@nodetool-ai/websocket 0.7.0-rc.22 → 0.8.1

package/dist/lib/external-asset-lookup.d.ts

@@ -0,0 +1,30 @@
+/** The row fields that describe an in-place file. */
+export interface ExternalAssetFields {
+    external_path: string | null;
+    metadata: Record<string, unknown> | null;
+}
+/** The metadata keys that fingerprint an external file. Server-owned. */
+export declare const EXTERNAL_FINGERPRINT_KEYS: readonly ["external_size", "external_mtime"];
+/** The recorded mtime of an external asset, or null for a managed one. */
+export declare function externalAssetMtime(asset: ExternalAssetFields): number | null;
+/**
+ * The external file behind `asset` when it is present and unchanged, else
+ * null. mtimes compare at millisecond granularity. A row with no recorded
+ * size or mtime is checked for presence only.
+ */
+export declare function verifiedExternalPath(asset: ExternalAssetFields): Promise<string | null>;
+/**
+ * Whether an external asset's file is missing or changed. Always false for a
+ * managed asset. One `stat`, so it is cheap enough for every asset response.
+ */
+export declare function isExternalAssetOffline(asset: ExternalAssetFields): Promise<boolean>;
+/**
+ * The external path behind `<owner>/<assetId>.<ext>` (or `<owner>/<assetId>`),
+ * or null. Only full asset ids resolve, only for the owner the key names, and
+ * only when the extension matches the one the row's content type maps to.
+ * Legacy flat keys and runtime scratch keys never resolve: external rows are
+ * always created under the owner-prefixed layout. An offline file resolves to
+ * null.
+ */
+export declare function lookupExternalAssetPath(key: string): Promise<string | null>;
+//# sourceMappingURL=external-asset-lookup.d.ts.map

package/dist/lib/external-asset-lookup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-asset-lookup.d.ts","sourceRoot":"","sources":["../../src/lib/external-asset-lookup.ts"],"names":[],"mappings":"AAqBA,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC1C;AAED,yEAAyE;AACzE,eAAO,MAAM,yBAAyB,YACpC,eAAe,EACf,gBAAgB,CACR,CAAC;AAUX,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAG5E;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiBxB;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,OAAO,CAAC,CAGlB;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAcxB"}

