@pablopunk/tau 0.0.0-stage → 0.1.1

package/dist/serve-Cmy0rUWr.js

@@ -0,0 +1,2932 @@
+import { $ as routes, A as changedFrame, C as LIVE_MAX_FRAME_BYTES, D as TERMINAL_STREAM_PATH, E as TERMINAL_STREAM_MAX_INPUT_BYTES, F as ERROR_STATUS, I as isAppError, J as LIVE_PATH, N as encodeFrame, O as TerminalClientFrameSchema, P as AppError, Q as iconCandidateUrl, R as toErrorBody, S as encodeDataFrame, T as TERMINAL_STREAM_CLOSE_UNKNOWN, X as PAIR_PAGE_PATH, Y as MESSAGE_BODY_LIMIT, b as chunkBody, d as CHUNK_BYTES, et as HUB_LINK_NONE, f as CREDIT_WINDOW_BYTES, i as createExitMarker, j as decodeClientFrame, k as WS_MAX_PAYLOAD_BYTES, m as LINK_CLOSE_UPDATE_REQUIRED, n as readRunningInstance, p as LINK_CLOSE_NO_CREDIT, r as createCore, rt as RETIRED_OPS, t as publishServerUrl, tt as MACHINE_PROXY_PREFIX, u as PROTOCOL_VERSION, v as LinkFrameSchema, w as TERMINAL_STREAM_CLOSE_SLOW, x as decodeDataFrame, y as MACHINE_LINK_PATH } from "./src-DO9LUlhi.js";
+import { n as waitForFreeHome } from "./wait-for-lock-CrSl2mi1.js";
+import { a as cliVersion, c as writePrivateFile, i as spawnCommand, n as fetchLatestVersion, o as readOrCreateToken, s as ensurePrivateDirectory } from "./latest-version-di9hD7cY.js";
+import { t as cliEntry } from "./cli-entry-DcDpQ30L.js";
+import { Worker } from "node:worker_threads";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { arch, homedir, hostname, platform } from "node:os";
+import { fileURLToPath } from "node:url";
+import { format, parseArgs } from "node:util";
+import { createHash, timingSafeEqual } from "node:crypto";
+import { readFile, rm } from "node:fs/promises";
+import { Value } from "typebox/value";
+import { createServer } from "node:net";
+import { request } from "node:http";
+import fastifyCookie from "@fastify/cookie";
+import fastifyWebsocket from "@fastify/websocket";
+import Fastify from "fastify";
+import fastifyStatic from "@fastify/static";
+import WebSocket from "ws";
+//#region ../protocol/src/machine-rules.ts
+const NO_CHAINS = "This tau is linked to a hub, so other machines cannot link to it. Disconnect it first.";
+const NO_LOOPS = "Other machines are linked to this tau, so it cannot link to a hub. Disconnect them first.";
+/** No chains, no loops (two-way): a tau that is linked to a hub never accepts machine links. */
+function acceptLinkRefusal(hub) {
+	return hub.state === "none" ? void 0 : NO_CHAINS;
+}
+/** `tau connect` is refused when this tau already has linked machines. */
+function connectRefusal(linkedMachines) {
+	return linkedMachines > 0 ? NO_LOOPS : void 0;
+}
+/** `tau connect` is also refused when this tau already has a hub (one hub at a time). */
+function alreadyLinkedRefusal(hasHubFile) {
+	return hasHubFile ? "This tau is already linked to a hub. Run `tau disconnect` first." : void 0;
+}
+//#endregion
+//#region ../core/src/remote/tunnel-target.ts
+function createTunnelTargetRef() {
+	let resolve = () => void 0;
+	const target = new Promise((done) => {
+		resolve = done;
+	});
+	return {
+		get: () => target,
+		set: (port) => resolve(`127.0.0.1:${port}`)
+	};
+}
+//#endregion
+//#region ../core/src/watchdog/start-watchdog.ts
+const BEAT_MS = 1e3;
+/** Beats a shared counter once a second from the main thread; a worker kills the process when it stops moving. */
+function startWatchdog(options) {
+	const counter = new SharedArrayBuffer(4);
+	const view = new Int32Array(counter);
+	const data = {
+		counter,
+		lastExitFile: options.lastExitFile,
+		logFile: options.logFile,
+		tickMs: options.tickMs,
+		stallTicks: options.stallTicks
+	};
+	const worker = new Worker(options.workerUrl, { workerData: data });
+	worker.unref();
+	const beat = setInterval(() => Atomics.add(view, 0, 1), BEAT_MS);
+	beat.unref();
+	return { async stop() {
+		clearInterval(beat);
+		await worker.terminate();
+	} };
+}
+//#endregion
+//#region src/machines/hub-file.ts
+const hubFilePath = (home) => join(home, "hub.json");
+function isHubFile(value) {
+	const file = value;
+	return typeof file?.hubUrl === "string" && typeof file.machineSecret === "string" && typeof file.name === "string";
+}
+function createHubFileStore(home) {
+	const path = hubFilePath(home);
+	return {
+		async read() {
+			try {
+				const parsed = JSON.parse(await readFile(path, "utf8"));
+				return isHubFile(parsed) ? parsed : void 0;
+			} catch {
+				return;
+			}
+		},
+		write: (file) => writePrivateFile(path, `${JSON.stringify(file)}\n`),
+		delete: () => rm(path, { force: true })
+	};
+}
+//#endregion
+//#region src/lifecycle/flags.ts
+function portOf$1(raw) {
+	if (raw === void 0) return void 0;
+	const port = Number(raw);
+	if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error(`Invalid --port: ${raw}`);
+	return port;
+}
+/** The flags the lifecycle commands read; others (`--faux`) are left alone. */
+function lifecycleFlagsOf(argv, defaults) {
+	const { values } = parseArgs({
+		args: [...argv],
+		strict: false,
+		options: {
+			home: { type: "string" },
+			port: { type: "string" },
+			"no-open": { type: "boolean" },
+			json: { type: "boolean" },
+			follow: {
+				type: "boolean",
+				short: "f"
+			}
+		}
+	});
+	return {
+		home: typeof values.home === "string" ? values.home : defaults.env.TAU_HOME ?? defaults.defaultHome,
+		explicitPort: portOf$1(typeof values.port === "string" ? values.port : void 0),
+		open: values["no-open"] !== true,
+		json: values.json === true,
+		follow: values.follow === true
+	};
+}
+//#endregion
+//#region src/options.ts
+const DEFAULT_PORT = 4317;
+const MAX_PORT$1 = 65535;
+const defaultHome = () => join(homedir(), ".tau");
+function parsePort(raw) {
+	if (raw === void 0) return DEFAULT_PORT;
+	const port = Number(raw);
+	if (!Number.isInteger(port) || port < 1 || port > MAX_PORT$1) throw new Error(`Invalid --port: ${raw}`);
+	return port;
+}
+const SERVER_FLAGS = {
+	port: { type: "string" },
+	"no-open": {
+		type: "boolean",
+		default: false
+	},
+	home: { type: "string" },
+	faux: {
+		type: "boolean",
+		default: false
+	},
+	service: {
+		type: "boolean",
+		default: false
+	}
+};
+/** The server flags of `serve` and `start`: `--port`, `--home`, `--faux`, `--no-open`, `--service`. */
+function parseCliOptions(argv, env = process.env) {
+	const { values } = parseArgs({
+		args: [...argv],
+		options: SERVER_FLAGS
+	});
+	return {
+		port: parsePort(values.port),
+		open: !values["no-open"],
+		home: values.home ?? env.TAU_HOME ?? defaultHome(),
+		faux: values.faux || env.TAU_FAUX === "1",
+		service: values.service
+	};
+}
+/** The command word (the first positional) and the argv without it. Unknown flags do not stop the scan. */
+function commandWordOf(argv) {
+	const { positionals } = parseArgs({
+		args: [...argv],
+		options: SERVER_FLAGS,
+		allowPositionals: true,
+		strict: false
+	});
+	const word = positionals[0];
+	if (word === void 0) return {
+		word,
+		rest: argv
+	};
+	const index = argv.indexOf(word);
+	return {
+		word,
+		rest: [...argv.slice(0, index), ...argv.slice(index + 1)]
+	};
+}
+//#endregion
+//#region src/lifecycle/port-store.ts
+const portFileOf = (home) => join(home, "port");
+function readStoredPort(home) {
+	try {
+		const port = Number(readFileSync(portFileOf(home), "utf8").trim());
+		return Number.isInteger(port) && port >= 1 && port <= 65535 ? port : void 0;
+	} catch {
+		return;
+	}
+}
+function writeStoredPort(home, port) {
+	mkdirSync(home, { recursive: true });
+	writeFileSync(portFileOf(home), `${port}\n`);
+}
+/** `--port` wins and is stored; otherwise the stored port; otherwise the default. */
+function resolvePort(home, explicitPort) {
+	if (explicitPort !== void 0) {
+		writeStoredPort(home, explicitPort);
+		return explicitPort;
+	}
+	return readStoredPort(home) ?? 4317;
+}
+//#endregion
+//#region src/logging/rotating-log.ts
+const MAX_LOG_BYTES = 10485760;
+const serverLogOf = (home) => join(home, "logs", "server.log");
+const sizeOf = (file) => {
+	try {
+		return statSync(file).size;
+	} catch {
+		return 0;
+	}
+};
+/** Appends to `file`; past `maxBytes` the file becomes `<file>.1` (one old file is kept). */
+function createRotatingLog(file, maxBytes = MAX_LOG_BYTES) {
+	mkdirSync(dirname(file), { recursive: true });
+	return { write(text) {
+		if (sizeOf(file) + Buffer.byteLength(text) > maxBytes) renameSync(file, `${file}.1`);
+		appendFileSync(file, text);
+	} };
+}
+//#endregion
+//#region ../server/src/error-handler.ts
+function isClientError(error) {
+	return error.validation !== void 0 || error.statusCode !== void 0 && error.statusCode < 500;
+}
+function toAppError(error) {
+	if (isAppError(error)) return error;
+	if (error.code === "FST_ERR_CTP_BODY_TOO_LARGE") return new AppError("too_large", "The request is too large.");
+	if (isClientError(error)) return new AppError("invalid_request", error.message);
+	return new AppError("internal", "Internal error");
+}
+function handleError(error, request, reply) {
+	const appError = toAppError(error);
+	if (appError.code === "internal") request.log.error(error);
+	return reply.code(ERROR_STATUS[appError.code]).send(toErrorBody(appError));
+}
+function sendApiNotFound(reply) {
+	return reply.code(ERROR_STATUS.not_found).send(toErrorBody(new AppError("not_found", "Unknown route")));
+}
+//#endregion
+//#region ../server/src/ws-frame-cap.ts
+const MESSAGE_TOO_BIG = 1009;
+function rawLength(data) {
+	if (Array.isArray(data)) return data.reduce((total, part) => total + part.length, 0);
+	return data instanceof ArrayBuffer ? data.byteLength : data.length;
+}
+/**
+* Must be the first line of every message handler: the shared server accepts up to `WS_MAX_PAYLOAD_BYTES`,
+* so each route refuses its own oversize frames, before any `toString()` or parse. Returns true when it closed.
