-                            return;
-                        busy = true;
-                        try {
-                            if (!await lease())
-                                return;
-                            const current = await context(cookie);
-                            if (authority(current) !== revision) {
-                                ws.close(4003, 'AUTHORITY_CHANGED');
-                                return;
-                            }
-                            for (const [name, value] of resources) {
-                                if (config.resolve(name, current) !== value.path) {
-                                    ws.close(4003, 'RESOURCE_REVOKED');
-                                    return;
-                                }
-                                const result = await fetch(bff + value.path, { headers: { cookie }, redirect: 'error', cache: 'no-store', signal: AbortSignal.timeout(8000) });
-                                if (result.status === 401 || result.status === 403) {
-                                    ws.close(4003, 'RESOURCE_REVOKED');
-                                    return;
-                                }
-                                if (!result.ok && result.status !== 404)
-                                    throw new Error('SNAPSHOT_UNAVAILABLE');
-                                const text = await result.text();
-                                if (text.length > 1048576)
-                                    throw new Error('SNAPSHOT_LIMIT');
-                                const hash = digest(result.status + ':' + text);
-                                if (value.hash !== hash) {
-                                    cursor++;
-                                    await send({ v: 1, type: 'invalidate', eventId: randomUUID(), contextRef, accessRevision: revision, resource: name, cursor: String(cursor) });
-                                    value.hash = hash;
-                                }
-                            }
-                        }
-                        catch (e) {
-                            if (e.status === 401)
-                                ws.close(4003, 'LOGIN_REQUIRED');
-                            else
-                                await send({ v: 1, type: 'resync-required', contextRef, accessRevision: revision });
-                        }
-                        finally {
-                            busy = false;
-                        }
-                    }
-                    const polling = setInterval(() => void tick(), interval), heartbeat = setInterval(() => { if (!alive) {
-                        ws.terminate();
-                        return;