package/dist/lib/external-asset-lookup.js

@@ -0,0 +1,99 @@
+/**
+ * Resolve an asset storage key to the file an external asset references in
+ * place (see `Asset.external_path`), and decide whether that file is offline.
+ *
+ * The local `FileStorageAdapter` and the `/api/storage` stream call the lookup
+ * after a key misses under the storage root. Every key-based reader then finds
+ * an external asset's bytes without knowing about asset rows.
+ *
+ * A file that is missing, no longer a regular file, or whose size or mtime
+ * differs from what import or relink recorded is offline. The lookup answers
+ * null for an offline file, so every reader (adapter reads, `localPath`, the
+ * `/api/storage` stream) reports it as missing instead of serving bytes the
+ * asset never pointed at. Relink records the new file and brings it back.
+ */
+import { stat } from "node:fs/promises";
+import { Asset } from "@nodetool-ai/models";
+import { assetKeyOwner, normalizeStorageKey } from "@nodetool-ai/storage";
+import { getAssetFileName } from "./asset-paths.js";
+import { isRuntimeScratchKey } from "./storage-access.js";
+import { isFiniteNumber } from "./wire-values.js";
+/** The metadata keys that fingerprint an external file. Server-owned. */
+export const EXTERNAL_FINGERPRINT_KEYS = [
+    "external_size",
+    "external_mtime"
+];
+function recordedNumber(metadata, key) {
+    const value = metadata?.[key];
+    return isFiniteNumber(value) ? value : null;
+}
+/** The recorded mtime of an external asset, or null for a managed one. */
+export function externalAssetMtime(asset) {
+    if (!asset.external_path)
+        return null;
+    return recordedNumber(asset.metadata, "external_mtime");
+}
+/**
+ * The external file behind `asset` when it is present and unchanged, else
+ * null. mtimes compare at millisecond granularity. A row with no recorded
+ * size or mtime is checked for presence only.
+ */
+export async function verifiedExternalPath(asset) {
+    const path = asset.external_path;
+    if (!path)
+        return null;
+    let info;
+    try {
+        info = await stat(path);
+    }
+    catch {
+        return null;
+    }
+    if (!info.isFile())
+        return null;
+    const size = recordedNumber(asset.metadata, "external_size");
+    if (size !== null && size !== info.size)
+        return null;
+    const mtime = recordedNumber(asset.metadata, "external_mtime");
+    if (mtime !== null && Math.trunc(mtime) !== Math.trunc(info.mtimeMs)) {
+        return null;
+    }
+    return path;
+}
+/**
+ * Whether an external asset's file is missing or changed. Always false for a
+ * managed asset. One `stat`, so it is cheap enough for every asset response.
+ */
+export async function isExternalAssetOffline(asset) {
+    if (!asset.external_path)
+        return false;
+    return (await verifiedExternalPath(asset)) === null;
+}
+/**
+ * The external path behind `<owner>/<assetId>.<ext>` (or `<owner>/<assetId>`),
+ * or null. Only full asset ids resolve, only for the owner the key names, and
+ * only when the extension matches the one the row's content type maps to.
+ * Legacy flat keys and runtime scratch keys never resolve: external rows are
+ * always created under the owner-prefixed layout. An offline file resolves to
+ * null.
+ */
+export async function lookupExternalAssetPath(key) {
+    if (isRuntimeScratchKey(key))
+        return null;
+    const owner = assetKeyOwner(key);
+    if (!owner)
+        return null;
+    const fileName = normalizeStorageKey(key).slice(owner.length + 1);
+    if (!fileName || fileName.includes("/"))
+        return null;
+    const dot = fileName.lastIndexOf(".");
+    const assetId = dot > 0 ? fileName.slice(0, dot) : fileName;
+    const asset = await Asset.find(owner, assetId);
+    if (!asset?.external_path || asset.id !== assetId)
+        return null;
+    if (dot > 0 && fileName !== getAssetFileName(asset.id, asset.content_type)) {
+        return null;
+    }
+    return verifiedExternalPath(asset);
+}
+//# sourceMappingURL=external-asset-lookup.js.map

package/dist/lib/external-asset-lookup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-asset-lookup.js","sourceRoot":"","sources":["../../src/lib/external-asset-lookup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAQlD,yEAAyE;AACzE,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,eAAe;IACf,gBAAgB;CACR,CAAC;AAEX,SAAS,cAAc,CACrB,QAAwC,EACxC,GAA+C;IAE/C,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,KAA0B;IAC3D,IAAI,CAAC,KAAK,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAA0B;IAE1B,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC7D,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC/D,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA0B;IAE1B,IAAI,CAAC,KAAK,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,CAAC,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAW;IAEX,IAAI,mBAAmB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC5D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,EAAE,aAAa,IAAI,KAAK,CAAC,EAAE,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,GAAG,GAAG,CAAC,IAAI,QAAQ,KAAK,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;AACrC,CAAC"}

package/dist/lib/external-assets.d.ts

@@ -0,0 +1,13 @@
+/** Setting (and env var) holding the size, in bytes, at which imports stay in place. */
+export declare const EXTERNAL_ASSET_THRESHOLD_SETTING = "NODETOOL_EXTERNAL_ASSET_THRESHOLD_BYTES";
+/** Default threshold: 1 GiB. */
+export declare const DEFAULT_EXTERNAL_ASSET_THRESHOLD_BYTES: number;
+/** Whether this server may create external asset references. */
+export declare function externalAssetsAvailable(): boolean;
+/**
+ * The import size at or above which the desktop app references a file in
+ * place. Read from the settings table, then the environment. A missing,
+ * non-numeric, or non-positive value falls back to the default.
+ */
+export declare function getExternalAssetThresholdBytes(): Promise<number>;
+//# sourceMappingURL=external-assets.d.ts.map

package/dist/lib/external-assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-assets.d.ts","sourceRoot":"","sources":["../../src/lib/external-assets.ts"],"names":[],"mappings":"AAaA,wFAAwF;AACxF,eAAO,MAAM,gCAAgC,4CACF,CAAC;AAE5C,gCAAgC;AAChC,eAAO,MAAM,sCAAsC,QAAqB,CAAC;AAEzE,gEAAgE;AAChE,wBAAgB,uBAAuB,IAAI,OAAO,CAIjD;AAED;;;;GAIG;AACH,wBAAsB,8BAA8B,IAAI,OAAO,CAAC,MAAM,CAAC,CActE"}