+*/
+function closeIfOversized(socket, data, capBytes) {
+	if (rawLength(data) <= capBytes) return false;
+	socket.close(MESSAGE_TOO_BIG, "frame too large");
+	return true;
+}
+//#endregion
+//#region ../server/src/live/backpressure.ts
+const HIGH_WATER_MARK_BYTES = 1048576;
+const POLL_MS = 10;
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** Resolves once the socket's send buffer has drained (or the socket is no longer open). */
+async function waitForDrain(socket) {
+	while (socket.readyState === socket.OPEN && socket.bufferedAmount > HIGH_WATER_MARK_BYTES) await sleep(POLL_MS);
+}
+//#endregion
+//#region ../server/src/live/connection.ts
+const POLICY_VIOLATION$3 = 1008;
+/** One browser tab: its conversation subscriptions plus the shared `changed` broadcasts. */
+var LiveConnection = class {
+	socket;
+	core;
+	onError;
+	subscriptions = /* @__PURE__ */ new Map();
+	stopListeningForChanges;
+	constructor(socket, core, onError) {
+		this.socket = socket;
+		this.core = core;
+		this.onError = onError;
+		this.stopListeningForChanges = core.onChange((change) => this.sendChange(change));
+		socket.on("message", (data) => {
+			if (closeIfOversized(socket, data, 65536)) return;
+			this.handleMessage(data.toString());
+		});
+		socket.on("close", () => void this.dispose());
+		socket.on("error", onError);
+	}
+	sendChange(change) {
+		this.send(changedFrame(change));
+	}
+	sendOps(conversationId, ops) {
+		this.send({
+			type: "ops",
+			conversationId,
+			ops
+		});
+	}
+	send(frame) {
+		if (this.socket.readyState === this.socket.OPEN) this.socket.send(encodeFrame(frame));
+	}
+	handleMessage(raw) {
+		const frame = decodeClientFrame(raw);
+		if (!frame) return void this.socket.close(POLICY_VIOLATION$3, "invalid frame");
+		if (frame.type === "subscribe") this.subscribe(frame.conversationId);
+		else this.unsubscribe(frame.conversationId).catch(this.onError);
+	}
+	subscribe(conversationId) {
+		if (this.subscriptions.has(conversationId)) return;
+		const subscription = {
+			cancelled: false,
+			watcher: Promise.resolve(void 0)
+		};
+		subscription.watcher = this.startWatching(conversationId, subscription);
+		this.subscriptions.set(conversationId, subscription);
+	}
+	async startWatching(conversationId, subscription) {
+		const forward = async (ops) => {
+			if (subscription.cancelled) return;
+			await waitForDrain(this.socket);
+			if (!subscription.cancelled) this.sendOps(conversationId, ops);
+		};
+		try {
+			const watcher = await this.core.conversations.watch(conversationId, forward);
+			if (!subscription.cancelled) return watcher;
+			await watcher.stop();
+		} catch (error) {
+			if (!isAppError(error)) this.onError(error);
+			else if (!subscription.cancelled) this.sendOps(conversationId, RETIRED_OPS);
+		}
+	}
+	async unsubscribe(conversationId) {
+		const subscription = this.subscriptions.get(conversationId);
+		if (!subscription) return;
+		this.subscriptions.delete(conversationId);
+		subscription.cancelled = true;
+		await (await subscription.watcher)?.stop();
+	}
+	async dispose() {
+		this.stopListeningForChanges();
+		await Promise.all([...this.subscriptions.keys()].map((id) => this.unsubscribe(id).catch(this.onError)));
+	}
+};
+//#endregion
+//#region ../server/src/live/register-live.ts
+function registerLive(app, core, sockets) {
+	app.get(LIVE_PATH, { websocket: true }, (socket, request) => {
+		if (!sockets.add(request.deviceId, socket)) return;
+		new LiveConnection(socket, core, (error) => request.log.error(error));
+	});
+}
+//#endregion
+//#region ../server/src/machines/link-stream.ts
+function newStream(id, now, handlers, ready) {
+	return {
+		id,
+		credit: CREDIT_WINDOW_BYTES,
+		pending: [],
+		pendingBytes: 0,
+		ready,
+		progressAt: now,
+		inFlight: 0,
+		owed: 0,
+		...handlers
+	};
+}
+function enqueue(stream, frame) {
+	stream.pending.push(frame);
+	stream.pendingBytes += frame.payload.byteLength;
+}
+function isBlocked(stream) {
+	const head = stream.pending[0];
+	return head !== void 0 && (!stream.ready || stream.credit < head.payload.byteLength);
+}
+//#endregion
+//#region ../server/src/machines/link-request.ts
+const MAX_RESPONSE_BYTES = 268435456;
+const OFFLINE = "This machine is offline.";
+/** One proxied HTTP call over a link: body out under the machine's credit, response in under ours. */
+function proxyRequest(session, request) {
+	return new Promise((resolve, reject) => {
+		const id = session.allocateId();
+		const chunks = [];
+		let received = 0;
+		let head;
+		const finish = (error) => {
+			session.removeStream(id);
+			if (error) reject(error);
+		};
+		const stream = newStream(id, Date.now(), {
+			onData(frame) {
+				received += frame.payload.byteLength;
+				if (received > MAX_RESPONSE_BYTES) {
+					session.sendControl({
+						type: "close",
+						id,
+						code: 1009,
+						reason: "response too large"
+					});
+					return finish(new AppError("too_large", "The machine's response is too large."));
+				}
+				chunks.push(Buffer.from(frame.payload));
+				stream.owed += frame.payload.byteLength;
+				if (!frame.end) return session.returnCredit(stream);
+				session.removeStream(id);
+				if (head) resolve({
+					...head,
+					body: Buffer.concat(chunks)
+				});
+				else reject(new AppError("internal", "The machine answered without a response."));
+			},
+			onClose: (_code, reason) => finish(new AppError(reason === "machine went away" ? "not_found" : "internal", OFFLINE)),
+			onStalled() {
+				session.sendControl({
+					type: "close",
+					id,
+					code: 1013,
+					reason: "no credit"
+				});
+				finish(new AppError("not_found", "The machine stopped answering."));
+			}
+		}, true);
+		stream.onResponse = (status, headers) => {
+			head = {
+				status,
+				headers
+			};
+		};
+		const body = request.body && request.body.length > 0 ? request.body : void 0;
+		session.addStream(stream);
+		session.sendControl({
+			type: "request",
+			id,
+			method: request.method,
+			path: request.path,
+			query: request.query,
+			hubDevice: request.hubDevice.slice(0, 120),
+			...request.contentType ? { contentType: request.contentType } : {},
+			...body ? { bodyBytes: body.length } : {}
+		});
+		if (body) for (const frame of chunkBody(id, body)) enqueue(stream, frame);
+		session.pump();
+	});
+}
+//#endregion
+//#region ../server/src/machines/link-session.ts
+const TICK_MS$1 = 1e3;
+const HEARTBEAT_EVERY_MS = 1e3;
+const PUMP_RETRY_MS = 5;
+const LINK_HIGH_WATER = 2 * CHUNK_BYTES;
+const CREDIT_BATCH_BYTES = 65536;
+const POLICY_VIOLATION$2 = 1008;
+const GOING_AWAY$1 = 1001;
+const INTERNAL$1 = 1011;
+function toBytes$1(data) {
+	if (Array.isArray(data)) return Buffer.concat(data);
+	return data instanceof ArrayBuffer ? Buffer.from(data) : data;
+}
+/** One machine's link: control frames, round-robin sending under credit, 15 s pings, 45 s silence. */
+var LinkSession = class {
+	machineId;
+	socket;
+	core;
+	events;
+	streams = /* @__PURE__ */ new Map();
+	registered = false;
+	nextId = 1;
+	lastFrameAt = Date.now();
+	lastPingAt = Date.now();
+	lastHeartbeatAt = 0;
+	pumpTimer;
+	ticker;
+	ended = false;
+	constructor(machineId, socket, core, events) {
+		this.machineId = machineId;
+		this.socket = socket;
+		this.core = core;
+		this.events = events;
+		socket.on("message", (data, isBinary) => this.receive(data, isBinary));
+		socket.on("close", () => this.end());
+		socket.on("error", () => void 0);
+		this.ticker = setInterval(() => this.tick(), TICK_MS$1);
+		this.ticker.unref();
+	}
+	allocateId() {
+		return this.nextId++;
+	}
+	addStream(stream) {
+		this.streams.set(stream.id, stream);
+	}
+	sendControl(frame) {
+		if (this.socket.readyState === this.socket.OPEN) this.socket.send(JSON.stringify(frame));
+	}
+	removeStream(id) {
+		this.streams.delete(id);
+	}
+	/** Sends credit for bytes consumed, batched; always when nothing is in flight so the sender never starves. */
+	returnCredit(stream) {
+		if (stream.owed <= 0) return;
+		if (stream.owed < CREDIT_BATCH_BYTES && stream.inFlight > 0) return;
+		this.sendControl({
+			type: "credit",
+			id: stream.id,
+			bytes: stream.owed
+		});
+		stream.owed = 0;
+	}
+	/** One chunk per ready stream per pass, until the link buffer is full or no stream can send. */
+	pump() {
+		if (this.ended) return;
+		let progressed = true;
+		while (progressed) {
+			progressed = false;
+			for (const stream of [...this.streams.values()]) {
+				if (this.socket.bufferedAmount > LINK_HIGH_WATER) {
+					this.schedulePump();
+					return;
+				}
+				progressed = this.sendOne(stream) || progressed;
+			}
+		}
+	}
+	close(code, reason) {
+		if (this.socket.readyState === this.socket.OPEN) this.socket.close(code, reason);
+		this.end();
+	}
+	sendOne(stream) {
+		const frame = stream.pending[0];
+		if (!frame || isBlocked(stream)) return false;
+		stream.pending.shift();
+		stream.pendingBytes -= frame.payload.byteLength;
+		stream.credit -= frame.payload.byteLength;
+		stream.progressAt = Date.now();
+		this.socket.send(encodeDataFrame(frame));
+		if (stream.pendingBytes < 1048576) stream.onDrained?.();
+		return true;
+	}
+	schedulePump() {
+		if (this.pumpTimer) return;
+		this.pumpTimer = setTimeout(() => {
+			this.pumpTimer = void 0;
+			this.pump();
+		}, PUMP_RETRY_MS);
+	}
+	receive(data, isBinary) {
+		const now = Date.now();
+		this.lastFrameAt = now;
+		if (now - this.lastHeartbeatAt >= HEARTBEAT_EVERY_MS) {
+			this.lastHeartbeatAt = now;
+			this.core.machines.heartbeat(this.machineId);
+		}
+		const bytes = toBytes$1(data);
+		if (isBinary) {
+			this.receiveData(bytes);
+			return;
+		}
+		let frame;
+		try {
+			frame = JSON.parse(bytes.toString("utf8"));
+		} catch {
+			this.close(POLICY_VIOLATION$2, "bad frame");
+			return;
+		}
+		if (!Value.Check(LinkFrameSchema, frame)) {
+			this.close(POLICY_VIOLATION$2, "bad frame");
+			return;
+		}
+		this.receiveControl(frame);
+	}
+	receiveData(bytes) {
+		const frame = decodeDataFrame(bytes);
+		const stream = frame && this.streams.get(frame.id);
+		if (!frame || !stream) return;
+		stream.ready = true;
+		stream.onData(frame);
+	}
+	receiveControl(frame) {
+		switch (frame.type) {
+			case "hello":
+				this.register(frame);
+				return;
+			case "ping":
+				this.sendControl({ type: "pong" });
+				return;
+			case "credit": {
+				const stream = this.streams.get(frame.id);
+				if (!stream) return;
+				stream.credit += frame.bytes;
+				stream.progressAt = Date.now();
+				this.pump();
+				return;
+			}
+			case "open": {
+				const stream = this.streams.get(frame.id);
+				if (stream) stream.ready = true;
+				this.pump();
+				return;
+			}
+			case "response":
+				this.streams.get(frame.id)?.onResponse?.(frame.status, frame.headers);
+				return;
+			case "close":
+				this.streams.get(frame.id)?.onClose(frame.code, frame.reason);
+				return;
+			default: return;
+		}
+	}
+	async register(frame) {
+		if (this.registered) return;
+		const { type: _type, ...hello } = frame;
+		try {
+			const machine = await this.core.machines.register(this.machineId, hello);
+			this.registered = true;
+			if (machine.status === "update-required") this.close(LINK_CLOSE_UPDATE_REQUIRED, "update required");
+		} catch {
+			this.close(INTERNAL$1, "register failed");
+		}
+	}
+	tick() {
+		const now = Date.now();
+		if (now - this.lastFrameAt >= 45e3) {
+			this.close(GOING_AWAY$1, "no frames");
+			return;
+		}
+		if (now - this.lastPingAt >= 15e3) {
+			this.lastPingAt = now;
+			this.sendControl({ type: "ping" });
+			this.core.machines.heartbeat(this.machineId);
+		}
+		for (const stream of [...this.streams.values()]) this.checkStalled(stream, now);
+	}
+	checkStalled(stream, now) {
+		if ((isBlocked(stream) || stream.inFlight > 0) && now - stream.progressAt >= 6e4) stream.onStalled();
+	}
+	end() {
+		if (this.ended) return;
+		this.ended = true;
+		clearInterval(this.ticker);
+		if (this.pumpTimer) clearTimeout(this.pumpTimer);
+		for (const stream of [...this.streams.values()]) stream.onClose(GOING_AWAY$1, "machine went away");
+		this.streams.clear();
+		this.events.onEnded();
+	}
+};
+//#endregion
+//#region ../server/src/machines/link-socket.ts
+const GOING_AWAY = 1001;
+const INTERNAL = 1011;
+/** Close codes `ws` accepts on the wire; anything else (1005, 1006, 1015, junk) becomes 1011. */
+function wireCloseCode(code) {
+	return code >= 1e3 && code <= 1003 || code >= 1007 && code <= 1014 || code >= 3e3 && code <= 4999 ? code : INTERNAL;
+}
+function clip(reason) {
+	return Buffer.from(reason).subarray(0, 123).toString("utf8").replace(/\uFFFD+$/, "");
+}
+/** Pipes a browser socket to a stream on the machine. Browser frames queue until the machine confirms `open`. */
+function pipeSocket(session, request, socket) {
+	const id = session.allocateId();
+	let machineClosed = false;
+	const closeBrowser = (code, reason) => {
+		if (socket.readyState === socket.OPEN || socket.readyState === socket.CONNECTING) socket.close(wireCloseCode(code), clip(reason));
+	};
+	const stream = newStream(id, Date.now(), {
+		onData(frame) {
+			if (socket.readyState !== socket.OPEN) return;
+			const size = frame.payload.byteLength;
+			if (stream.inFlight === 0) stream.progressAt = Date.now();
+			stream.inFlight += size;
+			socket.send(Buffer.from(frame.payload), { binary: !frame.text }, () => {
+				stream.inFlight -= size;
+				stream.owed += size;
+				stream.progressAt = Date.now();
+				session.returnCredit(stream);
+			});
+		},
+		onClose(code, reason) {
+			machineClosed = true;
+			session.removeStream(id);
+			closeBrowser(code === GOING_AWAY ? LINK_CLOSE_NO_CREDIT : code, reason);
+		},
+		onStalled() {
+			session.sendControl({
+				type: "close",
+				id,
+				code: LINK_CLOSE_NO_CREDIT,
+				reason: "no credit"
+			});
+			session.removeStream(id);
+			closeBrowser(LINK_CLOSE_NO_CREDIT, "stalled");
+		}
+	}, false);
+	stream.onDrained = () => {
+		if (typeof socket.resume === "function") socket.resume();
+	};
+	session.addStream(stream);
+	socket.on("message", (data, isBinary) => {
+		if (socket.readyState !== socket.OPEN) return;
+		const payload = Array.isArray(data) ? Buffer.concat(data) : Buffer.from(data);
+		if (payload.byteLength > 262144) return;
+		enqueue(stream, {
+			id,
+			end: false,
+			text: !isBinary,
+			payload
+		});
+		if (stream.pendingBytes >= 1048576 && typeof socket.pause === "function") socket.pause();
+		session.pump();
+	});
+	socket.on("close", (code, reason) => {
+		if (machineClosed) return;
+		machineClosed = true;
+		session.removeStream(id);
+		session.sendControl({
+			type: "close",
+			id,
+			code: wireCloseCode(code),
+			reason: clip(reason.toString())
+		});
+	});
+	socket.on("error", () => void 0);
+	session.sendControl({
+		type: "open",
+		id,
+		path: request.path,
+		query: request.query,
+		hubDevice: request.hubDevice.slice(0, 120)
+	});
+}
+//#endregion
+//#region ../server/src/machines/create-gateway.ts
+const NOT_LINKED = "This machine is offline.";
+const TRY_AGAIN_LATER = 1013;
+const REPLACED = 1e3;
+const REVOKED = 1008;
+/** The real multiplexer: one `LinkSession` per machine; a newer link replaces an older one. */
+function createMachineGateway(core) {
+	const sessions = /* @__PURE__ */ new Map();
+	const online = (machineId) => {
+		const session = sessions.get(machineId);
+		return session?.registered ? session : void 0;
+	};
+	return {
+		acceptLink(machineId, socket) {
+			sessions.get(machineId)?.close(REPLACED, "replaced by a new link");
+			const session = new LinkSession(machineId, socket, core, { onEnded() {
+				if (sessions.get(machineId) !== session) return;
+				sessions.delete(machineId);
+				core.machines.markOffline(machineId);
+			} });
+			sessions.set(machineId, session);
