@ohmaseclaro/fleetwatch 0.1.0

package/dist/server/registry.js

@@ -0,0 +1,275 @@
+import { EventEmitter } from "node:events";
+const HISTORY_BUFFER = 500; // keep the last N events per session in memory for replays
+const IDLE_THRESHOLD_MS = 60_000;
+const RUNNING_FRESHNESS_MS = 5_000;
+export class SessionRegistry extends EventEmitter {
+    sessions = new Map();
+    upsertMeta(sessionId, init) {
+        let entry = this.sessions.get(sessionId);
+        if (!entry) {
+            const session = {
+                id: sessionId,
+                projectPath: init.projectPath,
+                projectLabel: init.projectLabel,
+                status: "idle",
+                lastUserMessageAt: 0,
+                lastEventAt: 0,
+                lastUserMessagePreview: "",
+                isSubagent: !!init.isSubagent,
+                parentSessionId: init.parentSessionId,
+                source: init.source,
+                gitBranch: init.gitBranch,
+                eventCount: 0,
+            };
+            entry = {
+                session,
+                events: [],
+                subscribed: false,
+                toolUseHasResult: new Set(),
+                filePath: init.filePath,
+            };
+            this.sessions.set(sessionId, entry);
+            this.emit("upsert", session);
+        }
+        else {
+            let changed = false;
+            if (entry.session.projectPath !== init.projectPath) {
+                entry.session.projectPath = init.projectPath;
+                changed = true;
+            }
+            if (entry.session.projectLabel !== init.projectLabel) {
+                entry.session.projectLabel = init.projectLabel;
+                changed = true;
+            }
+            if (init.gitBranch && entry.session.gitBranch !== init.gitBranch) {
+                entry.session.gitBranch = init.gitBranch;
+                changed = true;
+            }
+            entry.filePath = init.filePath;
+            if (changed)
+                this.emit("upsert", entry.session);
+        }
+        return entry;
+    }
+    setTitle(sessionId, patch) {
+        const entry = this.sessions.get(sessionId);
+        if (!entry)
+            return;
+        let changed = false;
+        if (patch.aiTitle && entry.session.aiTitle !== patch.aiTitle) {
+            entry.session.aiTitle = patch.aiTitle;
+            changed = true;
+        }
+        if (patch.customTitle && entry.session.customTitle !== patch.customTitle) {
+            entry.session.customTitle = patch.customTitle;
+            changed = true;
+        }
+        if (changed)
+            this.emit("upsert", entry.session);
+    }
+    /** Mark a session as actively subscribed by a client, enabling event buffering. */
+    subscribe(sessionId) {
+        const entry = this.sessions.get(sessionId);
+        if (entry)
+            entry.subscribed = true;
+    }
+    /** Unsubscribe: stop buffering events (clears the ring buffer to reclaim memory). */
+    unsubscribe(sessionId) {
+        const entry = this.sessions.get(sessionId);
+        if (entry) {
+            entry.subscribed = false;
+            entry.events = [];
+        }
+    }
+    isSubscribed(sessionId) {
+        return this.sessions.get(sessionId)?.subscribed ?? false;
+    }
+    appendEvent(sessionId, event) {
+        const entry = this.sessions.get(sessionId);
+        if (!entry)
+            return;
+        // Only buffer events for subscribed sessions to cap memory.
+        if (entry.subscribed) {
+            entry.events.push(event);
+            if (entry.events.length > HISTORY_BUFFER)
+                entry.events.splice(0, entry.events.length - HISTORY_BUFFER);
+        }
+        const s = entry.session;
+        s.eventCount += 1;
+        if (event.ts > s.lastEventAt)
+            s.lastEventAt = event.ts;
+        if (event.type === "user" && event.text) {
+            // Skip slash commands & internal hooks for the "last human message" notion.
+            const isHumanText = !event.text.startsWith("<command-name>") && !event.text.startsWith("<local-command-stdout>");
+            if (isHumanText) {
+                s.lastUserMessageAt = event.ts;
+                s.lastUserMessagePreview = previewOf(event.text);
+            }
+        }
+        // Status state updates — each event resets prior flags so the state always
+        // reflects the most recent meaningful turn.