package/dist/lib/external-assets.js

@@ -0,0 +1,46 @@
+/**
+ * When an import references a local file in place instead of copying it.
+ *
+ * Only the local desktop/dev server does this: the asset store must be the
+ * local file backend, and `NODETOOL_ENV=production` refuses it the same way
+ * it refuses the local file browser. A stored path is a read capability on
+ * the host, so it is never offered where the host is shared.
+ */
+import { loadAssetStorageConfig } from "@nodetool-ai/config";
+import { FileStorageAdapter } from "@nodetool-ai/storage";
+import { getSetting } from "../settings-registry.js";
+import { getAssetAdapter } from "./storage.js";
+/** Setting (and env var) holding the size, in bytes, at which imports stay in place. */
+export const EXTERNAL_ASSET_THRESHOLD_SETTING = "NODETOOL_EXTERNAL_ASSET_THRESHOLD_BYTES";
+/** Default threshold: 1 GiB. */
+export const DEFAULT_EXTERNAL_ASSET_THRESHOLD_BYTES = 1024 * 1024 * 1024;
+/** Whether this server may create external asset references. */
+export function externalAssetsAvailable() {
+    if (process.env["NODETOOL_ENV"] === "production")
+        return false;
+    if (loadAssetStorageConfig().kind !== "file")
+        return false;
+    return getAssetAdapter() instanceof FileStorageAdapter;
+}
+/**
+ * The import size at or above which the desktop app references a file in
+ * place. Read from the settings table, then the environment. A missing,
+ * non-numeric, or non-positive value falls back to the default.
+ */
+export async function getExternalAssetThresholdBytes() {
+    let raw;
+    try {
+        raw = await getSetting(EXTERNAL_ASSET_THRESHOLD_SETTING);
+    }
+    catch {
+        raw = process.env[EXTERNAL_ASSET_THRESHOLD_SETTING] ?? null;
+    }
+    if (raw === null || raw.trim() === "") {
+        return DEFAULT_EXTERNAL_ASSET_THRESHOLD_BYTES;
+    }
+    const parsed = Number(raw);
+    return Number.isFinite(parsed) && parsed > 0
+        ? Math.floor(parsed)
+        : DEFAULT_EXTERNAL_ASSET_THRESHOLD_BYTES;
+}
+//# sourceMappingURL=external-assets.js.map

package/dist/lib/external-assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-assets.js","sourceRoot":"","sources":["../../src/lib/external-assets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,wFAAwF;AACxF,MAAM,CAAC,MAAM,gCAAgC,GAC3C,yCAAyC,CAAC;AAE5C,gCAAgC;AAChC,MAAM,CAAC,MAAM,sCAAsC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAEzE,gEAAgE;AAChE,MAAM,UAAU,uBAAuB;IACrC,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,sBAAsB,EAAE,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,eAAe,EAAE,YAAY,kBAAkB,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B;IAClD,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,UAAU,CAAC,gCAAgC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,IAAI,IAAI,CAAC;IAC9D,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtC,OAAO,sCAAsC,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;QAC1C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QACpB,CAAC,CAAC,sCAAsC,CAAC;AAC7C,CAAC"}

package/dist/lib/fly-replay.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Route a resuming WebSocket handshake to the machine running the job.
+ *
+ * A workflow run lives in one process: its `JobRunSession` — replay buffer,
+ * cancel/stream hooks — is process-wide, not shared. With more than one
+ * instance behind the Fly proxy a reconnecting client is balanced onto an
+ * arbitrary machine, where `reconnect_job` finds no session and degrades to the
+ * persisted row: the run continues, but the client sees no frames and its Stop
+ * reaches nothing.
+ *
+ * Fly's proxy answers this with `fly-replay`. A response carrying
+ * `fly-replay: instance=<machine>` makes the proxy re-issue the *whole*
+ * request — an upgrade included, before any WebSocket frame exists — at the
+ * named machine. So the client hints which run it wants to resume
+ * (`?resume_job=<jobId>`), and the handshake is replayed at the instance the
+ * job row says owns it. Everything else upgrades normally.
+ *
+ * Bounded to one hop: the proxy stamps `fly-replay-src` on a request it
+ * replayed, and a request carrying that header is never replayed again. A
+ * machine that is gone fails the replay and the client's own reconnect retries
+ * — the run's row is still the fallback either way.
+ */
+import type { FastifyReply, FastifyRequest } from "fastify";
+/**
+ * Answer the handshake with a replay instruction, if it belongs elsewhere.
+ * Returns true when the request has been answered and must not be upgraded.
+ *
+ * Every failure — no hint, unknown job, another user's job, a DB that cannot
+ * be reached — falls through to a normal upgrade. Routing is an optimization;
+ * refusing connections when it cannot be computed would be strictly worse than
+ * the single-machine behavior it replaces.
+ */
+export declare function replayUpgradeToOwner(req: FastifyRequest, reply: FastifyReply): Promise<boolean>;
+//# sourceMappingURL=fly-replay.d.ts.map