+		},
+		isOnline: (machineId) => online(machineId) !== void 0,
+		request(machineId, request) {
+			const session = online(machineId);
+			if (!session) return Promise.reject(new AppError("not_found", NOT_LINKED));
+			return proxyRequest(session, request);
+		},
+		openStream(machineId, request, socket) {
+			const session = online(machineId);
+			if (!session) return void socket.close(TRY_AGAIN_LATER, "machine offline");
+			pipeSocket(session, request, socket);
+		},
+		closeMachine(machineId) {
+			sessions.get(machineId)?.close(REVOKED, "revoked");
+		}
+	};
+}
+//#endregion
+//#region ../server/src/machines/device-labels.ts
+const MAX_LABEL = 120;
+/** Device names for the audit header `x-tau-hub-device`; the device id until the list is read or for an unknown one. */
+function createDeviceLabels(core) {
+	const names = /* @__PURE__ */ new Map();
+	const refresh = () => Promise.resolve().then(() => core.access.listDevices()).then((devices) => {
+		names.clear();
+		for (const device of devices) names.set(device.id, device.name);
+	}).catch(() => void 0);
+	refresh();
+	return {
+		label: (deviceId) => (names.get(deviceId) ?? deviceId).replace(/\p{Cc}/gu, " ").slice(0, MAX_LABEL),
+		stop: core.onChange((change) => {
+			if (change.resource === "devices") refresh();
+		})
+	};
+}
+//#endregion
+//#region ../server/src/security/allow-list.ts
+const LOCAL_NAMES = ["127.0.0.1", "localhost"];
+function allowListForPort(port) {
+	let tunnel;
+	return {
+		localHosts: new Set(LOCAL_NAMES.map((name) => `${name}:${port}`)),
+		localOrigins: new Set(LOCAL_NAMES.map((name) => `http://${name}:${port}`)),
+		tunnelHostname: () => tunnel,
+		setTunnelHostname: (hostname) => {
+			tunnel = hostname?.toLowerCase();
+		}
+	};
+}
+function isAllowedLocalHost(list, host) {
+	return host !== void 0 && list.localHosts.has(host.toLowerCase());
+}
+function isAllowedLocalOrigin(list, origin) {
+	return origin !== void 0 && list.localOrigins.has(origin.toLowerCase());
+}
+/** On a tagged socket the only Host is exactly the tunnel hostname. */
+function isTunnelHost(list, host) {
+	const hostname = list.tunnelHostname();
+	return hostname !== void 0 && host?.toLowerCase() === hostname;
+}
+/** On a tagged socket the only Origin is `https://<hostname>`. */
+function isTunnelOrigin(list, origin) {
+	const hostname = list.tunnelHostname();
+	return hostname !== void 0 && origin?.toLowerCase() === `https://${hostname}`;
+}
+/** The hostname of a tunnel URL, lowercased; `undefined` for no URL. */
+function hostnameOfUrl(url) {
+	return url === null ? void 0 : new URL(url).hostname.toLowerCase();
+}
+//#endregion
+//#region ../server/src/security/link-limits.ts
+const FAILURE_LIMIT = 5;
+const WINDOW_MS = 6e4;
+const LOCK_MS = 6e5;
+function createLinkLimits(now = Date.now) {
+	const records = /* @__PURE__ */ new Map();
+	return {
+		locked: (peer) => (records.get(peer)?.lockedUntil ?? 0) > now(),
+		recordFailure(peer) {
+			const record = records.get(peer) ?? {
+				at: [],
+				lockedUntil: 0
+			};
+			record.at = [...record.at.filter((time) => now() - time < WINDOW_MS), now()];
+			if (record.at.length >= FAILURE_LIMIT) record.lockedUntil = now() + LOCK_MS;
+			records.set(peer, record);
+		}
+	};
+}
+//#endregion
+//#region ../server/src/security/request-info.ts
+function pathOf(request) {
+	return request.url.split("?")[0] ?? "";
+}
+function isApiPath(request) {
+	const path = pathOf(request);
+	return path === "/api" || path.startsWith(`/api/`);
+}
+function isWebSocketUpgrade(request) {
+	return request.headers.upgrade?.toLowerCase() === "websocket";
+}
+function needsOriginCheck(request) {
+	return request.method !== "GET" || isWebSocketUpgrade(request);
+}
+function hasBody(request) {
+	return Number(request.headers["content-length"] ?? 0) > 0 || request.headers["transfer-encoding"] !== void 0;
+}
+const JSON_CONTENT_TYPE = /^application\/json\s*(;|$)/i;
+function rejectApi(reply, error) {
+	return reply.code(ERROR_STATUS[error.code]).send(toErrorBody(error));
+}
+function rejectContentType(request, reply) {
+	if (!hasBody(request) || JSON_CONTENT_TYPE.test(request.headers["content-type"] ?? "")) return;
+	rejectApi(reply, new AppError("invalid_request", "Content-Type must be application/json"));
+}
+/** The unauthenticated surface, on every socket: the pair page, redeem and health. Nothing else. */
+function isOpenSurface(request) {
+	const path = pathOf(request);
+	if (request.method === "GET") return path === "/pair" || path === routes.getHealth.path;
+	return request.method === "POST" && path === routes.redeemPairing.path;
+}
+const BEARER = /^Bearer ([^\s]+)$/i;
+function bearerOf(request) {
+	return BEARER.exec(request.headers.authorization ?? "")?.[1];
+}
+/** Exactly `GET /api/machines/link` with `Upgrade: websocket`: the only place a machine secret is looked at. */
+function isMachineLink(request) {
+	return request.method === "GET" && pathOf(request) === MACHINE_LINK_PATH && isWebSocketUpgrade(request);
+}
+//#endregion
+//#region ../server/src/security/session-start-page.ts
+/** Same-origin page that lands the cookie, then moves on. A 302 can lose a SameSite=Strict cookie when the link comes from another app. */
+const SESSION_START_PAGE = `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="referrer" content="no-referrer" />
+    <title>tau</title>
+  </head>
+  <body>
+    <script>location.replace("/");<\/script>
+    <noscript><a href="/">Continue to tau</a></noscript>
+  </body>
+</html>
+`;
+//#endregion
+//#region ../server/src/security/unauthorized-page.ts
+const UNAUTHORIZED_PAGE = `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>tau</title>
+  </head>
+  <body style="font-family: system-ui, sans-serif; max-width: 32rem; margin: 4rem auto; padding: 0 1rem">
+    <h1>Not signed in</h1>
+    <p>Open the URL printed in your terminal.</p>
+  </body>
+</html>
+`;
+//#endregion
+//#region ../server/src/security/guard.ts
+const DEVICE_COOKIE = "tau_device";
+const OWNER_DEVICE_ID = "owner";
+const LOCAL_PEER$1 = "local";
+function forbid(reply, what) {
+	reply.code(403).type("text/plain").send(`Forbidden ${what}`);
+}
+function sendUnauthenticated(request, reply) {
+	if (isApiPath(request)) return rejectApi(reply, new AppError("unauthorized", "Open the URL printed in your terminal"));
+	return reply.code(401).type("text/html; charset=utf-8").send(UNAUTHORIZED_PAGE);
+}
+async function authenticateDevice(ctx, request) {
+	const secret = request.cookies[DEVICE_COOKIE];
+	const verified = secret ? await ctx.access.verifyDevice(secret) : void 0;
+	if (!verified) return false;
+	request.deviceId = verified.deviceId;
+	ctx.access.touch(verified.deviceId);
+	return true;
+}
+/** Machine branch: a rate-limit check by peer BEFORE the hash lookup; only a machine secret passes, never a cookie. */
+async function authenticateMachine(ctx, limits, request) {
+	const peer = ctx.tunnel.tagOf(request.raw.socket)?.peer ?? LOCAL_PEER$1;
+	if (limits.locked(peer)) return false;
+	const secret = bearerOf(request);
+	const verified = secret ? await ctx.access.verifyMachine(secret) : void 0;
+	if (!verified) {
+		limits.recordFailure(peer);
+		return false;
+	}
+	request.deviceId = verified.deviceId;
+	ctx.access.touch(verified.deviceId);
+	return true;
+}
+/** A tagged socket came through the tunnel: only the tunnel Host and Origin, only a device cookie. */
+async function guardTunneled(ctx, limits, request, reply) {
+	const list = ctx.hostnames();
+	if (!isTunnelHost(list, request.headers.host)) return forbid(reply, "host");
+	const { origin } = request.headers;
+	const originOk = isTunnelOrigin(list, origin);
+	if (needsOriginCheck(request) && !originOk || origin !== void 0 && !originOk) return forbid(reply, "origin");
+	if (isOpenSurface(request)) return rejectContentType(request, reply);
+	if (isMachineLink(request)) {
+		if (!await authenticateMachine(ctx, limits, request)) return sendUnauthenticated(request, reply);
+		return;
+	}
+	if (!await authenticateDevice(ctx, request)) return sendUnauthenticated(request, reply);
+	rejectContentType(request, reply);
+}
+function hasForeignOrigin(list, request) {
+	const { origin } = request.headers;
+	return origin !== void 0 && !isAllowedLocalOrigin(list, origin);
+}
+function startSession(ctx, reply, token) {
+	reply.setCookie(ctx.session.cookieName, token, {
+		httpOnly: true,
+		sameSite: "strict",
+		path: "/"
+	}).header("cache-control", "no-store").type("text/html; charset=utf-8").send(SESSION_START_PAGE);
+}
+/** An untagged socket is loopback: the master token works, and device cookies too. */
+async function guardLocal(ctx, limits, request, reply) {
+	const list = ctx.hostnames();
+	if (!isAllowedLocalHost(list, request.headers.host)) return forbid(reply, "host");
+	if (request.headers.authorization !== void 0) {
+		const master = ctx.session.isValidToken(bearerOf(request));
+		if (!master && !isMachineLink(request)) return sendUnauthenticated(request, reply);
+		if (hasForeignOrigin(list, request)) return forbid(reply, "origin");
+		if (!master) {
+			if (!await authenticateMachine(ctx, limits, request)) return sendUnauthenticated(request, reply);
+			return;
+		}
+		request.deviceId = OWNER_DEVICE_ID;
+		return rejectContentType(request, reply);
+	}
+	if (needsOriginCheck(request) && !isAllowedLocalOrigin(list, request.headers.origin)) return forbid(reply, "origin");
+	if (isOpenSurface(request)) return rejectContentType(request, reply);
+	const { token } = request.query;
+	if (request.method === "GET" && !isApiPath(request) && ctx.session.isValidToken(token)) return startSession(ctx, reply, token);
+	if (ctx.session.isValidToken(request.cookies[ctx.session.cookieName])) {
+		request.deviceId = OWNER_DEVICE_ID;
+		return rejectContentType(request, reply);
+	}
+	if (isMachineLink(request) || !await authenticateDevice(ctx, request)) return sendUnauthenticated(request, reply);
+	rejectContentType(request, reply);
+}
+/** Runs before routing. Provenance is the socket (`ctx.tunnel`), never a header. */
+function createGuard(ctx, limits = createLinkLimits()) {
+	return async function guard(request, reply) {
+		if (ctx.tunnel.tagOf(request.raw.socket)) return guardTunneled(ctx, limits, request, reply);
+		return guardLocal(ctx, limits, request, reply);
+	};
+}
+//#endregion
+//#region ../server/src/machines/register-link.ts
+const POLICY_VIOLATION$1 = 1008;
+/**
+* `GET /api/machines/link`: an ordinary guarded WebSocket route on the shared server (no second WebSocketServer).
+* The guard already accepted a machine secret and set `request.deviceId` to the machine's device id; the owner
+* (master token) may reach this handler too and is refused here. Registered in `sockets` so a revoke closes the link.
+* Owner G: replace the stub gateway; the guard, caps and registration stay.
+*/
+function registerMachineLink(app, { core, sockets, gateway }) {
+	app.get(MACHINE_LINK_PATH, { websocket: true }, async (socket, request) => {
+		if (request.deviceId === "owner") return void socket.close(POLICY_VIOLATION$1, "machines only");
+		if (acceptLinkRefusal(await core.machines.hubState())) return void socket.close(POLICY_VIOLATION$1, "hub is linked");
+		if (!sockets.add(request.deviceId, socket)) return;
+		gateway.acceptLink(request.deviceId, socket);
+	});
+}
+//#endregion
+//#region ../server/src/rest/define-route.ts
+/** Registers one frozen protocol route; schemas come from the protocol, so the handler input is fully typed. */
+function defineRoute(app, route, handler) {
+	app.route({
+		method: route.method,
+		url: route.path,
+		...route.bodyLimit && { bodyLimit: route.bodyLimit },
+		schema: {
+			...route.params && { params: route.params },
+			...route.query && { querystring: route.query },
+			...route.body && { body: route.body }
+		},
+		handler: async (request, reply) => {
+			const output = await handler({
+				params: request.params,
+				query: request.query,
+				body: request.body
+			}, request);
+			reply.code(route.status);
+			if (route.status === 204) return reply.send();
+			return output === null ? reply.type("application/json").send("null") : output;
+		}
+	});
+}
+//#endregion
+//#region ../server/src/machines/register-machine-routes.ts
+/** The hub's own machine routes (denylisted from the proxy, so they always answer about THIS tau). */
+function registerMachineRoutes(app, { core, sockets, gateway }) {
+	defineRoute(app, routes.listMachines, () => core.machines.list());
+	defineRoute(app, routes.renameMachine, ({ params, body }) => core.machines.rename(params.id, body.name));
+	defineRoute(app, routes.getMachineSummary, async ({ params }) => {
+		const summary = await core.machines.readSummary(params.id);
+		if (!summary) throw new AppError("not_found", "No summary for this machine yet.");
+		return summary;
+	});
+	defineRoute(app, routes.disconnectMachine, async ({ params }) => {
+		await core.machines.disconnect(params.id);
+		sockets.closeDevice(params.id);
+		sockets.closeMachine(params.id);
+		gateway.closeMachine(params.id);
+	});
+	defineRoute(app, routes.getHubLink, () => core.machines.hubState());
+	defineRoute(app, routes.disconnectHub, () => core.machines.disconnectHub());
+}
+//#endregion
+//#region ../server/src/machines/path-filter.ts
+/** Routes that must never cross the hub: they would show or change the hub's own data. */
+const DENIED_FIRST_SEGMENTS = /* @__PURE__ */ new Set([
+	"access",
+	"remote",
+	"machines",
+	"update",
+	"pair",
+	"health",
+	"m"
+]);
+const FASTIFY_DEFAULT_BODY_LIMIT = 1048576;
+const deny = (status, reason) => ({
+	allowed: false,
+	status,
+	reason
+});
+const segmentsOf = (path) => path.split("/").slice(1);
+function httpEntry(route) {
+	return {
+		method: route.method,
+		segments: segmentsOf(route.path),
+		target: () => ({
+			kind: "http",
+			bodyLimit: route.bodyLimit ?? FASTIFY_DEFAULT_BODY_LIMIT
+		})
+	};
+}
+const TABLE = [
+	...Object.values(routes).map(httpEntry),
+	{
+		method: "GET",
+		segments: segmentsOf(LIVE_PATH),
+		target: () => ({ kind: "live" })
+	},
+	{
+		method: "GET",
+		segments: segmentsOf(TERMINAL_STREAM_PATH),
+		target: (params) => ({
+			kind: "terminal-stream",
+			terminalId: params.id ?? ""
+		})
+	}
+];
+/** `..`, an encoded dot, slash or backslash, a doubled slash, a query, a fragment or a control character. */
+const FORBIDDEN_RAW = /\.\.|%2e|%2f|%5c|\/\/|[?#\\]/i;
+/** What decoding must not produce: a slash, a backslash, a control character or a dot segment. */
+const FORBIDDEN_DECODED = /[\\/]|^\.\.?$/;
+const hasControlCharacter$1 = (text) => [...text].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127);
+function decodeOnce(raw) {
+	try {
+		const decoded = segmentsOf(raw).map((segment) => decodeURIComponent(segment));
+		return decoded.some((segment) => FORBIDDEN_DECODED.test(segment) || hasControlCharacter$1(segment)) ? void 0 : decoded;
+	} catch {
+		return;
+	}
+}
+function matchEntry(entry, method, decoded) {
+	if (entry.method !== method || entry.segments.length !== decoded.length) return void 0;
+	const params = {};
+	for (const [index, template] of entry.segments.entries()) {
+		const actual = decoded[index] ?? "";
+		if (template.startsWith(":")) {
+			if (actual === "") return void 0;
+			params[template.slice(1)] = actual;
+		} else if (template !== actual) return void 0;
+	}
+	return params;
+}
+/**
+* The path filter of `/api/m/<machineId>/**`. `rawPath` is the part after the machine id, as received and without
+* the query string. Decodes once, then matches the exact method and path against the routes table plus the two
+* socket paths. A denylisted or unknown path is refused here and again by a direct machine (it is not a route there).