-                    } alive = false; ws.ping(); }, 30000);
-                    ws.on('close', () => { clearTimeout(admission); clearInterval(polling); clearInterval(heartbeat); void release(); });
-                });
-            }
-            catch (e) {
-                if (reserved)
-                    await release();
-                socket.end('HTTP/1.1 ' + (e.status === 401 ? '401 Unauthorized' : '503 Service Unavailable') + '\r\nConnection: close\r\n\r\n');
-            }
-        });
-    }
-    function close() { for (const ws of sockets.clients)
-        ws.terminate(); sockets.close(); tickets.clear(); }
-    return { handleHttp, attach, close };
-}
+export { createPresentationRealtime, } from './core.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,UAAU,EAAC,WAAW,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AAE9D,OAAO,EAAC,eAAe,EAAC,SAAS,EAAC,MAAM,IAAI,CAAC;AAC7C,OAAO,EAAC,4BAA4B,EAAuB,MAAM,wBAAwB,CAAC;AAmB1F,mFAAmF;AACnF,MAAM,UAAU,8BAA8B,CAAC,MAA6B;IAC1E,MAAM,QAAQ,GAAU,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAC,KAAK,CAAC;IAAA,IAAG,CAAC;QAAA,KAAK,GAAC,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,KAAG,QAAQ,CAAC;IAAA,CAAC;IAAA,MAAK,CAAC;QAAA,KAAK,GAAC,KAAK,CAAC;IAAA,CAAC;IAC/F,IAAG,CAAC,KAAK;QAAC,QAAQ,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACxD,IAAG,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,KAAG,IAAI;QAAC,QAAQ,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC/F,gHAAgH;IAChH,sHAAsH;IACtH,MAAM,QAAQ,GAAC,CAAC,QAAyC,EAAC,EAAE,CAAA,OAAO,QAAQ,EAAE,OAAO,KAAG,SAAS,IAAE,OAAO,QAAQ,CAAC,GAAG,KAAG,SAAS,IAAE,OAAO,QAAQ,CAAC,aAAa,KAAG,SAAS,CAAC;IAC7K,IAAG,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,KAAG,IAAI,IAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACpJ,qHAAqH;IACrH,MAAM,KAAK,GAAC,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC;IACrD,IAAG,KAAK,EAAE,OAAO,IAAE,KAAK,CAAC,GAAG,KAAG,IAAI;QAAC,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC/E,IAAG,KAAK,EAAE,OAAO,IAAE,KAAK,CAAC,aAAa,KAAG,IAAI;QAAC,QAAQ,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACpG,IAAG,MAAM,CAAC,UAAU,EAAE,gBAAgB,EAAE,MAAM,KAAG,IAAI;QAAC,QAAQ,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACzG,OAAO,QAAQ,CAAC;AAClB,CAAC;AACD,MAAM,MAAM,GAAC,CAAC,KAAY,EAAC,EAAE,CAAA,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACpF,MAAM,SAAS,GAAC,CAAC,CAAe,EAAC,EAAE,CAAA,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,EAAC,CAAC,CAAC,MAAM,EAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACpG,SAAS,aAAa,CAAC,KAAY,IAAE,MAAM,GAAG,GAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA,IAAG,CAAC,CAAC,OAAO,EAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAE,GAAG,CAAC,QAAQ,IAAE,GAAG,CAAC,QAAQ,IAAE,GAAG,CAAC,QAAQ,KAAG,GAAG,IAAE,GAAG,