package/dist/lib/fly-replay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fly-replay.d.ts","sourceRoot":"","sources":["../../src/lib/fly-replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAoB5D;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,OAAO,CAAC,CAiElB"}

package/dist/lib/fly-replay.js

@@ -0,0 +1,111 @@
+/**
+ * Route a resuming WebSocket handshake to the machine running the job.
+ *
+ * A workflow run lives in one process: its `JobRunSession` — replay buffer,
+ * cancel/stream hooks — is process-wide, not shared. With more than one
+ * instance behind the Fly proxy a reconnecting client is balanced onto an
+ * arbitrary machine, where `reconnect_job` finds no session and degrades to the
+ * persisted row: the run continues, but the client sees no frames and its Stop
+ * reaches nothing.
+ *
+ * Fly's proxy answers this with `fly-replay`. A response carrying
+ * `fly-replay: instance=<machine>` makes the proxy re-issue the *whole*
+ * request — an upgrade included, before any WebSocket frame exists — at the
+ * named machine. So the client hints which run it wants to resume
+ * (`?resume_job=<jobId>`), and the handshake is replayed at the instance the
+ * job row says owns it. Everything else upgrades normally.
+ *
+ * Bounded to one hop: the proxy stamps `fly-replay-src` on a request it
+ * replayed, and a request carrying that header is never replayed again. A
+ * machine that is gone fails the replay and the client's own reconnect retries
+ * — the run's row is still the fallback either way.
+ */
+import { createLogger } from "@nodetool-ai/config";
+import { Job } from "@nodetool-ai/models";
+import { getInstanceId, isValidInstanceId } from "./instance-id.js";
+import { isWebSocketUpgrade } from "./ws-upgrade.js";
+const log = createLogger("nodetool.websocket.fly-replay");
+/** A run in one of these states has no session left to route to. */
+const TERMINAL_STATUSES = new Set(["completed", "failed", "cancelled"]);
+/**
+ * Grace for the proxy to read the replay response before the socket is torn
+ * down. `end()` alone waits for the peer's FIN, which a hostile or wedged
+ * client never sends — the CLOSE_WAIT fd leak `ws-upgrade.ts` documents.
+ */
+const REPLAY_SOCKET_LINGER_MS = 5000;
+/**
+ * Answer the handshake with a replay instruction, if it belongs elsewhere.
+ * Returns true when the request has been answered and must not be upgraded.
+ *
+ * Every failure — no hint, unknown job, another user's job, a DB that cannot
+ * be reached — falls through to a normal upgrade. Routing is an optimization;
+ * refusing connections when it cannot be computed would be strictly worse than
+ * the single-machine behavior it replaces.
+ */
+export async function replayUpgradeToOwner(req, reply) {
+    if (!isWebSocketUpgrade(req))
+        return false;
+    // Already replayed once — accept it here rather than bounce it again.
+    if (req.headers["fly-replay-src"])
+        return false;
+    const instanceId = getInstanceId();
+    if (!instanceId)
+        return false;
+    const jobId = new URLSearchParams(req.url.split("?")[1] ?? "").get("resume_job");
+    if (!jobId)
+        return false;
+    const userId = req.userId;
+    if (!userId)
+        return false;
+    let owner = null;
+    try {
+        const job = await Job.find(userId, jobId);
+        if (!job || TERMINAL_STATUSES.has(job.status))
+            return false;
+        owner = job.runner_instance;
+    }
+    catch (err) {
+        log.warn("Could not resolve the owner of a resuming job", {
+            jobId,
+            error: err instanceof Error ? err.message : String(err)
+        });
+        return false;
+    }
+    if (!owner || owner === instanceId)
+        return false;
+    // The owner goes into a response header verbatim. A stored value that is not
+    // header-safe means someone's `NODETOOL_INSTANCE_ID` was malformed when the
+    // row was stamped; refuse to echo it rather than let a CRLF split the
+    // response we hand the proxy.
+    if (!isValidInstanceId(owner)) {
+        log.warn("Refusing to replay to a malformed instance id", { jobId, owner });
+        return false;
+    }
+    log.info("Replaying a resuming WebSocket upgrade to its owner", {
+        jobId,
+        owner
+    });
+    // An upgrade cannot be answered through `reply.send()` — see the doc comment
+    // on `denyUnauthorized`. Unlike a refusal this socket is *ended*, not
+    // destroyed: the proxy has to read the response to act on the header, and a
+    // destroyed socket may drop it.
+    reply.hijack();
+    const socket = req.raw.socket;
+    if (!socket || socket.destroyed)
+        return true;
+    socket.write("HTTP/1.1 409 Conflict\r\n" +
+        `fly-replay: instance=${owner}\r\n` +
+        "Connection: close\r\n" +
+        "Content-Length: 0\r\n" +
+        "\r\n");
+    socket.end();
+    // …but do not wait forever for the other side to finish closing.
+    const linger = setTimeout(() => {
+        if (!socket.destroyed)
+            socket.destroy();
+    }, REPLAY_SOCKET_LINGER_MS);
+    linger.unref?.();
+    socket.once("close", () => clearTimeout(linger));
+    return true;
+}
+//# sourceMappingURL=fly-replay.js.map