+        if (event.type === "tool_use") {
+            entry.lastToolUseId = event.toolUseId;
+            entry.lastToolUseName = event.toolName;
+            entry.lastWasError = false;
+            entry.lastWasSummary = false;
+            entry.lastAssistantStop = undefined;
+        }
+        else if (event.type === "tool_result") {
+            if (event.toolUseRef)
+                entry.toolUseHasResult.add(event.toolUseRef);
+            entry.lastWasError = event.toolResultIsError === true;
+        }
+        else if (event.type === "assistant") {
+            entry.lastAssistantStop = "end_turn";
+            entry.lastWasError = false;
+            entry.lastWasSummary = false;
+        }
+        else if (event.type === "user") {
+            // New user prompt — reset error flag, assistant hasn't replied yet.
+            entry.lastWasError = false;
+            entry.lastWasSummary = false;
+            entry.lastAssistantStop = undefined;
+        }
+        else if (event.type === "summary") {
+            entry.lastWasSummary = true;
+        }
+        // We deliberately ignore system events for status derivation — they're
+        // mostly hooks / reminders / warnings, not errors.
+        this.recomputeStatus(entry);
+        this.emit("event", event);
+        this.emit("upsert", entry.session);
+    }
+    setUserMessageFromHistory(projectPath, sessionId, ts, preview) {
+        const entry = this.sessions.get(sessionId);
+        if (!entry)
+            return;
+        if (ts > entry.session.lastUserMessageAt) {
+            entry.session.lastUserMessageAt = ts;
+            entry.session.lastUserMessagePreview = preview;
+            this.emit("upsert", entry.session);
+        }
+    }
+    /**
+     * Sync per-session metrics from a non-event source (e.g. Cursor's
+     * `composerData` envelopes which carry timestamps but no events until the
+     * session is opened). Used to seed sort-order before subscription.
+     */
+    setActivity(sessionId, opts) {
+        const entry = this.sessions.get(sessionId);
+        if (!entry)
+            return;
+        let changed = false;
+        if (opts.lastEventAt !== undefined && opts.lastEventAt > entry.session.lastEventAt) {
+            entry.session.lastEventAt = opts.lastEventAt;
+            changed = true;
+        }
+        if (opts.eventCount !== undefined && opts.eventCount !== entry.session.eventCount) {
+            entry.session.eventCount = opts.eventCount;
+            changed = true;
+        }
+        if (opts.currentActivity !== undefined && entry.session.currentActivity !== opts.currentActivity) {
+            entry.session.currentActivity = opts.currentActivity;
+            changed = true;
+        }
+        if (changed) {
+            this.recomputeStatus(entry);
+            this.emit("upsert", entry.session);
+        }
+    }
+    recomputeAll() {
+        for (const entry of this.sessions.values()) {
+            this.recomputeStatus(entry);
+        }
+    }
+    recomputeStatus(entry) {
+        const prev = entry.session.status;
+        const next = deriveStatus(entry);
+        if (prev !== next.status || entry.session.currentActivity !== next.currentActivity) {
+            entry.session.status = next.status;
+            entry.session.currentActivity = next.currentActivity;
+            this.emit("upsert", entry.session);
+        }
+    }
+    list() {
+        return Array.from(this.sessions.values())
+            .map((e) => e.session)
+            .sort(sortSessions);
+    }
+    get(sessionId) {
+        return this.sessions.get(sessionId)?.session;
+    }
+    /**
+     * Where this session's transcript lives on disk. For JSONL providers
+     * (Claude Code, Cowork) it's an actual path. For Cursor we use a synthetic
+     * `cursor:<composerId>` token so the UI can show "lives in the Cursor
+     * SQLite DB" instead of a misleading non-existent file.
+     */
+    filePathOf(sessionId) {
+        return this.sessions.get(sessionId)?.filePath;
+    }
+    history(sessionId, limit) {
+        const entry = this.sessions.get(sessionId);
+        if (!entry)
+            return [];
+        if (limit && entry.events.length > limit) {
+            return entry.events.slice(entry.events.length - limit);
+        }
+        return entry.events.slice();
+    }
+    remove(sessionId) {
+        if (this.sessions.delete(sessionId))
+            this.emit("remove", sessionId);
+    }
+}
+const ERROR_FRESHNESS_MS = 5 * 60_000;
+function deriveStatus(entry) {
+    const s = entry.session;
+    const now = Date.now();
+    const ageMs = now - (s.lastEventAt || now);
+    if (entry.lastToolUseId && !entry.toolUseHasResult.has(entry.lastToolUseId)) {
+        // Only show as running-tool if the call is fresh — otherwise treat as idle.