+*/
+function filterProxyPath(method, rawPath) {
+	if (!rawPath.startsWith(`/api/`)) return deny(404, "not an API path");
+	if (FORBIDDEN_RAW.test(rawPath) || hasControlCharacter$1(rawPath)) return deny(403, "unsafe path");
+	const decoded = decodeOnce(rawPath);
+	if (!decoded) return deny(403, "bad encoding");
+	if (DENIED_FIRST_SEGMENTS.has(decoded[1] ?? "")) return deny(403, "not available through a hub");
+	for (const entry of TABLE) {
+		const params = matchEntry(entry, method.toUpperCase(), decoded);
+		if (params) return {
+			allowed: true,
+			path: rawPath,
+			target: entry.target(params)
+		};
+	}
+	return deny(404, "unknown route");
+}
+const RESPONSE_HEADERS = /* @__PURE__ */ new Set([
+	"content-type",
+	"cache-control",
+	"content-disposition",
+	"etag"
+]);
+function pick(headers, allowed) {
+	const out = {};
+	for (const [name, value] of Object.entries(headers)) {
+		const key = name.toLowerCase();
+		if (allowed.has(key) && typeof value === "string") out[key] = value;
+	}
+	return out;
+}
+/** Only these come back to the browser; `set-cookie` never does, so a machine cannot plant a cookie on the hub's origin. */
+const filterResponseHeaders = (headers) => pick(headers, RESPONSE_HEADERS);
+//#endregion
+//#region ../server/src/machines/proxy-streams.ts
+function queryOf(request) {
+	const index = request.url.indexOf("?");
+	return index < 0 ? "" : request.url.slice(index + 1);
+}
+function hubStream(app, deps, hubPath, machinePath, capBytes) {
+	app.get(hubPath, { websocket: true }, (socket, request) => {
+		const { machineId } = request.params;
+		if (!deps.sockets.addProxied(request.deviceId, machineId, socket)) return;
+		socket.on("message", (data) => void closeIfOversized(socket, data, capBytes));
+		deps.gateway.openStream(machineId, {
+			path: machinePath(request.params),
+			query: queryOf(request),
+			hubDevice: deps.hubDeviceLabel(request.deviceId)
+		}, socket);
+	});
+}
+/** Hub-side `/api/m/<id>/api/live` and `/api/m/<id>/api/terminals/:id/stream`, with the 64 KB caps as the first line. */
+function registerProxyStreams(app, deps) {
+	hubStream(app, deps, `${MACHINE_PROXY_PREFIX}/:machineId${LIVE_PATH}`, () => LIVE_PATH, LIVE_MAX_FRAME_BYTES);
+	hubStream(app, deps, `${MACHINE_PROXY_PREFIX}/:machineId${TERMINAL_STREAM_PATH}`, (params) => TERMINAL_STREAM_PATH.replace(":id", encodeURIComponent(params.id ?? "")), TERMINAL_STREAM_MAX_INPUT_BYTES);
+}
+//#endregion
+//#region ../server/src/machines/register-proxy.ts
+const PREFIX_PATTERN = new RegExp(`^${MACHINE_PROXY_PREFIX}/([^/?]+)(/[^?]*)?`);
+function splitUrl(url) {
+	const [pathPart = "", query = ""] = url.split(/\?(.*)/s);
+	const match = PREFIX_PATTERN.exec(pathPart);
+	if (!match) return void 0;
+	return {
+		machineId: decodeURIComponent(match[1] ?? ""),
+		rest: match[2] ?? "",
+		query
+	};
+}
+async function proxyHttp(gateway, label, request, reply) {
+	const parts = splitUrl(request.url);
+	if (!parts) throw new AppError("not_found", "Unknown route");
+	const decision = filterProxyPath(request.method, parts.rest);
+	if (!decision.allowed) {
+		const code = decision.status === 403 ? "unauthorized" : "not_found";
+		return reply.code(decision.status).send(toErrorBody(new AppError(code, decision.reason)));
+	}
+	if (decision.target.kind !== "http") throw new AppError("invalid_request", "That path is a socket.");
+	const body = request.body instanceof Buffer ? request.body : void 0;
+	if (body && body.length > decision.target.bodyLimit) throw new AppError("too_large", "The request body is too large.");
+	const response = await gateway.request(parts.machineId, {
+		method: request.method,
+		path: decision.path,
+		query: parts.query,
+		hubDevice: label(request.deviceId),
+		contentType: request.headers["content-type"],
+		body
+	});
+	return reply.code(response.status).headers(filterResponseHeaders(response.headers)).send(response.body);
+}
+/**
+* `/api/m/<machineId>/**` on the hub. Registered in an encapsulated scope so a raw-buffer parser passes bodies
+* through untouched (the machine validates). The guard has already required a device cookie. Owner G fills the gateway.
+*/
+async function registerMachineProxy(app, deps) {
+	await app.register(async (scope) => {
+		scope.removeAllContentTypeParsers();
+		scope.addContentTypeParser("*", {
+			parseAs: "buffer",
+			bodyLimit: MESSAGE_BODY_LIMIT
+		}, (_request, body, done) => done(null, body));
+		registerProxyStreams(scope, deps);
+		scope.all(`${MACHINE_PROXY_PREFIX}/:machineId/*`, { bodyLimit: MESSAGE_BODY_LIMIT }, (request, reply) => proxyHttp(deps.gateway, deps.hubDeviceLabel, request, reply));
+	});
+}
+//#endregion
+//#region ../server/src/machines/summary-writer.ts
+const TICK_MS = 2e3;
+const WRITE_EVERY_MS = 15e3;
+const HUB_LABEL = "hub-summary";
+async function fetchJson(gateway, machineId, path) {
+	const response = await gateway.request(machineId, {
+		method: "GET",
+		path,
+		query: "",
+		hubDevice: HUB_LABEL
+	});
+	if (response.status !== 200) throw new Error(`${path}: ${response.status}`);
+	return JSON.parse(response.body.toString("utf8"));
+}
+/** Titles and times only: what the hub shows for a machine that went offline. */
+async function summaryOf(gateway, machineId) {
+	const [projects, conversations] = await Promise.all([fetchJson(gateway, machineId, "/api/projects"), fetchJson(gateway, machineId, "/api/conversations")]);
+	return {
+		savedAt: Date.now(),
+		projects: projects.map(({ id, name }) => ({
+			id,
+			name
+		})),
+		threads: conversations.filter((thread) => thread.archivedAt === null).map(({ id, projectId, title, updatedAt }) => ({
+			id,
+			projectId,
+			title,
+			updatedAt
+		}))
+	};
+}
+/** While a machine is online the hub saves its summary through the link: at once, then at most every 15 s. */
+function startSummaryWriter(core, gateway) {
+	const lastWrite = /* @__PURE__ */ new Map();
+	let running = false;
+	const writeOne = async (machineId) => {
+		lastWrite.set(machineId, Date.now());
+		try {
+			const summary = await summaryOf(gateway, machineId);
+			await core.machines.writeSummary(machineId, summary);
+			core.machines.heartbeat(machineId, summary.threads.length);
+		} catch {}
+	};
+	const tick = async () => {
+		if (running) return;
+		running = true;
+		try {
+			const due = (await core.machines.list()).filter((machine) => machine.status === "online" && gateway.isOnline(machine.id) && Date.now() - (lastWrite.get(machine.id) ?? 0) >= WRITE_EVERY_MS);
+			await Promise.all(due.map((machine) => writeOne(machine.id)));
+		} finally {
+			running = false;
+		}
+	};
+	const timer = setInterval(() => void tick(), TICK_MS);
+	timer.unref();
+	return () => clearInterval(timer);
+}
+//#endregion
+//#region ../server/src/rest/json-body.ts
+/** Like Fastify's JSON parser, but an empty body is `undefined` instead of an error (bodiless POSTs such as abort). */
+function allowEmptyJsonBodies(app) {
+	app.addContentTypeParser("application/json", { parseAs: "string" }, (_request, body, done) => {
+		if (body === "") return done(null, void 0);
+		try {
+			done(null, JSON.parse(body));
+		} catch {
+			done(Object.assign(/* @__PURE__ */ new Error("Body is not valid JSON"), { statusCode: 400 }), void 0);
+		}
+	});
+}
+//#endregion
+//#region ../server/src/rest/candidate-name.ts
+const MAX_NAME_LENGTH = 512;
+const hasControlCharacter = (name) => [...name].some((char) => char.charCodeAt(0) < 32);
+const escapesProject = (name) => name.startsWith("/") || name.includes("\\") || name.split("/").some((part) => part === ".." || part === "");
+/** Rejects anything but a plain relative path before it reaches core; core validates against its candidate list again. */
+function requireCandidateName(name) {
+	if (name.length > MAX_NAME_LENGTH || hasControlCharacter(name) || escapesProject(name)) throw new AppError("invalid_request", "Invalid icon name.");
+	return name;
+}
+//#endregion
+//#region ../server/src/rest/etag-match.ts
+const stripWeak = (tag) => tag.trim().replace(/^W\//, "");
+/** True when an If-None-Match header lists the current ETag (weak forms and `*` included). */
+function etagMatches(header, etag) {
+	if (!header) return false;
+	return header.split(",").some((tag) => tag.trim() === "*" || stripWeak(tag) === etag);
+}
+//#endregion
+//#region ../server/src/rest/define-image-route.ts
+const hashOf = (data) => createHash("sha1").update(data).digest("base64url");
+const etagOf = (image) => `"${image.etag ?? hashOf(image.data)}"`;
+function setImageHeaders(reply, image) {
+	reply.header("x-content-type-options", "nosniff").header("cache-control", "no-cache").header("etag", etagOf(image));
+	if (image.contentType === "image/svg+xml") reply.header("content-security-policy", "sandbox");
+}
+function sendImage(reply, image) {
+	setImageHeaders(reply, image);
+	return reply.header("content-type", image.contentType).send(Buffer.from(image.data));
+}
+/** Registers an `image` route: raw bytes, or 404 when the handler has none. Always nosniff; SVG is sandboxed. */
+function defineImageRoute(app, route, handler) {
+	app.route({
+		method: route.method,
+		url: route.path,
+		schema: {
+			...route.params && { params: route.params },
+			...route.query && { querystring: route.query }
+		},
+		handler: async (request, reply) => {
+			const image = await handler({
+				params: request.params,
+				query: request.query
+			});
+			if (!image) return reply.code(404).send({ error: {
+				code: "not_found",
+				message: "No icon."
+			} });
+			if (etagMatches(request.headers["if-none-match"], etagOf(image))) {
+				setImageHeaders(reply, image);
+				return reply.code(304).send();
+			}
+			return sendImage(reply, image);
+		}
+	});
+}
+const MAX_FRAME_BYTES = 65536;
+/** Joins chunks arriving within `COALESCE_MS` (or up to `COALESCE_MAX_BYTES`) into one frame; no frame exceeds `MAX_FRAME_BYTES`. */
+function createCoalescer(send) {
+	let pending = [];
+	let size = 0;
+	let timer;
+	function flush() {
+		if (timer) clearTimeout(timer);
+		timer = void 0;
+		if (size === 0) return;
+		const frame = Buffer.concat(pending, size);
+		pending = [];
+		size = 0;
+		send(new Uint8Array(frame.buffer, frame.byteOffset, frame.byteLength));
+	}
+	function add(chunk) {
+		pending.push(chunk);
+		size += chunk.length;
+		if (size >= 16384) flush();
+		else timer ??= setTimeout(flush, 8);
+	}
+	return {
+		push(data) {
+			for (let at = 0; at < data.length; at += MAX_FRAME_BYTES) {
+				if (size + Math.min(65536, data.length - at) > 65536) flush();
+				add(data.subarray(at, at + MAX_FRAME_BYTES));
+			}
+		},
+		flush,
+		dispose() {
+			if (timer) clearTimeout(timer);
+			timer = void 0;
+			pending = [];
+			size = 0;
+		}
+	};
+}
+const CHECK_MS = 250;
+/** Calls `onStalled` once the buffer has stayed above `STALL_BYTES` for `STALL_MS`. Returns the stop function. */
+function watchStall(socket, onStalled, now = Date.now) {
+	let since;
+	const timer = setInterval(() => {
+		if (socket.bufferedAmount <= 1048576) {
+			since = void 0;
+			return;
+		}
+		since ??= now();
+		if (now() - since >= 5e3) {
+			clearInterval(timer);
+			onStalled();
+		}
+	}, CHECK_MS);
+	return () => clearInterval(timer);
+}
+//#endregion
+//#region ../server/src/terminals/stream-connection.ts
+const INTERNAL_ERROR = 1011;
+const SLOW_CLOSE_GRACE_MS = 2e3;
+function decodeResize(raw) {
+	try {
+		const value = JSON.parse(raw);
+		return Value.Check(TerminalClientFrameSchema, value) ? value : void 0;
+	} catch {
+		return;
+	}
+}
+const toBytes = (data) => {
+	if (Array.isArray(data)) return Buffer.concat(data);
+	return data instanceof ArrayBuffer ? new Uint8Array(data) : data;
+};
+/** One attached pane: attaches to the core, sends `ready`, coalesced output, then `exit`; detaches on close. */
+var TerminalStream = class {
+	socket;
+	onError;
+	coalescer = createCoalescer((frame) => this.sendBinary(frame));
+	stopWatching;
+	attachment;
+	ready = false;
+	exited = false;
+	queue = [];
+	constructor(socket, core, id, onError) {
+		this.socket = socket;
+		this.onError = onError;
+		this.stopWatching = watchStall(socket, () => this.dropSlowClient());
+		this.attachment = this.attach(core, id);
+		socket.on("message", (data, isBinary) => void this.handleMessage(data, isBinary));
+		socket.on("close", () => void this.dispose());
+		socket.on("error", onError);
+	}
+	/** A stalled client never reads the close frame queued behind its data: close with 1013, then cut the socket so the buffer is freed. */
+	dropSlowClient() {
+		this.socket.close(TERMINAL_STREAM_CLOSE_SLOW, "too slow");
+		const cut = setTimeout(() => this.socket.terminate(), SLOW_CLOSE_GRACE_MS);
+		cut.unref();
+		this.socket.once("close", () => clearTimeout(cut));
+	}
+	async attach(core, id) {
+		try {
+			const attachment = await core.terminals.attach(id, {
+				onData: (data) => this.afterReady(() => this.coalescer.push(data)),
+				onExit: (code) => this.afterReady(() => this.sendExit(code))
+			});
+			if (this.socket.readyState !== this.socket.OPEN) {
+				attachment.detach();
+				return;
+			}
+			this.sendText({
+				type: "ready",
+				status: attachment.status,
+				exitCode: attachment.exitCode
+			});
+			this.ready = true;
+			for (const step of this.queue.splice(0)) step();
+			if (attachment.status === "exited") this.finishExited(attachment.exitCode);
+			return attachment;
+		} catch (error) {
+			this.failAttach(error);
+			return;
+		}
+	}
+	/** Attaching to an ended terminal never calls `onExit`: send the replay, then `exit`, then close. */
+	finishExited(exitCode) {
+		this.afterReady(() => {
+			this.sendExit(exitCode);
+			this.socket.close(1e3, "exited");
+		});
+	}
+	failAttach(error) {
+		if (error instanceof AppError && error.code === "not_found") {
+			this.socket.close(TERMINAL_STREAM_CLOSE_UNKNOWN, "not_found");
+			return;
+		}
+		this.onError(error);
+		this.socket.close(INTERNAL_ERROR, "internal_error");
+	}
+	afterReady(step) {
+		if (this.ready) step();
+		else this.queue.push(step);
+	}
+	sendExit(exitCode) {
+		if (this.exited) return;
+		this.exited = true;
+		this.coalescer.flush();
+		this.sendText({
+			type: "exit",
+			exitCode
+		});
+	}
+	sendBinary(frame) {
+		if (this.socket.readyState === this.socket.OPEN) this.socket.send(frame, { binary: true });
+	}
+	sendText(frame) {
+		if (this.socket.readyState === this.socket.OPEN) this.socket.send(JSON.stringify(frame));
+	}
+	async handleMessage(data, isBinary) {
+		if (closeIfOversized(this.socket, data, 65536)) return;
+		const attachment = await this.attachment;
+		if (!attachment) return;
+		if (isBinary) return attachment.write(toBytes(data));
+		const frame = decodeResize(data.toString());
+		if (!frame) return this.socket.close(TERMINAL_STREAM_CLOSE_UNKNOWN, "invalid frame");
+		attachment.resize(frame.cols, frame.rows);
+	}
+	async dispose() {
+		this.stopWatching();
+		this.coalescer.dispose();
+		this.queue = [];
+		(await this.attachment)?.detach();
+	}
+};
+//#endregion
+//#region ../server/src/terminals/register-stream.ts
+function registerTerminalStream(app, core, sockets) {
+	app.get(TERMINAL_STREAM_PATH, { websocket: true }, (socket, request) => {
+		if (!sockets.add(request.deviceId, socket)) return;
+		new TerminalStream(socket, core, request.params.id, (error) => request.log.error(error));
+	});
+}
+//#endregion
+//#region ../server/src/rest/register-terminal-routes.ts
+/**
+* REST half of terminals: no business logic, every route forwards to `core.terminals`.