package/dist/lib/fly-replay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fly-replay.js","sourceRoot":"","sources":["../../src/lib/fly-replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAE1C,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,GAAG,GAAG,YAAY,CAAC,+BAA+B,CAAC,CAAC;AAE1D,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAExE;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAmB,EACnB,KAAmB;IAEnB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,sEAAsE;IACtE,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAAE,OAAO,KAAK,CAAC;IAEhD,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9B,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAChE,YAAY,CACb,CAAC;IACF,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEzB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5D,KAAK,GAAG,GAAG,CAAC,eAAe,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,+CAA+C,EAAE;YACxD,KAAK;YACL,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IACjD,6EAA6E;IAC7E,4EAA4E;IAC5E,sEAAsE;IACtE,8BAA8B;IAC9B,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,qDAAqD,EAAE;QAC9D,KAAK;QACL,KAAK;KACN,CAAC,CAAC;IAEH,6EAA6E;IAC7E,sEAAsE;IACtE,4EAA4E;IAC5E,gCAAgC;IAChC,KAAK,CAAC,MAAM,EAAE,CAAC;IACf,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,CAAC,KAAK,CACV,2BAA2B;QACzB,wBAAwB,KAAK,MAAM;QACnC,uBAAuB;QACvB,uBAAuB;QACvB,MAAM,CACT,CAAC;IACF,MAAM,CAAC,GAAG,EAAE,CAAC;IACb,iEAAiE;IACjE,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE;QAC7B,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC1C,CAAC,EAAE,uBAAuB,CAAC,CAAC;IAC5B,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;IACjB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/http-rate-limit.d.ts

@@ -0,0 +1,32 @@
+interface HttpRateLimitConfig {
+    enabled: boolean;
+    max: number;
+    /** Window length in milliseconds. */
+    timeWindow: number;
+    /**
+     * When true, derive the client key from req.ip (X-Forwarded-For aware). Only
+     * safe behind a trusted proxy — otherwise clients can spoof the header to mint
+     * unlimited fresh buckets.
+     */
+    trustProxy: boolean;
+}
+export declare function getHttpRateLimitConfig(): HttpRateLimitConfig;
+interface KeyableRequest {
+    ip?: string;
+    socket?: {
+        remoteAddress?: string;
+    };
+}
+/**
+ * Derive the rate-limit bucket key for a request.
+ *
+ * Defaults to the raw socket address rather than req.ip: with `trustProxy` on at
+ * the Fastify level, req.ip reflects the (spoofable) X-Forwarded-For header, so a
+ * client could mint unlimited fresh buckets and bypass the limit entirely. Set
+ * `trustProxy` only when a trusted reverse proxy populates the header.
+ */
+export declare function rateLimitKey(req: KeyableRequest, trustProxy: boolean): string;
+/** Localhost is never rate limited (mirrors the auth hook's localhost bypass). */
+export declare function isRateLimitExempt(key: string): boolean;
+export {};
+//# sourceMappingURL=http-rate-limit.d.ts.map