+        if (ageMs < IDLE_THRESHOLD_MS) {
+            return {
+                status: "running-tool",
+                currentActivity: `Running ${entry.lastToolUseName ?? "tool"}…`,
+            };
+        }
+    }
+    if (entry.lastWasSummary) {
+        return { status: "compacted", currentActivity: "Session compacted" };
+    }
+    // Errors are only sticky if recent — old sessions go to idle instead of staying red forever.
+    if (entry.lastWasError && ageMs < ERROR_FRESHNESS_MS) {
+        return { status: "errored", currentActivity: "Error" };
+    }
+    if (entry.lastAssistantStop === "end_turn") {
+        if (ageMs < RUNNING_FRESHNESS_MS) {
+            return { status: "running", currentActivity: "Finishing turn…" };
+        }
+        if (ageMs < IDLE_THRESHOLD_MS) {
+            return { status: "awaiting-user", currentActivity: "Waiting for you" };
+        }
+        return { status: "idle" };
+    }
+    if (s.lastEventAt > 0 && ageMs > IDLE_THRESHOLD_MS) {
+        return { status: "idle" };
+    }
+    return { status: "running", currentActivity: "Working…" };
+}
+function previewOf(text) {
+    const cleaned = text.replace(/\s+/g, " ").trim();
+    return cleaned.length > 120 ? cleaned.slice(0, 117) + "…" : cleaned;
+}
+export function sortSessions(a, b) {
+    // errored sessions in the last 5 min float to the top
+    const now = Date.now();
+    const aErrRecent = a.status === "errored" && now - a.lastEventAt < 5 * 60_000;
+    const bErrRecent = b.status === "errored" && now - b.lastEventAt < 5 * 60_000;
+    if (aErrRecent && !bErrRecent)
+        return -1;
+    if (bErrRecent && !aErrRecent)
+        return 1;
+    return (b.lastUserMessageAt || b.lastEventAt) - (a.lastUserMessageAt || a.lastEventAt);
+}
+//# sourceMappingURL=registry.js.map

package/dist/server/server.js

@@ -0,0 +1,397 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { existsSync } from "node:fs";
+import Fastify from "fastify";
+import fastifyStatic from "@fastify/static";
+import fastifyWebsocket from "@fastify/websocket";
+import { attachmentStore } from "./attachmentStore.js";
+import { buildPairingPayload, pickLanIp, rotateToken, saveConfig } from "./pairing.js";
+import { stopTunnel, activeTunnel, lastTunnelError } from "./tunnel.js";
+import { isAuthorized, isPasswordRequired, issueJwt, setPairingToken, setPassword, verifyPassword, } from "./auth.js";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+export async function startServer(opts) {
+    const app = Fastify({ logger: false, trustProxy: true });
+    await app.register(fastifyWebsocket, {
+        options: {
+            maxPayload: 1024 * 1024,
+        },
+    });
+    // Block browser extensions (e.g. Claude Code's SES lockdown) from injecting
+    // scripts into the app. Inline styles are needed for Tailwind utility classes.
+    app.addHook("onSend", async (_req, reply, payload) => {
+        const ct = reply.getHeader("content-type");
+        if (ct && ct.startsWith("text/html")) {
+            reply.header("Content-Security-Policy", "default-src 'self'; connect-src 'self' ws: wss:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data: https:;");
+        }
+        return payload;
+    });
+    if (existsSync(opts.webRoot)) {
+        await app.register(fastifyStatic, {
+            root: opts.webRoot,
+            prefix: "/",
+            wildcard: false,
+            decorateReply: true,
+        });
+    }
+    // Auth helper: token is presented either as ?token= or Authorization: Bearer
+    // and may be either a JWT or the pairing token (when no password is set).
+    const requireToken = (token) => isAuthorized(token);
+    // --- HTTP routes ---
+    app.get("/api/health", async () => ({
+        ok: true,
+        host: opts.config.hostLabel,
+        platform: process.platform,
+        version: opts.agentVersion,
+    }));
+    /** Public — tells the client what auth method to use. */
+    app.get("/api/auth-info", async () => ({
+        passwordRequired: isPasswordRequired(),
+        hostLabel: opts.config.hostLabel,
+    }));
+    /**
+     * Exchange pairing token + optional password for a JWT.
+     * Rules:
+     *   - No password configured: valid pairing token required.
+     *   - Password configured:    valid password required (pairing token optional).