CAAC,MAAM,IAAE,GAAG,CAAC,IAAI;IAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAA,OAAO,GAAG,CAAC,MAAM,CAAC,CAAA,CAAC;AACvO,SAAS,IAAI,CAAC,GAAkB,EAAC,MAAa,EAAC,KAAa,IAAE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAC,EAAC,cAAc,EAAC,kBAAkB,EAAC,eAAe,EAAC,UAAU,EAAC,wBAAwB,EAAC,SAAS,EAAC,CAAC,CAAC,CAAA,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA,CAAC;AAEtN,MAAM,UAAU,0BAA0B,CAAC,MAAmB;IAC5D,MAAM,UAAU,GAAC,YAAY,IAAI,MAAM,IAAE,MAAM,CAAC,UAAU,KAAG,SAAS,CAAA,CAAC,CAAA,MAAM,CAAC,UAAU,CAAA,CAAC,CAAA,SAAS,CAAC;IACnG,IAAG,UAAU,EAAC,CAAC;QACb,MAAM,QAAQ,GAAC,8BAA8B,CAAC,MAAgC,CAAC,CAAC;QAChF,IAAG,QAAQ,CAAC,MAAM;YAAC,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvF,CAAC;SAAK,IAAI,MAAkC,CAAC,WAAW,KAAG,IAAI,IAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAG,YAAY;QAAC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC1J,MAAM,WAAW,GAAC,UAAU,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,MAAiC,CAAC;IACzE,MAAM,YAAY,GAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,EAAC,GAAG,GAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAC,MAAM,CAAC,MAAM,IAAE,IAAI,CAAC,EAAC,OAAO,GAAC,IAAI,GAAG,EAA0B,CAAC;IAC5F,MAAM,gBAAgB,GAAC,UAAU,CAAA,CAAC,CAAA,UAAU,CAAC,gBAAgB,CAAA,CAAC,CAAA,WAAW,EAAE,gBAAgB,IAAE,4BAA4B,EAAE,CAAC;IAC5H,MAAM,WAAW,GAAC,UAAU,CAAA,CAAC,CAAA,UAAU,CAAC,WAAW,CAAA,CAAC,CAAA,WAAW,EAAE,WAAW,IAAE;QAC5E,KAAK,CAAC,KAAK,CAAC,EAAS,EAAC,MAAsB;YAC1C,KAAI,MAAK,CAAC,GAAG,EAAC,KAAK,CAAC,IAAG,OAAO;gBAAC,IAAG,KAAK,CAAC,OAAO,IAAE,IAAI,CAAC,GAAG,EAAE;oBAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChF,IAAG,OAAO,CAAC,IAAI,IAAE,GAAG;gBAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,EAAC,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC,CAAC;YACjF,OAAO,CAAC,GAAG,CAAC,EAAE,EAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,EAAS,IAAE,MAAM,MAAM,GAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA,OAAO,MAAM,CAAC,CAAA,CAAC;KACzF,CAAC;IACF,MAAM,OAAO,GAAC,IAAI,eAAe,CAAC,EAAC,QAAQ,EAAC,IAAI,EAAC,UAAU,EAAC,IAAI,EAAC,iBAAiB,EAAC,KAAK,EAAC,CAAC,CAAC;IAC3F,KAAK,UAAU,OAAO,CAAC,MAAa;QAClC,MAAM,QAAQ,GAAC,MAAM,KAAK,CAAC,GAAG,GAAC,UAAU,EAAC,EAAC,OAAO,EAAC,EAAC,MAAM,EAAC,EAAC,QAAQ,EAAC,OAAO,EAAC,MAAM,EAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,KAAK,EAAC,UAAU,EAAC,CAAC,CAAC;QACjI,IAAG,QAAQ,CAAC,MAAM,KAAG,GAAG,IAAE,QAAQ,CAAC,MAAM,KAAG,GAAG;YAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,EAAC,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC,CAAC;QAC9G,IAAG,CAAC,QAAQ,CAAC,EAAE;YAAC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACzD,MAAM,CAAC,GAAC,MAAM,QAAQ,CAAC,IAAI,EAAmB,CAAC;QAC/C,IAAG,OAAO,CAAC,CAAC,OAAO,KAAG,QAAQ,IAAE,OAAO,CAAC,CAAC,IAAI,KAAG,QAAQ,IAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA,EAAE,CAAA,OAAO,CAAC,KAAG,QAAQ,CAAC,IAAE,CAAC,CAAC,CAAC,MAAM,KAAG,IAAI,IAAE,OAAO,CAAC,CAAC,MAAM,KAAG,QAAQ,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC5M,OAAO,CAAC,CAAC;IACX,CAAC;IACD,KAAK,UAAU,UAAU,CAAC,GAAmB,EAAC,GAAkB;QAC9D,IAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAE,GAAG,EAAC,YAAY,CAAC,CAAC,QAAQ,KAAG,sBAAsB;YAAC,OAAO,KAAK,CAAC;QACrF,IAAG,CAAC;YACF,IAAG,GAAG,CAAC,MAAM,KAAG,MAAM,EAAC,CAAC;gBAAA,IAAI,CAAC,GAAG,EAAC,GAAG,EAAC,EAAC,KAAK,EAAC,eAAe,EAAC,CAAC,CAAC;gBAAA,OAAO,IAAI,CAAC;YAAA,CAAC;YAC3E,IAAG,GAAG,CAAC,OAAO,CAAC,MAAM,KAAG,YAAY,EAAC,CAAC;gBAAA,IAAI,CAAC,GAAG,EAAC,GAAG,EAAC,EAAC,KAAK,EAAC,iBAAiB,EAAC,CAAC,CAAC;gBAAA,OAAO,IAAI,CAAC;YAAA,CAAC;YAC3F,MAAM,MAAM,GAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAE,EAAE,EAAC,CAAC,GAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5D,IAAG,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,KAAG,QAAQ,IAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,KAAG,CAAC,CAAC,IAAI,EAAC,CAAC;gBAAA,IAAI,CAAC,GAAG,EAAC,GAAG,EAAC,EAAC,KAAK,EAAC,eAAe,EAAC,CAAC,CAAC;gBAAA,OAAO,IAAI,CAAC;YAAA,CAAC;YAC3I,MAAM,MAAM,GAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACnD,MAAM,WAAW,CAAC,KAAK,CAAC,MAAM,EAAC,EAAC,UAAU,EAAC,MAAM,CAAC,MAAM,CAAC,EAAC,QAAQ,EAAC,SAAS,CAAC,CAAC,CAAC,EAAC,OAAO,EAAC,IAAI,CAAC,GAAG,EAAE,GAAC,KAAK,EAAC,CAAC,CAAC;YAC3G,IAAI,CAAC,GAAG,EAAC,GAAG,EAAC,EAAC,MAAM,EAAC,SAAS,EAAC,EAAE,EAAC,CAAC,CAAC;QACtC,CAAC;QAAA,OAAM,CAAC,EAAC,CAAC;YAAA,MAAM,MAAM,GAAE,CAAsB,CAAC,MAAM,IAAE,GAAG,CAAC;YAAA,IAAI,CAAC,GAAG,EAAC,MAAM,EAAC,EAAC,KAAK,EAAC,MAAM,KAAG,GAAG,CAAA,CAAC,CAAA,gBAAgB,CAAA,CAAC,CAAA,MAAM,KAAG,GAAG,CAAA,CAAC,CAAA,cAAc,CAAA,CAAC,CAAA,uBAAuB,EAAC,CAAC,CAAC;QAAA,CAAC;QACvK,OAAO,IAAI,CAAC;IACd,CAAC;IACD,SAAS,MAAM,CAAC,MAAa;QAC3B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAC,KAAK,EAAC,GAAG,EAAC,MAAM,EAAC,IAAI,EAAC,EAAE;YAC1C,MAAM,GAAG,GAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAE,GAAG,EAAC,YAAY,CAAC,CAAC;YAC7C,IAAG,GAAG,CAAC,QAAQ,KAAG,eAAe,IAAE,GAAG,CAAC,MAAM,IAAE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAG,YAAY,EAAC,CAAC;gBAAA,MAAM,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;gBAAA,OAAO;YAAA,CAAC;YAC5J,MAAM,MAAM,GAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAE,EAAE,EAAC,UAAU,GAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9D,MAAM,YAAY,GAAC,UAAU,EAAE,CAAC;YAAA,IAAI,QAAQ,GAAC,KAAK,EAAC,QAAQ,GAAC,KAAK,CAAC;YAClE,MAAM,OAAO,GAAC,GAAE,EAAE,CAAA,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAE,EAAE,CAAA,SAAS,CAAC,CAAC;YACzF,IAAG,CAAC;gBACF,MAAM,OAAO,GAAC,MAAM,OAAO,CAAC,MAAM,CAAC,EAAC,QAAQ,GAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAChE,IAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAE,EAAE,IAAE,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAC,YAAY,CAAC,EAAC,CAAC;oBAAA