package/dist/lib/http-rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-rate-limit.d.ts","sourceRoot":"","sources":["../../src/lib/http-rate-limit.ts"],"names":[],"mappings":"AAkBA,UAAU,mBAAmB;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,sBAAsB,IAAI,mBAAmB,CAO5D;AAED,UAAU,cAAc;IACtB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,CAK7E;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOtD"}

package/dist/lib/http-rate-limit.js

@@ -0,0 +1,47 @@
+/**
+ * Per-IP HTTP request rate limiting configuration for the Fastify server.
+ *
+ * Backs `@fastify/rate-limit` to blunt brute-force (e.g. repeated auth attempts)
+ * and crude HTTP flooding. Tunable via environment variables:
+ *
+ *   NODETOOL_RATE_LIMIT_DISABLED      Set truthy to turn the limiter off.
+ *   NODETOOL_RATE_LIMIT_MAX           Max requests per window per IP (default 1000).
+ *   NODETOOL_RATE_LIMIT_WINDOW_MS     Window length in ms (default 60000).
+ *   NODETOOL_RATE_LIMIT_TRUST_PROXY   Key by X-Forwarded-For (req.ip) instead of
+ *                                     the socket address. Only enable behind a
+ *                                     trusted proxy that sets the header.
+ *
+ * Localhost is always exempt so local/Electron usage is never throttled — the
+ * same posture the auth hook takes.
+ */
+import { parseIntEnv, parseBoolEnv } from "./env-config.js";
+export function getHttpRateLimitConfig() {
+    return {
+        enabled: !parseBoolEnv("NODETOOL_RATE_LIMIT_DISABLED"),
+        max: parseIntEnv("NODETOOL_RATE_LIMIT_MAX", 1000),
+        timeWindow: parseIntEnv("NODETOOL_RATE_LIMIT_WINDOW_MS", 60_000),
+        trustProxy: parseBoolEnv("NODETOOL_RATE_LIMIT_TRUST_PROXY")
+    };
+}
+/**
+ * Derive the rate-limit bucket key for a request.
+ *
+ * Defaults to the raw socket address rather than req.ip: with `trustProxy` on at
+ * the Fastify level, req.ip reflects the (spoofable) X-Forwarded-For header, so a
+ * client could mint unlimited fresh buckets and bypass the limit entirely. Set
+ * `trustProxy` only when a trusted reverse proxy populates the header.
+ */
+export function rateLimitKey(req, trustProxy) {
+    if (trustProxy) {
+        return req.ip ?? req.socket?.remoteAddress ?? "unknown";
+    }
+    return req.socket?.remoteAddress ?? req.ip ?? "unknown";
+}
+/** Localhost is never rate limited (mirrors the auth hook's localhost bypass). */
+export function isRateLimitExempt(key) {
+    return (key === "127.0.0.1" ||
+        key === "::1" ||
+        key === "::ffff:127.0.0.1" ||
+        key === "localhost");
+}
+//# sourceMappingURL=http-rate-limit.js.map

package/dist/lib/http-rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-rate-limit.js","sourceRoot":"","sources":["../../src/lib/http-rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAe5D,MAAM,UAAU,sBAAsB;IACpC,OAAO;QACL,OAAO,EAAE,CAAC,YAAY,CAAC,8BAA8B,CAAC;QACtD,GAAG,EAAE,WAAW,CAAC,yBAAyB,EAAE,IAAI,CAAC;QACjD,UAAU,EAAE,WAAW,CAAC,+BAA+B,EAAE,MAAM,CAAC;QAChE,UAAU,EAAE,YAAY,CAAC,iCAAiC,CAAC;KAC5D,CAAC;AACJ,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,GAAmB,EAAE,UAAmB;IACnE,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,SAAS,CAAC;IAC1D,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;AAC1D,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO,CACL,GAAG,KAAK,WAAW;QACnB,GAAG,KAAK,KAAK;QACb,GAAG,KAAK,kBAAkB;QAC1B,GAAG,KAAK,WAAW,CACpB,CAAC;AACJ,CAAC"}