+     */
+    app.post("/api/login", async (req, reply) => {
+        const body = req.body ?? {};
+        const passwordNeeded = isPasswordRequired();
+        if (passwordNeeded) {
+            if (typeof body.password !== "string" || body.password.length === 0) {
+                reply.code(400);
+                return { error: "password_required" };
+            }
+            const ok = await verifyPassword(body.password);
+            if (!ok) {
+                reply.code(401);
+                return { error: "invalid_password" };
+            }
+        }
+        else {
+            // No password — require valid pairing token (provided via QR URL).
+            if (typeof body.token !== "string" || body.token !== opts.config.token) {
+                reply.code(401);
+                return { error: "invalid_token" };
+            }
+        }
+        const { token: jwtToken, expiresAt } = issueJwt();
+        return { jwt: jwtToken, expiresAt, passwordRequired: passwordNeeded };
+    });
+    app.get("/api/pairing", async (req, reply) => {
+        // Only available from localhost.
+        const ip = req.ip;
+        const isLocal = ip === "127.0.0.1" || ip === "::1" || ip === "::ffff:127.0.0.1";
+        if (!isLocal) {
+            reply.code(403);
+            return { error: "Pairing info is only available from localhost." };
+        }
+        const lan = pickLanIp() ?? "127.0.0.1";
+        const tunnel = activeTunnel();
+        const payload = await buildPairingPayload(lan, opts.port, opts.config.token, tunnel?.url);
+        return {
+            url: payload.url,
+            qrSvg: payload.qrSvg,
+            hostLabel: opts.config.hostLabel,
+            lan,
+            port: opts.port,
+            ngrokUrl: tunnel?.url ?? null,
+            ngrokActive: !!tunnel,
+            ngrokConfigured: !!(opts.config.ngrokAuthtoken || process.env.NGROK_AUTHTOKEN),
+            ngrokDisabled: !!opts.config.ngrokDisabled,
+            passwordRequired: isPasswordRequired(),
+        };
+    });
+    /** Tunnel status — available to any authenticated client so the phone can show it. */
+    app.get("/api/tunnel", async (req, reply) => {
+        const token = extractToken(req.query, req.headers.authorization);
+        if (!requireToken(token)) {
+            reply.code(401);
+            return { error: "unauthorized" };
+        }
+        const tunnel = activeTunnel();
+        const err = lastTunnelError();
+        return {
+            active: !!tunnel,
+            url: tunnel?.url ?? null,
+            error: tunnel ? null : err,
+        };
+    });
+    app.post("/api/rotate-token", async (req, reply) => {
+        const ip = req.ip;
+        const isLocal = ip === "127.0.0.1" || ip === "::1" || ip === "::ffff:127.0.0.1";
+        if (!isLocal) {
+            reply.code(403);
+            return { error: "Local only." };
+        }
+        const next = await rotateToken(opts.config);
+        opts.config.token = next.token;
+        setPairingToken(next.token);
+        opts.onConfigChanged(next);
+        return { ok: true, token: next.token };
+    });
+    app.post("/api/settings", async (req, reply) => {
+        const ip = req.ip;
+        const isLocal = ip === "127.0.0.1" || ip === "::1" || ip === "::ffff:127.0.0.1";
+        if (!isLocal) {
+            reply.code(403);
+            return { error: "Local only." };
+        }
+        if (typeof req.body?.includeCowork === "boolean") {
+            opts.config.preferences.includeCowork = req.body.includeCowork;
+        }
+        if (typeof req.body?.hostLabel === "string" && req.body.hostLabel.length > 0) {
+            opts.config.hostLabel = req.body.hostLabel.slice(0, 80);
+        }
+        if (typeof req.body?.password === "string") {
+            setPassword(req.body.password.length > 0 ? req.body.password : null);
+        }
+        let tunnelRestarted = false;
+        if (typeof req.body?.ngrokDisabled === "boolean") {
+            opts.config.ngrokDisabled = req.body.ngrokDisabled;
+            if (req.body.ngrokDisabled) {
+                await stopTunnel().catch(() => { });
+            }
+            else if (opts.onTunnelAuthtoken && opts.config.ngrokAuthtoken) {
+                await opts.onTunnelAuthtoken(opts.config.ngrokAuthtoken).catch(() => { });
+                tunnelRestarted = true;
+            }
+        }
+        if (typeof req.body?.ngrokAuthtoken === "string") {
+            const token = req.body.ngrokAuthtoken.trim();
+            opts.config.ngrokAuthtoken = token || undefined;
+            if (opts.onTunnelAuthtoken && token && !opts.config.ngrokDisabled) {
+                await opts.onTunnelAuthtoken(token).catch(() => { });
+                tunnelRestarted = true;
+            }
+            else if (!token) {
+                await stopTunnel().catch(() => { });
+            }
+        }
+        await saveConfig(opts.config);
+        opts.onConfigChanged(opts.config);
+        const tunnel = activeTunnel();
+        return {
+            ok: true,
+            hostLabel: opts.config.hostLabel,
+            includeCowork: opts.config.preferences.includeCowork,
+            ngrokUrl: tunnel?.url ?? null,
+            ngrokActive: !!tunnel,
+            ngrokDisabled: !!opts.config.ngrokDisabled,
+            passwordRequired: isPasswordRequired(),
+            tunnelRestarted,
+        };
+    });
+    /**
+     * Serve a stored image attachment. Content-addressed — the hash comes from
+     * the SessionEvent's `images[].hash`. Requires JWT (or pairing token when
+     * no password is set).