,MAAM,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;oBAAA,OAAO;gBAAA,CAAC;gBACzK,QAAQ,GAAC,IAAI,CAAC;gBACd,wFAAwF;gBACxF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAC,GAAE,EAAE,GAAC,IAAG,CAAC,QAAQ;oBAAC,KAAK,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC;gBACxD,IAAG,MAAM,CAAC,SAAS,EAAC,CAAC;oBAAA,MAAM,OAAO,EAAE,CAAC;oBAAA,OAAO;gBAAA,CAAC;gBAC7C,OAAO,CAAC,aAAa,CAAC,GAAG,EAAC,MAAM,EAAC,IAAI,EAAC,EAAE,CAAA,EAAE;oBACxC,QAAQ,GAAC,IAAI,CAAC;oBACd,MAAM,UAAU,GAAC,UAAU,EAAE,EAAC,SAAS,GAAC,IAAI,GAAG,EAAqC,CAAC;oBAAA,IAAI,QAAQ,GAAC,KAAK,EAAC,SAAS,GAAC,KAAK,EAAC,IAAI,GAAC,KAAK,EAAC,MAAM,GAAC,CAAC,EAAC,KAAK,GAAC,IAAI,CAAC;oBACvJ,KAAK,UAAU,KAAK;wBAClB,IAAG,EAAE,CAAC,UAAU,KAAG,SAAS,CAAC,IAAI;4BAAC,OAAO,KAAK,CAAC;wBAC/C,MAAM,OAAO,GAAC,WAAW,CAAC,GAAG,EAAE,CAAC;wBAChC,IAAG,CAAC;4BACF,MAAM,QAAQ,GAAC,MAAM,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAC,YAAY,CAAC,CAAC;4BACrE,IAAG,CAAC,QAAQ,IAAE,WAAW,CAAC,GAAG,EAAE,GAAC,OAAO,IAAE,QAAQ,EAAC,CAAC;gCAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,YAAY,CAAC,CAAC;gCAAA,OAAO,KAAK,CAAC;4BAAA,CAAC;4BAC7F,OAAO,EAAE,CAAC,UAAU,KAAG,SAAS,CAAC,IAAI,CAAC;wBACxC,CAAC;wBAAA,MAAK,CAAC;4BAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,qBAAqB,CAAC,CAAC;4BAAA,OAAO,KAAK,CAAC;wBAAA,CAAC;oBAC5D,CAAC;oBACD,MAAM,IAAI,GAAC,KAAK,EAAC,KAAa,EAAC,EAAE,GAAC,IAAG,CAAC,MAAM,KAAK,EAAE;wBAAC,OAAO,CAAA,IAAG,EAAE,CAAC,cAAc,GAAC,KAAK,EAAC,CAAC;wBAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,cAAc,CAAC,CAAC;wBAAA,OAAO;oBAAA,CAAC,CAAA,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC;oBAC9J,MAAM,SAAS,GAAC,UAAU,CAAC,GAAE,EAAE,CAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,mBAAmB,CAAC,EAAC,IAAI,CAAC,CAAC;oBACxE,EAAE,CAAC,EAAE,CAAC,MAAM,EAAC,GAAE,EAAE,GAAC,KAAK,GAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC;oBAChC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAC,GAAE,EAAE,CAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,iBAAiB,CAAC,CAAC,CAAC;oBACpD,EAAE,CAAC,EAAE,CAAC,SAAS,EAAC,KAAK,EAAC,GAAG,EAAC,MAAM,EAAC,EAAE;wBACjC,IAAG,CAAC;4BACF,IAAG,MAAM,IAAE,QAAQ,IAAE,SAAS;gCAAC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;4BAChE,SAAS,GAAC,IAAI,CAAC;4BACf,MAAM,KAAK,GAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAA4D,CAAC;4BAClG,IAAG,KAAK,CAAC,CAAC,KAAG,CAAC,IAAE,KAAK,CAAC,IAAI,KAAG,WAAW,IAAE,OAAO,KAAK,CAAC,MAAM,KAAG,QAAQ,IAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAE,KAAK,CAAC,SAAS,CAAC,MAAM,GAAC,CAAC,IAAE,KAAK,CAAC,SAAS,CAAC,MAAM,GAAC,CAAC,IAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,OAAO,CAAC,KAAG,QAAQ,IAAE,CAAC,CAAC,MAAM,GAAC,EAAE,CAAC;gCAAC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;4BAC1P,IAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gCAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