+* Owner B: the stream WebSocket (`TERMINAL_STREAM_PATH`) lives in `server/src/terminals/**`.
+* `getTerminalsAvailable` answers `{ available }`; the list and open routes answer `not_found` when unavailable.
+*/
+function registerTerminalRoutes(app, core, sockets) {
+	const { terminals } = core;
+	defineRoute(app, routes.getTerminalsAvailable, async () => ({ available: await terminals.available() }));
+	defineRoute(app, routes.listTerminals, ({ params }) => terminals.list(params.id));
+	defineRoute(app, routes.openTerminal, ({ params, body }) => terminals.open(params.id, body));
+	defineRoute(app, routes.closeTerminal, ({ params }) => terminals.close(params.id));
+	registerTerminalStream(app, core, sockets);
+}
+//#endregion
+//#region ../server/src/rest/register-connector-routes.ts
+function registerConnectorRoutes(app, core) {
+	const { approvals, settings } = core;
+	defineRoute(app, routes.setClaudeConnectors, ({ body }) => settings.setClaudeConnectors(body));
+	defineRoute(app, routes.listApprovals, ({ params }) => approvals.list(params.id));
+	defineRoute(app, routes.decideApproval, ({ params, body }) => approvals.decide(params.id, params.toolUseId, body.decision));
+}
+//#endregion
+//#region ../server/src/rest/register-workspace-routes.ts
+function registerThreadRoutes(app, core) {
+	const { conversations, workspaces } = core;
+	defineRoute(app, routes.forkConversation, ({ params, body }) => conversations.fork(params.id, body.entryId));
+	defineRoute(app, routes.rewindPreview, ({ params, body }) => conversations.rewindPreview(params.id, body.entryId));
+	defineRoute(app, routes.rewindConversation, ({ params, body }) => conversations.rewind(params.id, body.entryId));
+	defineRoute(app, routes.stopAgent, ({ params }) => conversations.stopAgent(params.id));
+	defineRoute(app, routes.cancelQueued, ({ params }) => conversations.cancelQueued(params.id, params.itemId));
+	defineRoute(app, routes.listCheckpoints, ({ params }) => conversations.checkpoints(params.id));
+	defineRoute(app, routes.getCheckpointDiff, async ({ params, query }) => ({ diff: await conversations.checkpointDiff(params.id, params.cid, query.path) }));
+	defineRoute(app, routes.getWorkspace, ({ params }) => workspaces.status(params.id));
+	defineRoute(app, routes.mergeWorkspace, ({ params }) => workspaces.merge(params.id));
+	defineRoute(app, routes.createPullRequest, ({ params }) => workspaces.createPullRequest(params.id));
+	defineRoute(app, routes.removeWorkspace, ({ params, query }) => workspaces.remove(params.id, query.force === "true"));
+}
+function registerToolRoutes(app, core) {
+	const { processes, mcp, settings, timers, goals } = core;
+	defineRoute(app, routes.listProcesses, ({ params }) => processes.list(params.id));
+	defineRoute(app, routes.getProcessLogs, async ({ params, query }) => ({ logs: await processes.logs(params.id, query.tail ? Number(query.tail) : 200) }));
+	defineRoute(app, routes.stopProcess, ({ params }) => processes.stop(params.id));
+	defineRoute(app, routes.listTimers, ({ params }) => timers.list(params.id));
+	defineRoute(app, routes.deleteTimer, ({ params }) => timers.delete(params.id));
+	defineRoute(app, routes.startLoop, ({ params, body }) => timers.loop(params.id, body));
+	defineRoute(app, routes.stopLoop, ({ params }) => timers.stopLoop(params.id));
+	defineRoute(app, routes.getGoal, ({ params }) => goals.get(params.id));
+	defineRoute(app, routes.setGoal, ({ params, body }) => goals.set(params.id, body.condition));
+	defineRoute(app, routes.clearGoal, ({ params }) => goals.clear(params.id));
+	defineRoute(app, routes.listMcpServers, ({ query }) => mcp.servers(query.projectId ?? null));
+	defineRoute(app, routes.saveMcpServer, ({ params, body }) => mcp.save({
+		...body,
+		name: params.name
+	}));
+	defineRoute(app, routes.removeMcpServer, ({ params }) => mcp.remove(params.name));
+	defineRoute(app, routes.setMessageMode, ({ body }) => settings.setMessageMode(body.mode));
+	defineRoute(app, routes.setWorkspaceDefault, ({ body }) => settings.setWorkspaceDefault(body.mode));
+}
+function registerWorkspaceRoutes(app, core) {
+	registerThreadRoutes(app, core);
+	registerToolRoutes(app, core);
+	registerConnectorRoutes(app, core);
+}
+//#endregion
+//#region ../server/src/rest/register-routes.ts
+function startLoginFor(core, id) {
+	if (id !== "openai") throw new AppError("invalid_request", "This provider has no sign-in.");
+	return core.providers.startLogin(id);
+}
+function registerRoutes(app, core, sockets) {
+	defineRoute(app, routes.suggestDirectories, ({ body }) => core.fs.suggestDirectories(body));
+	defineRoute(app, routes.getUpdateStatus, () => core.updates.status());
+	defineRoute(app, routes.refreshUpdateStatus, () => core.updates.refresh());
+	defineRoute(app, routes.getSettings, () => core.settings.get());
+	defineRoute(app, routes.setDefaultModel, ({ body }) => core.settings.setDefaultModel(body));
+	defineRoute(app, routes.setDefaultThinking, ({ body }) => core.settings.setDefaultThinkingLevel(body.thinkingLevel));
+	defineRoute(app, routes.setFastThinking, ({ body }) => core.settings.setFastThinkingLevel(body.thinkingLevel));
+	defineRoute(app, routes.setFastModel, ({ body }) => core.settings.setFastModel(body.model));
+	defineRoute(app, routes.setProjectsFolder, ({ body }) => core.settings.setProjectsFolder(body.path));
+	defineRoute(app, routes.getSuggestedCodeFolder, () => core.settings.suggestedCodeFolder());
+	defineRoute(app, routes.getGithubStatus, () => core.github.status());
+	defineRoute(app, routes.listGithubRepos, () => core.github.repos());
+	defineRoute(app, routes.refreshGithubRepos, () => core.github.refreshRepos());
+	defineRoute(app, routes.useGithubRepo, ({ body }) => core.github.use(body));
+	defineRoute(app, routes.listProviders, () => core.providers.list());
+	defineRoute(app, routes.setProviderKey, ({ params, body }) => core.providers.setApiKey(params.id, body.key));
+	defineRoute(app, routes.disconnectProvider, ({ params }) => core.providers.disconnect(params.id));
+	defineRoute(app, routes.acknowledgeClaudeCli, () => core.providers.acknowledgeClaudeCli());
+	defineRoute(app, routes.refreshClaudeCli, () => core.providers.refreshClaudeCli());
+	defineRoute(app, routes.installClaudeCliSdk, () => core.providers.installClaudeCliSdk());
+	defineRoute(app, routes.startLogin, ({ params }) => startLoginFor(core, params.id));
+	defineRoute(app, routes.getLogin, ({ params }) => core.providers.login(params.sid));
+	defineRoute(app, routes.submitLoginUrl, ({ params, body }) => core.providers.submitLoginUrl(params.sid, body.url));
+	defineRoute(app, routes.cancelLogin, ({ params }) => core.providers.cancelLogin(params.sid));
+	defineRoute(app, routes.listModels, () => core.models.list());
+	defineRoute(app, routes.listSkills, ({ query }) => core.skills.list(query.projectId ?? null));
+	defineRoute(app, routes.suggestProjectFiles, ({ params, body }) => core.projects.suggestFiles(params.id, body.query));
+	defineRoute(app, routes.listProjects, () => core.projects.list());
+	defineRoute(app, routes.addProject, ({ body }) => core.projects.add(body));
+	defineRoute(app, routes.cloneProject, ({ body }) => core.projects.clone(body));
+	defineRoute(app, routes.retryClone, ({ params }) => core.projects.retryClone(params.id));
+	defineRoute(app, routes.setProjectFolder, ({ params, body }) => core.projects.setFolder(params.id, body.path));
+	defineRoute(app, routes.renameProject, ({ params, body }) => core.projects.rename(params.id, body.name));
+	defineRoute(app, routes.removeProject, ({ params }) => core.projects.remove(params.id));
+	defineImageRoute(app, routes.getProjectIcon, ({ params }) => core.projects.icon(params.id));
+	defineRoute(app, routes.setProjectIcon, ({ params, body }) => core.projects.setIcon(params.id, new Uint8Array(Buffer.from(body.png, "base64"))));
+	defineRoute(app, routes.resetProjectIcon, ({ params }) => core.projects.setIcon(params.id, null));
+	defineRoute(app, routes.listIconCandidates, async ({ params }) => (await core.projects.iconCandidates(params.id)).map(({ name }) => ({
+		name,
+		url: iconCandidateUrl(params.id, name)
+	})));
+	defineImageRoute(app, routes.getIconCandidate, ({ params, query }) => core.projects.iconCandidate(params.id, requireCandidateName(query.name)));
+	defineRoute(app, routes.listConversations, ({ params }) => core.conversations.list(params.id));
+	defineRoute(app, routes.listAllConversations, () => core.conversations.listAll());
+	defineRoute(app, routes.deleteArchivedConversations, ({ body }) => core.conversations.deleteArchived(body));
+	defineRoute(app, routes.startConversation, ({ body }) => core.conversations.start(body));
+	defineRoute(app, routes.renameConversation, ({ params, body }) => core.conversations.rename(params.id, body.title));
+	defineRoute(app, routes.sendMessage, ({ params, body }) => core.conversations.send(params.id, body));
+	defineRoute(app, routes.abortConversation, ({ params }) => core.conversations.abort(params.id));
+	defineRoute(app, routes.archiveConversation, ({ params, body }) => core.conversations.archive(params.id, body.archived));
+	defineRoute(app, routes.removeConversation, ({ params, query }) => core.conversations.remove(params.id, { force: query.force === "true" }));
+	defineRoute(app, routes.configureConversation, ({ params, body }) => core.conversations.configure(params.id, body));
+	defineRoute(app, routes.compactConversation, ({ params, body }) => core.conversations.compact(params.id, body));
+	defineRoute(app, routes.retryConversation, ({ params, body }) => core.conversations.retry(params.id, body));
+	registerWorkspaceRoutes(app, core);
+	registerTerminalRoutes(app, core, sockets);
+}
+//#endregion
+//#region ../server/src/security/device-sockets.ts
+const POLICY_VIOLATION = 1008;
+const OWNER = "owner";
+function createDeviceSockets() {
+	const byDevice = /* @__PURE__ */ new Map();
+	const byMachine = /* @__PURE__ */ new Map();
+	const closeAll = (sockets) => {
+		for (const socket of sockets) socket.close(POLICY_VIOLATION, "revoked");
+	};
+	const self = {
+		addProxied(deviceId, machineId, socket) {
+			if (!self.add(deviceId, socket)) return false;
+			const set = byMachine.get(machineId) ?? /* @__PURE__ */ new Set();
+			set.add(socket);
+			byMachine.set(machineId, set);
+			socket.once("close", () => {
+				set.delete(socket);
+				if (set.size === 0) byMachine.delete(machineId);
+			});
+			return true;
+		},
+		closeMachine(machineId) {
+			closeAll([...byMachine.get(machineId) ?? []]);
+		},
+		add(deviceId, socket) {
+			if (deviceId === "") {
+				socket.close(POLICY_VIOLATION, "unauthorized");
+				return false;
+			}
+			const set = byDevice.get(deviceId) ?? /* @__PURE__ */ new Set();
+			set.add(socket);
+			byDevice.set(deviceId, set);
+			socket.once("close", () => {
+				set.delete(socket);
+				if (set.size === 0) byDevice.delete(deviceId);
+			});
+			return true;
+		},
+		closeDevice(deviceId) {
+			closeAll([...byDevice.get(deviceId) ?? []]);
+		},
+		closeExcept(liveIds) {
+			for (const [deviceId, sockets] of [...byDevice]) if (deviceId !== OWNER && !liveIds.has(deviceId)) closeAll([...sockets]);
+		},
+		count: (deviceId) => byDevice.get(deviceId)?.size ?? 0
+	};
+	return self;
+}
+/** After any `devices` change: cut the sockets of devices that no longer exist (revoke from the CLI, a new URL). */
+async function closeSocketsOfGoneDevices(core, sockets) {
+	const devices = await core.access.listDevices();
+	sockets.closeExcept(new Set(devices.map((device) => device.id)));
+}
+//#endregion
+//#region ../server/src/security/pair-page.ts
+/** The one UI outside the design system, on purpose: the React app needs a session first. Colours by value. */
+const SCRIPT = `
+const $ = (id) => document.getElementById(id);
+const REDEEM_PATH = ${JSON.stringify(routes.redeemPairing.path)};
+const MESSAGES = {
+  401: "That code did not work. Check it, or ask for a new one.",
+  429: "Too many tries. Wait a little, then try again.",
+};
+const guessName = () => {
+  const agent = navigator.userAgent;
+  const os = /iPhone|iPad/.test(agent) ? "iOS" : /Android/.test(agent) ? "Android" : /Mac/.test(agent) ? "Mac" : /Windows/.test(agent) ? "Windows" : /Linux/.test(agent) ? "Linux" : "";
+  const browser = /Edg\\//.test(agent) ? "Edge" : /Firefox\\//.test(agent) ? "Firefox" : /Chrome\\//.test(agent) ? "Chrome" : /Safari\\//.test(agent) ? "Safari" : "Browser";
+  return os ? browser + " on " + os : browser;
+};
+const show = (text) => { $("error").textContent = text; };
+const busy = (on) => { $("link").disabled = on; };
+const redeem = async (code, deviceName) => {
+  busy(true);
+  show("");
+  try {
+    const response = await fetch(REDEEM_PATH, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ code, deviceName: deviceName.slice(0, 120) || guessName() }),
+    });
+    if (response.ok) return location.replace("/");
+    show(MESSAGES[response.status] || "Something went wrong. Try again.");
+  } catch {
+    show("Could not reach tau. Check your connection and try again.");
+  }
+  busy(false);
+};
+const groups = (text) => text.replace(/[^a-z0-9]/gi, "").toUpperCase().slice(0, 8).replace(/(.{4})(?=.)/g, "$1 ");
+const fromLink = () => {
+  const [code, name] = location.hash.slice(1).split(".");
+  try { return { code, name: name ? decodeURIComponent(name) : "" }; } catch { return { code, name: "" }; }
+};
+$("name").value = guessName();
+const linked = fromLink();
+if (linked.code) {
+  history.replaceState(null, "", location.pathname + location.search);