package/dist/lib/instance-id.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Which server instance this process is.
+ *
+ * On Fly every machine gets `FLY_MACHINE_ID`, and it is also the value the
+ * proxy's `fly-replay: instance=<id>` header addresses — so the same string
+ * both stamps a job row and routes a handshake back to its owner.
+ * `NODETOOL_INSTANCE_ID` overrides it for tests and for other multi-instance
+ * deployments.
+ *
+ * Null means single-machine: nothing to route to, and every feature keyed off
+ * this is inert — which is also what a malformed value gets. The id is written
+ * into a response header verbatim (`fly-replay: instance=<id>`), so anything
+ * outside {@link INSTANCE_ID_PATTERN} is rejected here rather than trusted to
+ * be caught downstream.
+ */
+export declare function getInstanceId(): string | null;
+/**
+ * What an instance id may contain. Fly machine ids are hex, but other
+ * deployments name their instances; the bound that matters is that the value
+ * cannot carry CRLF into a response header.
+ */
+export declare const INSTANCE_ID_PATTERN: RegExp;
+/** True for a value safe to interpolate into a header. */
+export declare function isValidInstanceId(value: string): boolean;
+//# sourceMappingURL=instance-id.d.ts.map

package/dist/lib/instance-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance-id.d.ts","sourceRoot":"","sources":["../../src/lib/instance-id.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,IAAI,CAc7C;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,QAAqB,CAAC;AAEtD,0DAA0D;AAC1D,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD"}

package/dist/lib/instance-id.js

@@ -0,0 +1,44 @@
+import { createLogger } from "@nodetool-ai/config";
+const log = createLogger("nodetool.websocket.instance-id");
+const warnedAbout = new Set();
+/**
+ * Which server instance this process is.
+ *
+ * On Fly every machine gets `FLY_MACHINE_ID`, and it is also the value the
+ * proxy's `fly-replay: instance=<id>` header addresses — so the same string
+ * both stamps a job row and routes a handshake back to its owner.
+ * `NODETOOL_INSTANCE_ID` overrides it for tests and for other multi-instance
+ * deployments.
+ *
+ * Null means single-machine: nothing to route to, and every feature keyed off
+ * this is inert — which is also what a malformed value gets. The id is written
+ * into a response header verbatim (`fly-replay: instance=<id>`), so anything
+ * outside {@link INSTANCE_ID_PATTERN} is rejected here rather than trusted to
+ * be caught downstream.
+ */
+export function getInstanceId() {
+    const configured = process.env["NODETOOL_INSTANCE_ID"] ?? process.env["FLY_MACHINE_ID"];
+    const trimmed = configured?.trim();
+    if (!trimmed)
+        return null;
+    if (!isValidInstanceId(trimmed)) {
+        // Called per run start and per upgrade, so say it once per bad value.
+        if (!warnedAbout.has(trimmed)) {
+            warnedAbout.add(trimmed);
+            log.warn("Ignoring a malformed instance id", { value: trimmed });
+        }
+        return null;
+    }
+    return trimmed;
+}
+/**
+ * What an instance id may contain. Fly machine ids are hex, but other
+ * deployments name their instances; the bound that matters is that the value
+ * cannot carry CRLF into a response header.
+ */
+export const INSTANCE_ID_PATTERN = /^[A-Za-z0-9_-]+$/;
+/** True for a value safe to interpolate into a header. */
+export function isValidInstanceId(value) {
+    return INSTANCE_ID_PATTERN.test(value);
+}
+//# sourceMappingURL=instance-id.js.map

package/dist/lib/instance-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance-id.js","sourceRoot":"","sources":["../../src/lib/instance-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,GAAG,GAAG,YAAY,CAAC,gCAAgC,CAAC,CAAC;AAE3D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;AAEtC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,UAAU,GACd,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,sEAAsE;QACtE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AAEtD,0DAA0D;AAC1D,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC"}