;4BAC/E,MAAM,KAAK,GAAC,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;4BACpD,IAAG,CAAC,KAAK,IAAE,KAAK,CAAC,OAAO,IAAE,IAAI,CAAC,GAAG,EAAE,IAAE,KAAK,CAAC,UAAU,KAAG,UAAU,IAAE,KAAK,CAAC,QAAQ,KAAG,QAAQ;gCAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;4BACjI,IAAG,SAAS,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,KAAG,QAAQ;gCAAC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;4BACpF,IAAG,EAAE,CAAC,UAAU,KAAG,SAAS,CAAC,IAAI;gCAAC,OAAO;4BACzC,KAAI,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAC,CAAC;gCAC1C,MAAM,IAAI,GAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAC,OAAO,CAAC,CAAC;gCACxC,IAAG,CAAC,IAAI,IAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAE,IAAI,GAAG,CAAC,IAAI,EAAC,GAAG,CAAC,CAAC,MAAM,KAAG,GAAG;oCAAC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;gCAClJ,SAAS,CAAC,GAAG,CAAC,IAAI,EAAC,EAAC,IAAI,EAAC,CAAC,CAAC;4BAC7B,CAAC;4BACD,QAAQ,GAAC,IAAI,CAAC;4BAAA,YAAY,CAAC,SAAS,CAAC,CAAC;4BAAA,MAAM,IAAI,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,IAAI,EAAC,OAAO,EAAC,UAAU,EAAC,cAAc,EAAC,QAAQ,EAAC,QAAQ,EAAC,UAAU,EAAC,CAAC,CAAC;4BAAA,KAAK,IAAI,EAAE,CAAC;wBAC1I,CAAC;wBAAA,MAAK,CAAC;4BAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,oBAAoB,CAAC,CAAC;wBAAA,CAAC;oBAC9C,CAAC,CAAC,CAAC;oBACH,KAAK,UAAU,IAAI;wBACjB,IAAG,CAAC,QAAQ,IAAE,IAAI,IAAE,EAAE,CAAC,UAAU,KAAG,SAAS,CAAC,IAAI;4BAAC,OAAO;wBAAA,IAAI,GAAC,IAAI,CAAC;wBACpE,IAAG,CAAC;4BACF,IAAG,CAAC,MAAM,KAAK,EAAE;gCAAC,OAAO;4BACzB,MAAM,OAAO,GAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;4BACpC,IAAG,SAAS,CAAC,OAAO,CAAC,KAAG,QAAQ,EAAC,CAAC;gCAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,mBAAmB,CAAC,CAAC;gCAAA,OAAO;4BAAA,CAAC;4BAC7E,KAAI,MAAK,CAAC,IAAI,EAAC,KAAK,CAAC,IAAG,SAAS,EAAC,CAAC;gCACjC,IAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAC,OAAO,CAAC,KAAG,KAAK,CAAC,IAAI,EAAC,CAAC;oCAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,kBAAkB,CAAC,CAAC;oCAAA,OAAO;gCAAA,CAAC;gCACxF,MAAM,MAAM,GAAC,MAAM,KAAK,CAAC,GAAG,GAAC,KAAK,CAAC,IAAI,EAAC,EAAC,OAAO,EAAC,EAAC,MAAM,EAAC,EAAC,QAAQ,EAAC,OAAO,EAAC,KAAK,EAAC,UAAU,EAAC,MAAM,EAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,CAAC,CAAC;gCAC/H,IAAG,MAAM,CAAC,MAAM,KAAG,GAAG,IAAE,MAAM,CAAC,MAAM,KAAG,GAAG,EAAC,CAAC;oCAAA,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,kBAAkB,CAAC,CAAC;oCAAA,OAAO;gCAAA,CAAC;gCACvF,IAAG,CAAC,MAAM,CAAC,EAAE,IAAE,MAAM,CAAC,MAAM,KAAG,GAAG;oCAAC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gCAC3E,MAAM,IAAI,GAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gCAAA,IAAG,IAAI,CAAC,MAAM,GAAC,OAAO;oCAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;gCACxF,MAAM,IAAI,GAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAC,GAAG,GAAC,IAAI,CAAC,CAAC;gCAC1C,IAAG,KAAK,