+  if (linked.name) $("name").value = linked.name;
+  redeem(linked.code, $("name").value);
+}
+$("code").addEventListener("input", (event) => { event.target.value = groups(event.target.value); });
+$("form").addEventListener("submit", (event) => {
+  event.preventDefault();
+  const typed = $("code").value.replace(/\\s/g, "");
+  if (typed.length !== 8) return show("The code has 8 characters.");
+  redeem(typed, $("name").value.trim());
+});
+`;
+const PAIR_PAGE = `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="color-scheme" content="light dark"><title>Link this device</title><style>
+:root{color-scheme:light dark;--bg:#ffffff;--fg:#0a0a0a;--muted:#737373;--border:#e5e5e5;--primary:#171717;--primary-fg:#fafafa;--danger:#e7000b}
+@media(prefers-color-scheme:dark){:root{--bg:#0a0a0a;--fg:#fafafa;--muted:#b5b5b5;--border:#ffffff26;--primary:#e5e5e5;--primary-fg:#171717;--danger:#ff6467}}
+*{box-sizing:border-box}
+body{margin:0;min-height:100vh;display:grid;place-items:center;background:var(--bg);color:var(--fg);font:16px/1.5 system-ui,sans-serif}
+main{width:100%;max-width:24rem;padding:1.5rem}
+h1{margin:0 0 .25rem;font-size:1.25rem;font-weight:600}
+p{margin:0 0 1.25rem;color:var(--muted);font-size:.875rem}
+label{display:block;margin:0 0 .375rem;font-size:.875rem;font-weight:500}
+input,button{font:inherit;width:100%;height:2.5rem;padding:0 .75rem;border-radius:.5rem;border:1px solid var(--border)}
+input{background:transparent;color:var(--fg);margin-bottom:1rem}
+#code{font-family:ui-monospace,monospace;letter-spacing:.2em;text-transform:uppercase}
+input:focus-visible,button:focus-visible{outline:2px solid var(--fg);outline-offset:2px}
+button{background:var(--primary);color:var(--primary-fg);border-color:transparent;font-weight:500;cursor:pointer}
+button:disabled{opacity:.5;cursor:default}
+#error{min-height:1.5rem;margin:1rem 0 0;color:var(--danger)}
+</style></head><body><main><h1>Link this device</h1><p>Type the 8-character code shown on your tau, or open the link it gave you.</p>
+<form id="form" novalidate><label for="code">Code</label><input id="code" inputmode="text" autocomplete="off" autocapitalize="characters" spellcheck="false" maxlength="9" placeholder="ABCD EFGH" aria-describedby="error">
+<label for="name">Device name</label><input id="name" autocomplete="off" maxlength="120"><button id="link" type="submit">Link this device</button></form>
+<p id="error" role="alert" aria-live="polite"></p></main><script>${SCRIPT}<\/script></body></html>`;
+const PAIR_PAGE_HEADERS = {
+	"content-security-policy": `default-src 'none'; script-src '${`sha256-${createHash("sha256").update(SCRIPT).digest("base64")}`}'; style-src 'unsafe-inline'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`,
+	"cache-control": "no-store"
+};
+//#endregion
+//#region ../server/src/security/register-access-routes.ts
+const COOKIE_MAX_AGE_SECONDS = 3456e4;
+const LOCAL_PEER = "local";
+function setDeviceCookie(reply, secret, secure) {
+	reply.setCookie(DEVICE_COOKIE, secret, {
+		httpOnly: true,
+		sameSite: "strict",
+		secure,
+		path: "/",
+		maxAge: COOKIE_MAX_AGE_SECONDS
+	});
+}
+function registerRedeem({ core, tunnel }, app) {
+	app.post(routes.redeemPairing.path, { schema: { body: routes.redeemPairing.body } }, async (request, reply) => {
+		const tag = tunnel.tagOf(request.raw.socket);
+		const redeemed = await core.access.redeemPairing({
+			...request.body,
+			peer: tag?.peer ?? LOCAL_PEER,
+			userAgent: request.headers["user-agent"]
+		});
+		if (redeemed.kind === "machine") return {
+			deviceId: redeemed.deviceId,
+			secret: redeemed.secret
+		};
+		setDeviceCookie(reply, redeemed.secret, tag !== void 0);
+		return { deviceId: redeemed.deviceId };
+	});
+}
+function registerDevices({ core, sockets }, app) {
+	defineRoute(app, routes.listDevices, (_input, request) => core.access.listDevices(request.deviceId));
+	defineRoute(app, routes.renameDevice, ({ params, body }) => core.access.renameDevice(params.id, body.name));
+	defineRoute(app, routes.revokeDevice, async ({ params }) => {
+		await core.access.revokeDevice(params.id);
+		sockets.closeDevice(params.id);
+	});
+	defineRoute(app, routes.signOutAllDevices, async () => {
+		const before = await core.access.listDevices();
+		await core.access.signOutAll();
+		for (const device of before) if (device.kind !== "machine") sockets.closeDevice(device.id);
+	});
+	defineRoute(app, routes.mintPairing, async ({ query }) => {
+		const refusal = query.kind === "machine" ? acceptLinkRefusal(await core.machines.hubState()) : void 0;
+		if (refusal) throw new AppError("invalid_request", refusal);
+		return core.access.mintPairing(query);
+	});
+}
+function registerAccessRoutes(app, deps) {
+	const { core } = deps;
+	defineRoute(app, routes.getHealth, async () => ({ ok: true }));
+	app.get(PAIR_PAGE_PATH, async (_request, reply) => reply.headers(PAIR_PAGE_HEADERS).type("text/html; charset=utf-8").send(PAIR_PAGE));
+	registerRedeem(deps, app);
+	registerDevices(deps, app);
+	defineRoute(app, routes.getRemoteStatus, () => core.remote.status());
+	defineRoute(app, routes.enableRemote, () => core.remote.enable());
+	defineRoute(app, routes.disableRemote, () => core.remote.disable());
+	defineRoute(app, routes.recreateRemote, () => core.remote.recreate());
+}
+//#endregion
+//#region ../server/src/security/session.ts
+function digest(value) {
+	return createHash("sha256").update(value).digest();
+}
+function createSession(token, port) {
+	const expected = digest(token);
+	return {
+		cookieName: `tau_${port}`,
+		isValidToken: (candidate) => typeof candidate === "string" && timingSafeEqual(digest(candidate), expected)
+	};
+}
+//#endregion
+//#region ../server/src/security/proxy-v2.ts
+const SIGNATURE = Buffer.from("0d0a0d0a000d0a515549540a", "hex");
+const HEADER_BYTES = 16;
+const COMMAND_LOCAL = 32;
+const COMMAND_PROXY = 33;
+const FAMILY_UNSPEC = 0;
+const FAMILY_TCP4 = 17;
+const FAMILY_TCP6 = 33;
+const TLV_AUTHORITY = 2;
+const TCP4_ADDRESS_BYTES = 12;
+const TCP6_ADDRESS_BYTES = 36;
+function peerOf(command, family, body) {
+	if (command === COMMAND_LOCAL) return {
+		peer: "local",
+		skip: 0
+	};
+	if (family === FAMILY_TCP4) return {
+		peer: [...body.subarray(0, 4)].join("."),
+		skip: TCP4_ADDRESS_BYTES
+	};
+	if (family === FAMILY_TCP6) return {
+		peer: body.subarray(0, 16).toString("hex"),
+		skip: TCP6_ADDRESS_BYTES
+	};
+	return {
+		peer: "local",
+		skip: 0
+	};
+}
+function authorityOf(tlvs) {
+	let offset = 0;
+	while (offset + 3 <= tlvs.length) {
+		const length = tlvs.readUInt16BE(offset + 1);
+		if (tlvs[offset] === TLV_AUTHORITY) return tlvs.subarray(offset + 3, offset + 3 + length).toString();
+		offset += 3 + length;
+	}
+}
+function addressBytesNeeded(command, family) {
+	if (command === COMMAND_LOCAL) return 0;
+	if (family === FAMILY_TCP4) return TCP4_ADDRESS_BYTES;
+	return family === FAMILY_TCP6 ? TCP6_ADDRESS_BYTES : 0;
+}
+/** Parses a PROXY protocol v2 header at the start of `buffer`. */
+function parseProxyV2(buffer) {
+	const seen = buffer.subarray(0, Math.min(buffer.length, SIGNATURE.length));
+	if (!seen.equals(SIGNATURE.subarray(0, seen.length))) return {
+		kind: "malformed",
+		reason: "signature"
+	};
+	if (buffer.length < HEADER_BYTES) return { kind: "need-more" };
+	const command = buffer[12];
+	const family = buffer[13];
+	if (command !== COMMAND_PROXY && command !== COMMAND_LOCAL) return {
+		kind: "malformed",
+		reason: "command"
+	};
+	if (![
+		FAMILY_TCP4,
+		FAMILY_TCP6,
+		FAMILY_UNSPEC
+	].includes(family)) return {
+		kind: "malformed",
+		reason: "family"
+	};
+	const length = buffer.readUInt16BE(14);
+	if (length < addressBytesNeeded(command, family)) return {
+		kind: "malformed",
+		reason: "length"
+	};
+	if (buffer.length < HEADER_BYTES + length) return { kind: "need-more" };
+	const body = buffer.subarray(HEADER_BYTES, HEADER_BYTES + length);
+	const { peer, skip } = peerOf(command, family, body);
+	return {
+		kind: "ok",
+		peer,
+		sni: authorityOf(body.subarray(skip)),
+		rest: buffer.subarray(HEADER_BYTES + length)
+	};
+}
+const MAX_HEADER_BYTES = 65551;
+/** Tag first, then hand the socket to the HTTP server: unshift the rest, emit `connection`, resume. */
+function admit(options, socket, peer, sni, rest) {
+	options.tags.tag(socket, {
+		peer,
+		sni
+	});
+	if (rest.length > 0) socket.unshift(rest);
+	options.app.server.emit("connection", socket);
+	socket.resume();
+}
+function handleConnection(options, socket) {
+	let buffered = Buffer.alloc(0);
+	const timer = setTimeout(() => socket.destroy(), options.headerTimeoutMs ?? 5e3);
+	const onData = (chunk) => {
+		buffered = Buffer.concat([buffered, chunk]);
+		const parsed = parseProxyV2(buffered);
+		if (parsed.kind === "need-more" && buffered.length <= MAX_HEADER_BYTES) return;
+		clearTimeout(timer);
+		socket.off("data", onData);
+		socket.pause();
+		const hostname = options.hostname();
+		if (parsed.kind !== "ok" || hostname === void 0 || parsed.sni?.toLowerCase() !== hostname) {
+			socket.destroy();
+			return;
+		}
+		admit(options, socket, parsed.peer, hostname, parsed.rest);
+	};
+	socket.on("data", onData);
+	socket.on("error", () => socket.destroy());
+	socket.on("close", () => clearTimeout(timer));
+}
+function createTunnelListener(options) {
+	const sockets = /* @__PURE__ */ new Set();
+	const server = createServer((socket) => {
+		sockets.add(socket);
+		socket.on("close", () => sockets.delete(socket));
+		handleConnection(options, socket);
+	});
+	return {
+		start: () => new Promise((resolve, reject) => {
+			server.once("error", reject);
+			server.listen(0, "127.0.0.1", () => {
+				server.off("error", reject);
+				const address = server.address();
+				resolve({ port: typeof address === "object" && address ? address.port : 0 });
+			});
+		}),
+		close: () => new Promise((resolve) => {
+			for (const socket of sockets) socket.destroy();
+			server.close(() => resolve());
+		})
+	};
+}
+//#endregion
+//#region ../server/src/security/tunnel-tags.ts
+function createTunnelTags() {
+	const tags = /* @__PURE__ */ new WeakMap();
+	return {
+		tagOf: (socket) => tags.get(socket),
+		tag: (socket, tag) => void tags.set(socket, tag)
+	};
+}
+//#endregion
+//#region ../server/src/static-assets.ts
+function isApiRequest(request) {
+	return request.url === "/api" || request.url.startsWith(`/api/`);
+}
+function acceptsHtml(request) {
+	return request.method === "GET" && (request.headers.accept ?? "").includes("text/html");
+}
+/** Serves the built web app; unknown HTML navigations fall back to `index.html` (client-side routing). */
+async function registerStaticAssets(app, staticDir) {
+	if (staticDir) await app.register(fastifyStatic, { root: staticDir });
+	app.setNotFoundHandler((request, reply) => {
+		if (isApiRequest(request)) return sendApiNotFound(reply);
+		if (staticDir && acceptsHtml(request)) return reply.sendFile("index.html");
+		return reply.code(404).type("text/plain").send("Not found");
+	});
+}
+//#endregion
+//#region ../server/src/create-server.ts
+const DEFAULT_HOST = "127.0.0.1";
+/** Keeps the allow-list's tunnel hostname equal to the core's remote URL, now and after every `remote` change. */
+function followTunnelHostname(core, list) {
+	const sync = () => void core.remote.status().then((status) => list()?.setTunnelHostname(hostnameOfUrl(status.url)), () => void 0);
+	sync();
+	return core.onChange((change) => {
+		if (change.resource === "remote") sync();
+	});
+}
+const createServer$2 = async (options) => {
+	const app = Fastify({
+		logger: options.logger ?? false,
+		ajv: { customOptions: {
+			coerceTypes: false,
+			removeAdditional: false
+		} }
+	});
+	let boundPort = options.port;
+	let allowList;
+	const tags = createTunnelTags();
+	const sockets = createDeviceSockets();
+	const session = () => createSession(options.token, boundPort);
+	const guard = (() => {
+		let built;
+		return (...args) => {
+			allowList ??= allowListForPort(boundPort);
+			built ??= createGuard({
+				session: session(),
+				access: options.core.access,
+				tunnel: tags,
+				hostnames: () => allowList
+			});
+			return built(...args);
+		};
+	})();
+	await app.register(fastifyCookie);
+	await app.register(fastifyWebsocket, { options: { maxPayload: WS_MAX_PAYLOAD_BYTES } });
+	allowEmptyJsonBodies(app);
+	app.setErrorHandler(handleError);
+	app.decorateRequest("deviceId", "");
+	app.addHook("onRequest", guard);
+	registerRoutes(app, options.core, sockets);
+	registerAccessRoutes(app, {
+		core: options.core,
+		tunnel: tags,
+		sockets
+	});
+	registerLive(app, options.core, sockets);
+	const labels = createDeviceLabels(options.core);
+	const gateway = options.gateway ?? createMachineGateway(options.core);
+	registerMachineRoutes(app, {
+		core: options.core,
+		sockets,
+		gateway
+	});
+	registerMachineLink(app, {
+		core: options.core,
+		sockets,
+		gateway
+	});
+	await registerMachineProxy(app, {
+		sockets,
+		gateway,
+		hubDeviceLabel: labels.label
+	});
+	await registerStaticAssets(app, options.staticDir);
+	const tunnel = createTunnelListener({
+		app,
+		tags,
+		hostname: () => allowList?.tunnelHostname()
+	});
+	let stopFollowing = () => {};
+	let stopReaping = () => {};
+	let stopSummaries = () => {};
+	try {
+		await app.listen({
+			port: options.port,
+			host: options.host ?? DEFAULT_HOST
+		});
+		boundPort = portOf(app.server.address(), options.port);
+		allowList = allowListForPort(boundPort);