+     */
+    app.get("/api/attachment/:hash", async (req, reply) => {
+        const token = extractToken(req.query, req.headers.authorization);
+        if (!requireToken(token)) {
+            reply.code(401);
+            return { error: "unauthorized" };
+        }
+        const { hash } = req.params;
+        // Defensive: only allow alphanumeric (our hashes are hex).
+        if (!/^[a-f0-9]{8,64}$/i.test(hash)) {
+            reply.code(400);
+            return { error: "bad_hash" };
+        }
+        const entry = attachmentStore.get(hash);
+        if (!entry) {
+            reply.code(404);
+            return { error: "not_found" };
+        }
+        reply.header("content-type", entry.mediaType);
+        // Long cache since the hash is content-addressed and immutable.
+        reply.header("cache-control", "private, max-age=2592000, immutable");
+        reply.header("content-length", entry.sizeBytes);
+        return reply.send(entry.buffer);
+    });
+    /**
+     * Per-session metadata: where the transcript lives, file size, event count,
+     * etc. Used by the (i) info modal in the SessionDetail screen.
+     */
+    app.get("/api/session/:id/info", async (req, reply) => {
+        const token = extractToken(req.query, req.headers.authorization);
+        if (!requireToken(token)) {
+            reply.code(401);
+            return { error: "unauthorized" };
+        }
+        const session = opts.registry.get(req.params.id);
+        if (!session) {
+            reply.code(404);
+            return { error: "not_found" };
+        }
+        const filePath = opts.registry.filePathOf(req.params.id);
+        // For real on-disk files, surface the size (helps the user judge if it's
+        // a "big" transcript). Synthetic paths (cursor:<id>) just return null.
+        let fileSize = null;
+        let exists = false;
+        if (filePath && !filePath.startsWith("cursor:")) {
+            try {
+                const stat = await import("node:fs").then((m) => m.promises.stat(filePath));
+                fileSize = stat.size;
+                exists = true;
+            }
+            catch {
+                exists = false;
+            }
+        }
+        return {
+            sessionId: session.id,
+            source: session.source,
+            filePath: filePath ?? null,
+            fileExists: exists,
+            fileSize,
+            projectPath: session.projectPath,
+            projectLabel: session.projectLabel,
+            gitBranch: session.gitBranch ?? null,
+            eventCount: session.eventCount,
+            lastEventAt: session.lastEventAt,
+            lastUserMessageAt: session.lastUserMessageAt,
+            status: session.status,
+            aiTitle: session.aiTitle ?? null,
+            customTitle: session.customTitle ?? null,
+            isSubagent: session.isSubagent,
+            parentSessionId: session.parentSessionId ?? null,
+        };
+    });
+    app.get("/api/session/:id/history", async (req, reply) => {
+        const token = extractToken(req.query, req.headers.authorization);
+        if (!requireToken(token)) {
+            reply.code(401);
+            return { error: "unauthorized" };
+        }
+        const { id } = req.params;
+        return { events: opts.registry.history(id) };
+    });
+    // SPA fallback — serve index.html for unknown routes so client routing works.