package/dist/lib/link-codes.d.ts

@@ -0,0 +1,82 @@
+/**
+ * One-time link codes for the external-identity flow, shared by the two
+ * surfaces that mint and consume them.
+ *
+ * A link always writes the same `external_identities` row, but it can start
+ * from either end, and the half the code carries is the half the starter
+ * already knows:
+ *
+ * - **Bot-minted** (`POST /api/integrations/:provider/link/start`, service
+ *   token): the bridge knows the external account, not the NodeTool user. The
+ *   code carries `externalId` and is redeemed by a signed-in browser, which
+ *   supplies the user.
+ * - **Web-minted** (`integrations.createLinkCode` over tRPC, user session): the
+ *   browser knows the user, not the external account. The code carries
+ *   `userId`, goes into a `t.me/<bot>?start=<code>` deep link, and is redeemed
+ *   by the bridge's `/link/complete`, which supplies the external id.
+ *
+ * Both halves are therefore always present at redemption, and neither surface
+ * ever accepts the half it did not mint on the caller's word: a browser cannot
+ * name an external account, and the bridge cannot name a user.
+ *
+ * Storage is in-memory on purpose (design §5): a code lives ten minutes, and
+ * losing one on restart costs a second `/link`, not data.
+ */
+/** How long a link code stays usable. */
+export declare const LINK_CODE_TTL_MS: number;
+/** A code the bridge minted, waiting for a signed-in user to claim it. */
+export interface BotMintedLinkCode {
+    kind: "external";
+    provider: string;
+    externalId: string;
+    expiresAtMs: number;
+}
+/** A code a signed-in user minted, waiting for an external account to claim it. */
+export interface WebMintedLinkCode {
+    kind: "user";
+    provider: string;
+    userId: string;
+    expiresAtMs: number;
+}
+export type LinkCode = BotMintedLinkCode | WebMintedLinkCode;
+export interface MintedLinkCode {
+    code: string;
+    expiresAtMs: number;
+}
+export interface LinkCodeStoreOptions {
+    /** Injected clock, so expiry is testable without waiting. */
+    now?: () => number;
+    ttlMs?: number;
+}
+export declare class LinkCodeStore {
+    private readonly codes;
+    private readonly now;
+    private readonly ttlMs;
+    constructor(options?: LinkCodeStoreOptions);
+    /** Mint a code bound to an external account, awaiting a NodeTool user. */
+    mintForExternalAccount(provider: string, externalId: string): MintedLinkCode;
+    /** Mint a code bound to a NodeTool user, awaiting an external account. */
+    mintForUser(provider: string, userId: string): MintedLinkCode;
+    /**
+     * Read a code without spending it, so a confirmation page can name the
+     * account it is about to link. An expired code reads as absent.
+     */
+    peek(code: string): LinkCode | null;
+    /**
+     * Spend a code. Single use: it is removed whether or not the caller goes on
+     * to accept it, so a guessed code cannot be probed against several accounts.
+     */
+    consume(code: string): LinkCode | null;
+    /** Codes currently outstanding — for tests and diagnostics. */
+    get size(): number;
+    private mint;
+    private prune;
+}
+/**
+ * The process-wide store. Both directions must see one another's codes — a
+ * deep link minted in the browser is redeemed by the bridge, and vice versa —
+ * so the service routes and the tRPC router share this instance. Tests inject
+ * their own.
+ */
+export declare const sharedLinkCodes: LinkCodeStore;
+//# sourceMappingURL=link-codes.d.ts.map

package/dist/lib/link-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-codes.d.ts","sourceRoot":"","sources":["../../src/lib/link-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,yCAAyC;AACzC,eAAO,MAAM,gBAAgB,QAAiB,CAAC;AAE/C,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,QAAQ,GAAG,iBAAiB,GAAG,iBAAiB,CAAC;AAE7D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAE/B,YAAY,OAAO,GAAE,oBAAyB,EAG7C;IAED,0EAA0E;IAC1E,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,cAAc,CAO3E;IAED,0EAA0E;IAC1E,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAO5D;IAED;;;OAGG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAGlC;IAED;;;OAGG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAMrC;IAED,+DAA+D;IAC/D,IAAI,IAAI,IAAI,MAAM,CAGjB;IAED,OAAO,CAAC,IAAI;IAOZ,OAAO,CAAC,KAAK;CAMd;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,eAAsB,CAAC"}