+		stopSummaries = startSummaryWriter(options.core, gateway);
+		stopFollowing = followTunnelHostname(options.core, () => allowList);
+		stopReaping = options.core.onChange((change) => {
+			if (change.resource === "devices") closeSocketsOfGoneDevices(options.core, sockets);
+		});
+	} catch (error) {
+		await app.close();
+		throw error;
+	}
+	const { port: tunnelPort } = await tunnel.start();
+	const origin = `http://${DEFAULT_HOST}:${boundPort}`;
+	return {
+		app,
+		port: boundPort,
+		tunnelPort,
+		origin,
+		url: `${origin}/?token=${encodeURIComponent(options.token)}`,
+		close: async () => {
+			labels.stop();
+			stopFollowing();
+			stopReaping();
+			stopSummaries();
+			await tunnel.close();
+			await app.close();
+		}
+	};
+};
+function portOf(address, fallback) {
+	return typeof address === "object" && address ? address.port : fallback;
+}
+//#endregion
+//#region src/logging/file-logging.ts
+const METHODS = [
+	"log",
+	"info",
+	"warn",
+	"error"
+];
+/** Mirrors `console.*` into `<home>/logs/server.log` with timestamps. Returns a function that undoes it. */
+function mirrorConsoleToLogFile(home, target = console) {
+	const log = createRotatingLog(serverLogOf(home));
+	const originals = /* @__PURE__ */ new Map();
+	for (const method of METHODS) {
+		const original = target[method].bind(target);
+		originals.set(method, target[method]);
+		target[method] = (...args) => {
+			original(...args);
+			log.write(`${(/* @__PURE__ */ new Date()).toISOString()} ${method} ${format(...args)}\n`);
+		};
+	}
+	return () => {
+		for (const [method, original] of originals) target[method] = original;
+	};
+}
+//#endregion
+//#region src/machines/link-endpoint.ts
+/** `https://host` dials `wss://host/api/machines/link`; a loopback hub `http://127.0.0.1:<port>` dials `ws://`. */
+function linkUrlOf(hubUrl) {
+	const url = new URL(hubUrl);
+	return `${url.protocol === "https:" ? "wss:" : "ws:"}//${url.host}${MACHINE_LINK_PATH}`;
+}
+const originOf = (hubUrl) => new URL(hubUrl).origin;
+/** The frame's `query` has no leading `?` (the hub splits the URL there); both forms are accepted. */
+function targetOf(path, query) {
+	const bare = query.startsWith("?") ? query.slice(1) : query;
+	return bare === "" ? path : `${path}?${bare}`;
+}
+//#endregion
+//#region src/machines/link-context.ts
+const loopbackHeaders = (context, hubDevice) => ({
+	host: `127.0.0.1:${context.port}`,
+	authorization: `Bearer ${context.token}`,
+	"x-tau-hub-device": hubDevice
+});
+//#endregion
+//#region src/machines/link-request.ts
+function flatten(headers) {
+	const out = {};
+	for (const [name, value] of Object.entries(headers)) if (value !== void 0) out[name] = Array.isArray(value) ? value.join(", ") : value;
+	return out;
+}
+function requestHeaders(context, frame) {
+	return {
+		...loopbackHeaders(context, frame.hubDevice),
+		...frame.contentType !== void 0 && { "content-type": frame.contentType },
+		...frame.bodyBytes !== void 0 && frame.bodyBytes > 0 && { "content-length": String(frame.bodyBytes) }
+	};
+}
+/** Calls this machine's own server on loopback and streams the answer back as `response` + data frames. */
+function startRequest(context, frame, finished) {
+	const { id } = frame;
+	const hasBody = (frame.bodyBytes ?? 0) > 0;
+	let responded = false;
+	let done = false;
+	const finish = () => {
+		if (done) return;
+		done = true;
+		finished();
+	};
+	const req = request({
+		host: "127.0.0.1",
+		port: context.port,
+		method: frame.method,
+		path: targetOf(frame.path, frame.query),
+		headers: requestHeaders(context, frame)
+	}, (res) => {
+		responded = true;
+		context.sendControl({
+			type: "response",
+			id,
+			status: res.statusCode ?? 502,
+			headers: flatten(res.headers)
+		});
+		pipeResponse(res);
+	});
+	async function pipeResponse(res) {
+		try {
+			for await (const chunk of res) for (const part of chunkBody(id, chunk)) if (!await context.sender.push({
+				...part,
+				end: false
+			})) {
+				req.destroy();
+				return;
+			}
+			await context.sender.push({
+				id,
+				end: true,
+				text: false,
+				payload: /* @__PURE__ */ new Uint8Array(0)
+			});
+		} catch {
+			context.sendControl({
+				type: "close",
+				id,
+				code: 1011,
+				reason: "response failed"
+			});
+		} finally {
+			context.sender.drop(id);
+			finish();
+		}
+	}
+	req.on("error", () => {
+		if (done) return;
+		if (!responded) {
+			context.sendControl({
+				type: "response",
+				id,
+				status: 502,
+				headers: {}
+			});
+			context.sender.push({
+				id,
+				end: true,
+				text: false,
+				payload: /* @__PURE__ */ new Uint8Array(0)
+			}).then(() => {
+				context.sender.drop(id);
+				finish();
+			});
+		} else {
+			context.sendControl({
+				type: "close",
+				id,
+				code: 1011,
+				reason: "request failed"
+			});
+			context.sender.drop(id);
+			finish();
+		}
+	});
+	if (!hasBody) req.end();
+	return {
+		onData(payload, end) {
+			if (!hasBody || req.writableEnded) return;
+			const sent = payload.byteLength;
+			const flushed = () => sent > 0 && context.sendControl({
+				type: "credit",
+				id,
+				bytes: sent
+			});
+			if (sent > 0) req.write(payload, flushed);
+			if (end) req.end();
+		},
+		onClose() {
+			req.destroy();
+			context.sender.drop(id);
+			finish();
+		},
+		abort() {
+			req.destroy();
+			context.sender.drop(id);
+		}
+	};
+}
+//#endregion
+//#region src/machines/link-sender.ts
+const BUFFER_LIMIT = 1048576;
+const BUFFER_POLL_MS = 5;
+function createLinkSender(socket, onDrained = () => void 0) {
+	const lanes = /* @__PURE__ */ new Map();
+	const pendingBytes = /* @__PURE__ */ new Map();
+	let pumping = false;
+	let closed = false;
+	const laneOf = (id) => {
+		const existing = lanes.get(id);
+		if (existing) return existing;
+		const lane = {
+			credit: CREDIT_WINDOW_BYTES,
+			queue: []
+		};
+		lanes.set(id, lane);
+		return lane;
+	};
+	const sendable = (lane) => {
+		const head = lane.queue[0];
+		return head !== void 0 && lane.credit >= head.frame.payload.byteLength;
+	};
+	function sendOne(id, lane) {
+		const item = lane.queue.shift();
+		lane.credit -= item.frame.payload.byteLength;
+		pendingBytes.set(id, (pendingBytes.get(id) ?? 0) - item.frame.payload.byteLength);
+		socket.send(encodeDataFrame(item.frame), { binary: true }, () => void 0);
+		item.done(true);
+		onDrained(id);
+	}
+	async function pump() {
+		if (pumping) return;
+		pumping = true;
+		try {
+			while (!closed) {
+				const ready = [...lanes].filter(([, lane]) => sendable(lane));
+				if (ready.length === 0) return;
+				if (socket.bufferedAmount > BUFFER_LIMIT) {
+					await new Promise((resolve) => setTimeout(resolve, BUFFER_POLL_MS));
+					continue;
+				}
+				for (const [id, lane] of ready) sendOne(id, lane);
+				await new Promise((resolve) => setImmediate(resolve));
+			}
+		} finally {
+			pumping = false;
+		}
+	}
+	return {
+		push(frame) {
+			if (closed) return Promise.resolve(false);
+			return new Promise((resolve) => {
+				laneOf(frame.id).queue.push({
+					frame,
+					done: resolve
+				});
+				pendingBytes.set(frame.id, (pendingBytes.get(frame.id) ?? 0) + frame.payload.byteLength);
+				pump();
+			});
+		},
+		addCredit(id, bytes) {
+			const lane = lanes.get(id);
+			if (!lane) return;
+			lane.credit += bytes;
+			pump();
+		},
+		pending: (id) => pendingBytes.get(id) ?? 0,
+		drop(id) {
+			for (const item of lanes.get(id)?.queue ?? []) item.done(false);
+			lanes.delete(id);
+			pendingBytes.delete(id);
+		},
+		closeAll() {
+			closed = true;
+			for (const id of [...lanes.keys()]) this.drop(id);
+		}
+	};
+}
+//#endregion
+//#region src/machines/link-socket.ts
+const MAX_INPUT_BYTES = 65536;
+const NOT_SENDABLE = /* @__PURE__ */ new Set([
+	1004,
+	1005,
+	1006,
+	1015
+]);
+const closeCodeOf = (code) => code >= 1e3 && code < 5e3 && !NOT_SENDABLE.has(code) ? code : 1011;
+/** Relays one hub stream to a loopback WebSocket of this machine's own server (`/api/live`, terminal stream). */
+function startSocketStream(context, frame, finished) {
+	const { id } = frame;
+	const socket = new WebSocket(`ws://127.0.0.1:${context.port}${targetOf(frame.path, frame.query)}`, {
+		headers: loopbackHeaders(context, frame.hubDevice),
+		maxPayload: CHUNK_BYTES * 4
+	});
+	const queued = [];
+	let open = false;
+	let ended = false;
+	const end = (code, reason, tell) => {
+		if (ended) return;
+		ended = true;
+		if (!tell) {
+			context.sender.drop(id);
+			return finished();
+		}
+		const close = {
+			type: "close",
+			id,
+			code: closeCodeOf(code),
+			reason: reason.slice(0, 120)
+		};
+		context.sender.push({
+			id,
+			end: true,
+			text: false,
+			payload: /* @__PURE__ */ new Uint8Array(0)
+		}).then((sent) => {
+			if (sent) context.sendControl(close);
+			context.sender.drop(id);
+			finished();
+		});
+	};
+	const credit = (bytes) => bytes > 0 && context.sendControl({
+		type: "credit",
+		id,
+		bytes
+	});
+	function deliver({ payload, text }) {
+		const bytes = payload.byteLength;
+		if (text) return void socket.send(Buffer.from(payload).toString("utf8"), () => credit(bytes));
+		for (let offset = 0; offset < bytes; offset += MAX_INPUT_BYTES) {
+			const part = payload.subarray(offset, offset + MAX_INPUT_BYTES);
+			socket.send(part, { binary: true }, () => credit(part.byteLength));
+		}
+	}
+	socket.on("open", () => {
+		open = true;
+		context.sendControl({
+			type: "open",
+			id,
+			path: frame.path,
+			query: frame.query,
+			hubDevice: frame.hubDevice
+		});
+		for (const held of queued.splice(0)) deliver(held);
+	});
+	socket.on("message", (data, isBinary) => {
+		const bytes = Buffer.isBuffer(data) ? data : Buffer.concat(data);
+		if (!isBinary && bytes.byteLength > 262144) {
+			socket.close(1009, "message too big");
+			return end(1009, "message too big", true);
+		}
+		for (const part of chunkBody(id, bytes, !isBinary)) context.sender.push({
+			...part,
+			end: false
+		}).then(relieve);
+		if (context.sender.pending(id) >= 1048576) socket.pause();
+	});
+	const relieve = () => {
+		if (context.sender.pending(id) < 524288) socket.resume();
+	};
+	socket.on("close", (code, reason) => end(code, reason.toString(), true));
+	socket.on("error", () => end(1011, "loopback socket failed", true));
+	return {
+		onData(payload, _end, text) {
+			if (ended) return;
+			if (text && payload.byteLength > MAX_INPUT_BYTES) {
+				socket.close(1009, "message too big");
+				return end(1009, "message too big", true);
+			}
+			const held = {
+				payload: Uint8Array.from(payload),
+				text
+			};
+			if (open) deliver(held);
+			else queued.push(held);
+		},
+		onClose() {
+			end(1e3, "", false);
+			socket.close();
+		},
+		abort() {
+			ended = true;
+			context.sender.drop(id);
+			socket.terminate();
+		}
+	};
+}
+//#endregion
+//#region src/machines/link-session.ts
+function parseFrame(data) {
+	try {
+		const value = JSON.parse(data.toString());
+		return Value.Check(LinkFrameSchema, value) ? value : void 0;
+	} catch {
+		return;
+	}
+}
+/** Serves one open link socket: `hello`, pings, `request` and `open` frames, data and credit. */
+function runLinkSession(socket, options) {
+	const streams = /* @__PURE__ */ new Map();
+	const sender = createLinkSender(socket);
+	const send = (frame) => {
+		if (socket.readyState === socket.OPEN) socket.send(JSON.stringify(frame));
+	};
+	const context = {
+		port: options.port,
+		token: options.token,
+		sender,
+		sendControl: send,
+		log: options.log
+	};
+	const forget = (id) => () => void streams.delete(id);
+	const serve = (frame) => {
+		if (frame.type === "request") streams.set(frame.id, startRequest(context, frame, forget(frame.id)));
+		else if (frame.type === "open") streams.set(frame.id, startSocketStream(context, frame, forget(frame.id)));
+		else if (frame.type === "credit") sender.addCredit(frame.id, frame.bytes);
+		else if (frame.type === "close") streams.get(frame.id)?.onClose();
+		else if (frame.type === "ping") send({ type: "pong" });
+	};
+	const logged = (frame) => {
+		if (frame.type === "request" || frame.type === "open") options.log(`hub device ${JSON.stringify(frame.hubDevice)}: ${frame.type === "request" ? frame.method : "open"} ${frame.path}`);
+	};
+	let lastFrameAt = Date.now();
+	socket.on("message", (data, isBinary) => {
+		lastFrameAt = Date.now();
+		if (isBinary) {
+			const bytes = Buffer.isBuffer(data) ? data : Buffer.concat(data);
+			const decoded = decodeDataFrame(bytes);
+			if (decoded) streams.get(decoded.id)?.onData(decoded.payload, decoded.end, decoded.text);
+			return;
+		}
+		const frame = parseFrame(data);
+		if (!frame) return;
+		logged(frame);
+		serve(frame);
+	});
+	const ping = setInterval(() => {
+		if (Date.now() - lastFrameAt > (options.idleMs ?? 45e3)) return socket.terminate();
+		send({ type: "ping" });
+	}, options.pingMs ?? 15e3);
+	const ended = new Promise((resolve) => {
+		socket.once("close", (code, reason) => {
+			clearInterval(ping);
+			sender.closeAll();
+			for (const stream of streams.values()) stream.abort();
+			streams.clear();
+			resolve({
+				code,
+				reason: reason.toString()
+			});
+		});
+	});
+	send({
+		type: "hello",
+		...options.hello
+	});
+	return {
+		ended,
+		close: () => socket.close(1e3, "stopping")
+	};
+}
+//#endregion
+//#region src/machines/link-state.ts
+const MESSAGES = {
+	reconnecting: "Reconnecting to the hub",
+	unreachable: "Hub unreachable",
+	"update-required": "Update tau on the hub or on this machine",
+	refused: "The hub refused this machine. Run `tau disconnect`, then link again."