CAAC,IAAI,KAAG,IAAI,EAAC,CAAC;oCAAA,MAAM,EAAE,CAAC;oCAAA,MAAM,IAAI,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,IAAI,EAAC,YAAY,EAAC,OAAO,EAAC,UAAU,EAAE,EAAC,UAAU,EAAC,cAAc,EAAC,QAAQ,EAAC,QAAQ,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,CAAC,EAAC,CAAC,CAAC;oCAAA,KAAK,CAAC,IAAI,GAAC,IAAI,CAAC;gCAAA,CAAC;4BAClL,CAAC;wBACH,CAAC;wBAAA,OAAM,CAAC,EAAC,CAAC;4BAAA,IAAI,CAAsB,CAAC,MAAM,KAAG,GAAG;gCAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAC,gBAAgB,CAAC,CAAC;;gCAAK,MAAM,IAAI,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,IAAI,EAAC,iBAAiB,EAAC,UAAU,EAAC,cAAc,EAAC,QAAQ,EAAC,CAAC,CAAC;wBAAA,CAAC;gCAC7J,CAAC;4BAAA,IAAI,GAAC,KAAK,CAAC;wBAAA,CAAC;oBACtB,CAAC;oBACD,MAAM,OAAO,GAAC,WAAW,CAAC,GAAE,EAAE,CAAA,KAAK,IAAI,EAAE,EAAC,QAAQ,CAAC,EAAC,SAAS,GAAC,WAAW,CAAC,GAAE,EAAE,GAAC,IAAG,CAAC,KAAK,EAAC,CAAC;wBAAA,EAAE,CAAC,SAAS,EAAE,CAAC;wBAAA,OAAO;oBAAA,CAAC,CAAA,KAAK,GAAC,KAAK,CAAC,CAAA,EAAE,CAAC,IAAI,EAAE,CAAC,CAAA,CAAC,EAAC,KAAK,CAAC,CAAC;oBAChJ,EAAE,CAAC,EAAE,CAAC,OAAO,EAAC,GAAE,EAAE,GAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAA,aAAa,CAAC,OAAO,CAAC,CAAC,CAAA,aAAa,CAAC,SAAS,CAAC,CAAC,CAAA,KAAK,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC;gBAC/G,CAAC,CAAC,CAAC;YACL,CAAC;YAAA,OAAM,CAAC,EAAC,CAAC;gBAAA,IAAG,QAAQ;oBAAC,MAAM,OAAO,EAAE,CAAC;gBAAA,MAAM,CAAC,GAAG,CAAC,WAAW,GAAC,CAAE,CAAsB,CAAC,MAAM,KAAG,GAAG,CAAA,CAAC,CAAA,kBAAkB,CAAA,CAAC,CAAA,yBAAyB,CAAC,GAAC,+BAA+B,CAAC,CAAC;YAAA,CAAC;QACrL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,SAAS,KAAK,KAAG,KAAI,MAAM,EAAE,IAAI,OAAO,CAAC,OAAO;QAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAA,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA,CAAC;IACjG,OAAO,EAAC,UAAU,EAAC,MAAM,EAAC,KAAK,EAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,0BAA0B,GAK3B,MAAM,WAAW,CAAC"}

package/dist/internal.d.ts

@@ -0,0 +1 @@
+export { presentationProductionRefusals, type SocketContext } from './core.js';

package/dist/internal.js

@@ -0,0 +1,3 @@
+// For the cohort's own packages: outside the compatibility guarantee (README "Versioning").
+export { presentationProductionRefusals } from './core.js';
+//# sourceMappingURL=internal.js.map

package/dist/internal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal.js","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,OAAO,EAAC,8BAA8B,EAAoB,MAAM,WAAW,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mpfrontend/presentation-server",
-  "version": "0.1.0",
+  "version": "1.1.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -18,6 +18,10 @@
     "./relay": {
       "types": "./dist/relay.d.ts",
       "import": "./dist/relay.js"
+    },
+    "./internal": {
+      "types": "./dist/internal.d.ts",
+      "import": "./dist/internal.js"
     }
   },
   "files": [