+    app.setNotFoundHandler(async (req, reply) => {
+        const indexPath = path.join(opts.webRoot, "index.html");
+        if (existsSync(indexPath) && (req.url || "").startsWith("/api") === false) {
+            return reply.type("text/html").sendFile("index.html");
+        }
+        reply.code(404).send({ error: "not found" });
+    });
+    // --- WebSocket ---
+    const clients = new Set();
+    app.get("/ws", { websocket: true }, (socket, req) => {
+        const token = extractToken(req.query, req.headers.authorization);
+        if (!requireToken(token)) {
+            socket.send(JSON.stringify({ kind: "error", message: "unauthorized" }));
+            socket.close(4001, "unauthorized");
+            return;
+        }
+        clients.add(socket);
+        const hello = {
+            kind: "hello",
+            agentVersion: opts.agentVersion,
+            hostname: opts.config.hostLabel,
+            platform: process.platform,
+            ts: Date.now(),
+        };
+        socket.send(JSON.stringify(hello));
+        const list = {
+            kind: "session_list",
+            sessions: opts.registry.list(),
+            ts: Date.now(),
+        };
+        socket.send(JSON.stringify(list));
+        const heartbeat = setInterval(() => {
+            try {
+                socket.send(JSON.stringify({ kind: "heartbeat", ts: Date.now() }));
+            }
+            catch { }
+        }, 15_000);
+        heartbeat.unref();
+        // Track which sessions this client has open so we can unsubscribe on disconnect.
+        const mySubscriptions = new Set();
+        socket.on("message", (raw) => {
+            let frame;
+            try {
+                frame = JSON.parse(raw.toString());
+            }
+            catch {
+                return;
+            }
+            if (frame.kind === "request_history") {
+                const sessionId = frame.sessionId;
+                // Mark subscribed → enables event buffering in the registry.
+                opts.registry.subscribe(sessionId);
+                mySubscriptions.add(sessionId);
+                // If the ring buffer is empty, kick off a full backfill from disk.
+                const existing = opts.registry.history(sessionId, frame.limit ?? 500);
+                if (existing.length > 0) {
+                    const response = { kind: "session_events", sessionId, events: existing, replay: true };
+                    socket.send(JSON.stringify(response));
+                }
+                else {
+                    // Backfill async — events will come via session_event broadcasts.
+                    opts.providers.backfillSession(sessionId).then(() => {
+                        const events = opts.registry.history(sessionId, frame.limit ?? 500);
+                        const response = { kind: "session_events", sessionId, events, replay: true };
+                        socket.send(JSON.stringify(response));
+                    });
+                }
+            }
+            else if (frame.kind === "subscribe") {
+                for (const id of frame.sessionIds) {
+                    opts.registry.subscribe(id);
+                    mySubscriptions.add(id);
+                }
+            }
+            else if (frame.kind === "unsubscribe") {
+                for (const id of frame.sessionIds) {
+                    opts.registry.unsubscribe(id);
+                    mySubscriptions.delete(id);
+                }
+            }
+            else if (frame.kind === "heartbeat") {
+                // echo
+            }
+        });
+        socket.on("close", () => {
+            clearInterval(heartbeat);
+            clients.delete(socket);
+            // Unsubscribe all sessions this client had open.
+            for (const id of mySubscriptions)
+                opts.registry.unsubscribe(id);
+            mySubscriptions.clear();
+        });
+        socket.on("error", () => {
+            clearInterval(heartbeat);
+            clients.delete(socket);
+            for (const id of mySubscriptions)
+                opts.registry.unsubscribe(id);
+            mySubscriptions.clear();
+        });
+    });
+    // Bridge registry events to all clients (broadcast model: tiny payloads).
+    opts.registry.on("upsert", (session) => broadcast(clients, { kind: "session_upsert", session }));
+    opts.registry.on("event", (event) => broadcast(clients, { kind: "session_event", event }));
+    opts.registry.on("remove", (sessionId) => broadcast(clients, { kind: "session_remove", sessionId }));
+    await app.listen({ port: opts.port, host: opts.host });
+    return app;
+}
+function broadcast(clients, frame) {
+    const payload = JSON.stringify(frame);
+    for (const sock of clients) {
+        if (sock.readyState === 1) {
+            try {
+                sock.send(payload);
+            }
+            catch { }
+        }
+    }
+}
+function extractToken(query, auth) {
+    if (query && typeof query.token === "string" && query.token.length > 0)
+        return query.token;
+    if (auth && auth.startsWith("Bearer "))
+        return auth.slice(7);
+    return undefined;
+}
+//# sourceMappingURL=server.js.map