+};
+function hubLinkOf(state, file, since) {
+	if (state === "none" || !file) return HUB_LINK_NONE;
+	return {
+		state,
+		hubName: file.name,
+		hubUrl: file.hubUrl,
+		since,
+		message: MESSAGES[state] ?? null
+	};
+}
+const fileKey = (file) => file ? `${file.hubUrl}\n${file.machineSecret}` : "";
+//#endregion
+//#region src/machines/link-client.ts
+const DEFAULT_TUNING = {
+	pollMs: 1e3,
+	backoffBaseMs: 1e3,
+	backoffMaxMs: 3e4,
+	unreachableAfter: 3,
+	log: (message) => console.log(`[link] ${message}`)
+};
+const REFUSED_STATUSES = /* @__PURE__ */ new Set([401, 403]);
+const REFUSED_CLOSE = 1008;
+async function helloOf(file, core) {
+	const threadCount = await core.conversations.listAll().then((all) => all.length, () => 0);
+	return {
+		name: file.machineName ?? hostname(),
+		os: `${platform()} ${arch()}`,
+		tauVersion: safeVersion(),
+		protocolVersion: PROTOCOL_VERSION,
+		threadCount
+	};
+}
+function safeVersion() {
+	try {
+		return cliVersion();
+	} catch {
+		return "unknown";
+	}
+}
+/** Reads `hub.json` (and watches it by polling, so `tau connect` and `tau disconnect` need no restart) and keeps the hub link up. */
+function startLinkClientWith(options, tuning) {
+	const { core, hubFile } = options;
+	let stopped = false;
+	let wakeSleeper;
+	/** A pause that `stop()` cuts short, so shutting down never waits for a poll tick. */
+	const sleep = (ms) => new Promise((resolve) => {
+		const timer = setTimeout(resolve, ms);
+		wakeSleeper = () => {
+			clearTimeout(timer);
+			resolve();
+		};
+	});
+	let active;
+	let lastState = "none";
+	let since = Date.now();
+	const report = (state, file) => {
+		if (state !== lastState) since = Date.now();
+		lastState = state;
+		core.machines.reportLink(hubLinkOf(state, file, since));
+	};
+	async function waitFor(ms, key) {
+		const deadline = Date.now() + ms;
+		while (!stopped && Date.now() < deadline) {
+			await sleep(Math.min(tuning.pollMs, Math.max(1, deadline - Date.now())));
+			if (fileKey(await hubFile.read()) !== key) return;
+		}
+	}
+	function dial(file) {
+		return new Promise((resolve) => {
+			const key = fileKey(file);
+			let linked = false;
+			const socket = new WebSocket(linkUrlOf(file.hubUrl), {
+				headers: {
+					authorization: `Bearer ${file.machineSecret}`,
+					origin: originOf(file.hubUrl)
+				},
+				handshakeTimeout: 15e3
+			});
+			active = socket;
+			socket.once("unexpected-response", (_request, response) => {
+				response.resume();
+				resolve({
+					outcome: REFUSED_STATUSES.has(response.statusCode ?? 0) ? "refused" : "failed",
+					linked
+				});
+			});
+			socket.once("error", () => resolve({
+				outcome: "failed",
+				linked
+			}));
+			socket.once("open", () => {
+				helloOf(file, core).then(async (hello) => {
+					if (socket.readyState !== socket.OPEN) return resolve({
+						outcome: "failed",
+						linked
+					});
+					linked = true;
+					report("linked", file);
+					const session = runLinkSession(socket, {
+						port: options.port,
+						token: options.token,
+						hello,
+						...tuning
+					});
+					const watch = setInterval(async () => {
+						if (fileKey(await hubFile.read()) !== key) session.close();
+					}, tuning.pollMs);
+					const end = await session.ended;
+					clearInterval(watch);
+					resolve({
+						outcome: outcomeOf(end),
+						linked
+					});
+				});
+			});
+		});
+	}
+	const outcomeOf = ({ code }) => {
+		if (code === REFUSED_CLOSE) return "refused";
+		return code === 4001 ? "update-required" : "ended";
+	};
+	async function loop() {
+		let attempts = 0;
+		let wasLinked = false;
+		while (!stopped) {
+			const file = await hubFile.read();
+			if (!file) {
+				if (lastState !== "none") report("none", void 0);
+				attempts = 0;
+				wasLinked = false;
+				await sleep(tuning.pollMs);
+				continue;
+			}
+			if (lastState === "none") report("connecting", file);
+			const { outcome, linked } = await dial(file);
+			active = void 0;
+			if (stopped) return;
+			wasLinked ||= linked;
+			attempts = linked ? 1 : attempts + 1;
+			const key = fileKey(file);
+			if (outcome === "refused") {
+				report("refused", file);
+				await waitFor(Number.POSITIVE_INFINITY, key);
+				attempts = 0;
+				continue;
+			}
+			if (outcome === "update-required") report("update-required", file);
+			else if (attempts >= tuning.unreachableAfter) report("unreachable", file);
+			else report(wasLinked ? "reconnecting" : "connecting", file);
+			await waitFor(Math.min(tuning.backoffMaxMs, tuning.backoffBaseMs * 2 ** Math.max(0, attempts - 1)), key);
+		}
+	}
+	const running = loop().catch((error) => {
+		tuning.log(`link client stopped: ${error instanceof Error ? error.message : String(error)}`);
+	});
+	return { async stop() {
+		stopped = true;
+		wakeSleeper?.();
+		const socket = active;
+		if (socket) {
+			socket.close(1e3, "stopping");
+			setTimeout(() => socket.terminate(), 1e3).unref();
+		}
+		await running;
+	} };
+}
+const startLinkClient = (options) => startLinkClientWith(options, DEFAULT_TUNING);
+//#endregion
+//#region src/listen-on-free-port.ts
+const MAX_PORT_ATTEMPTS = 100;
+const MAX_PORT = 65535;
+function isAddressInUse(error) {
+	return error?.code === "EADDRINUSE";
+}
+/** Tries `preferred`, then the next ports, until `start` succeeds. */
+async function listenOnFreePort(preferred, start) {
+	const last = Math.min(preferred + MAX_PORT_ATTEMPTS - 1, MAX_PORT);
+	for (let port = preferred; port <= last; port++) try {
+		return await start(port);
+	} catch (error) {
+		if (!isAddressInUse(error)) throw error;
+	}
+	throw new Error(`No free port between ${preferred} and ${last}`);
+}
+//#endregion
+//#region src/update/latest-source.ts
+/**
+* Where core learns the latest published version. `TAU_FAKE_LATEST` is a test hook (e2e): its value is the
+* answer, so no npm runs.
+*/
+function latestVersionSource(env = process.env) {
+	const fake = env.TAU_FAKE_LATEST;
+	if (fake) return async () => fake;
+	return () => fetchLatestVersion(spawnCommand, process.execPath);
+}
+//#endregion
+//#region src/run.ts
+const withToken = (origin, token) => `${origin}/?token=${encodeURIComponent(token)}`;
+async function reportExistingInstance(options, dependencies, token) {
+	const running = await readRunningInstance(options.home);
+	if (!running?.url) return void 0;
+	const url = withToken(running.url, token);
+	dependencies.log(`tau is already running: ${url}`);
+	return url;
+}
+async function openBrowserSafely(url, { openBrowser, log }) {
+	try {
+		await openBrowser(url);
+	} catch (error) {
+		log(`Could not open the browser (${error instanceof Error ? error.message : error}). Open the URL above.`);
+	}
+}
+/** Resolves to the running app, or `undefined` when another instance already serves this home. */
+async function run(options, dependencies) {
+	await ensurePrivateDirectory(options.home);
+	const token = await readOrCreateToken(options.home);
+	if (await reportExistingInstance(options, dependencies, token)) return void 0;
+	const tunnelTarget = createTunnelTargetRef();
+	const hubFile = createHubFileStore(options.home);
+	const core = await dependencies.createCore({
+		home: options.home,
+		faux: options.faux,
+		cliEntry: dependencies.cliEntry,
+		tunnelTarget: tunnelTarget.get,
+		forgetHub: () => hubFile.delete(),
+		currentVersion: dependencies.version ?? "",
+		latestVersion: dependencies.latestVersion ?? latestVersionSource()
+	});
+	try {
+		const server = await listenOnFreePort(options.port, (port) => dependencies.createServer({
+			core,
+			port,
+			token,
+			staticDir: dependencies.staticDir
+		}));
+		tunnelTarget.set(server.tunnelPort);
+		await publishServerUrl(options.home, server.origin, dependencies.version);
+		dependencies.log(`tau is running: ${server.url}`);
+		if (options.open) await openBrowserSafely(server.url, dependencies);
+		const link = dependencies.startLinkClient?.({
+			port: server.port,
+			token,
+			hubFile,
+			core
+		});
+		return {
+			url: server.url,
+			close: async () => {
+				await link?.stop();
+				await server.close();
+				await core.close();
+			}
+		};
+	} catch (error) {
+		await core.close();
+		throw error;
+	}
+}
+//#endregion
+//#region src/static-dir.ts
+const here = (relative) => fileURLToPath(new URL(relative, import.meta.url));
+/** Bundled (`dist/web` next to `dist/bin.js`) or, when run from source, the sibling web package build. */
+const CANDIDATES = [here("./web"), here("../../web/dist")];
+function findStaticDir(candidates = CANDIDATES) {
+	return candidates.find((directory) => existsSync(join(directory, "index.html")));
+}
+//#endregion
+//#region src/serve.ts
+async function openBrowser(url) {
+	const { default: open } = await import("open");
+	await open(url);
+}
+/** Only the service-managed run is watched: a hang is killed and the OS service restarts it. */
+function startServiceWatchdog(home) {
+	return startWatchdog({
+		lastExitFile: join(home, "last-exit.json"),
+		logFile: join(home, "logs", "server.log"),
+		workerUrl: new URL("./watchdog.js", import.meta.url)
+	});
+}
+function closeOnSignals(close, markExit) {
+	let closing = false;
+	const shutDown = () => {
+		if (closing) return;
+		closing = true;
+		markExit("signal");
+		close().then(() => process.exit(0), (error) => {
+			console.error(error);
+			process.exit(1);
+		});
+	};
+	process.on("SIGINT", shutDown);
+	process.on("SIGTERM", shutDown);
+}
+const portOfUrl = (url) => Number(new URL(url).port);
+async function serveOnce(argv) {
+	const parsed = parseCliOptions(argv);
+	const { explicitPort } = lifecycleFlagsOf(argv, {
+		defaultHome: defaultHome(),
+		env: process.env
+	});
+	mirrorConsoleToLogFile(parsed.home);
+	if (parsed.service) await waitForFreeHome(parsed.home, { log: (message) => console.log(message) });
+	const options = {
+		...parsed,
+		port: resolvePort(parsed.home, explicitPort)
+	};
+	const app = await run(options, {
+		createCore,
+		createServer: createServer$2,
+		openBrowser,
+		startLinkClient,
+		log: (message) => console.log(message),
+		staticDir: findStaticDir(),
+		cliEntry: cliEntry().entry,
+		version: cliVersion()
+	});
+	if (!app) return options.service ? process.exit(1) : void 0;
+	writeStoredPort(options.home, portOfUrl(app.url));
+	const watchdog = options.service ? startServiceWatchdog(options.home) : void 0;
+	const markExit = createExitMarker(join(options.home, "last-exit.json"));
+	process.on("exit", (code) => code === 0 && markExit("clean"));
+	closeOnSignals(async () => {
+		await watchdog?.stop();
+		await app.close();
+	}, markExit);
+}
+/** `tau serve`: the server in the foreground. `argv` holds only the server flags. */
+async function serveInForeground(argv) {
+	try {
+		await serveOnce(argv);
+	} catch (error) {
+		console.error(error instanceof Error ? error.message : error);
+		process.exit(1);
+	}
+}
+//#endregion
+export { lifecycleFlagsOf as a, connectRefusal as c, commandWordOf as i, serverLogOf as n, createHubFileStore as o, writeStoredPort as r, alreadyLinkedRefusal as s, serveInForeground as t };