@pairlobby/server-core 0.23.0 → 0.24.0

package/README.md

@@ -1,5 +1,5 @@
 # @pairlobby/server-core
 
-Part of [PairLobby](https://github.com/PairLobby/app), built from `packages/server-core` at version 0.23.0. See that repository for documentation.
+Part of [PairLobby](https://github.com/PairLobby/app), built from `packages/server-core` at version 0.24.0. See that repository for documentation.
 
 Licensed under the [Elastic License 2.0](LICENSE): you may use, copy, modify and distribute it, but may not offer it to others as a hosted or managed service.

package/dist/admission.d.ts

@@ -1,3 +1,4 @@
+import type { RequestContext } from './ports.js';
 /** The header that carries a relay's create token, the same one a hosted account token travels in. */
 export declare const CREATE_TOKEN_HEADER = "x-pairlobby-account-token";
 export declare const CREATE_TOKEN_REQUIRED = "this relay needs its create token to start a room; set PAIRLOBBY_CREATE_TOKEN";
@@ -33,10 +34,15 @@ export type AdmissionOptions = {
     /** Absent means no rate limits. */
     limiter?: RateLimiter;
     limits?: Partial<AdmissionLimits>;
-    /** The caller's address as the transport saw it; undefined when it cannot tell, and then every such caller shares one count. */
-    clientAddress?: (request: Request) => string | undefined;
+    /**
+     * The header a proxy in front of the relay puts the caller's address in, such as `x-forwarded-for`.
+     * Absent means no such header is read, whoever sends it: a caller could write it themselves.
+     */
+    trustedProxyHeader?: string;
+    /** The caller's address; defaults to the proxy header when one is trusted, else the connection's address. Undefined makes every such caller share one count. */
+    clientAddress?: (request: Request, context: RequestContext) => string | undefined;
     /** Callers the limits do not apply to, such as this device on a relay that is not behind a proxy. */
-    exempt?: (request: Request) => boolean;
+    exempt?: (request: Request, context: RequestContext) => boolean;
 };
 type MemoryRateLimiterOptions = {
     now?: () => number;
@@ -50,17 +56,17 @@ export declare function createAdmission(options: AdmissionOptions): {
     /** Creating a room needs the create token here. */
     createTokenRequired: boolean;
     /** Refuses a room creation without the create token, then counts it against the caller. */
-    beforeCreate(request: Request): Promise<void>;
+    beforeCreate(request: Request, context?: RequestContext): Promise<void>;
     /**
      * The team token check behind token-mode login: counted first, in its own bucket so
      * guessing cannot spend the create budget, then refused the same way whether the
      * token is missing or wrong.
      */
-    beforeAccountCheck(request: Request): Promise<void>;
+    beforeAccountCheck(request: Request, context?: RequestContext): Promise<void>;
     /** Counts an invite redemption against the caller and the whole relay, before the code is looked up. */
-    beforeRedeem(request: Request): Promise<void>;
+    beforeRedeem(request: Request, context?: RequestContext): Promise<void>;
     /** A code that matched nothing costs the caller once more, so guessing is slower than joining. */
-    afterUnknownInvite(request: Request): Promise<void>;
+    afterUnknownInvite(request: Request, context?: RequestContext): Promise<void>;
 };
 export type Admission = ReturnType<typeof createAdmission>;
 /**

package/dist/admission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admission.d.ts","sourceRoot":"","sources":["../src/admission.ts"],"names":[],"mappings":"AAMA,sGAAsG;AACtG,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D,eAAO,MAAM,qBAAqB,kFAAkF,CAAC;AAErH,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,8CAA8C,CAAC;AAE9E,MAAM,MAAM,SAAS,GAAG;IAAC,SAAS,EAAE,MAAM,CAAA;CAAC,CAAC;AAE5C,MAAM,MAAM,YAAY,GAAG;IAAC,EAAE,EAAE,IAAI,CAAA;CAAC,GAAG;IAAC,EAAE,EAAE,KAAK,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAC,CAAC;AAE1E,2HAA2H;AAC3H,MAAM,WAAW,WAAW;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAC5E;AAED,MAAM,MAAM,eAAe,GAAG;IAC1B,6CAA6C;IAC7C,yBAAyB,EAAE,MAAM,CAAC;IAClC,iGAAiG;IACjG,yBAAyB,EAAE,MAAM,CAAC;IAClC,+EAA+E;IAC/E,qBAAqB,EAAE,MAAM,CAAC;IAC9B,sHAAsH;IACtH,+BAA+B,EAAE,MAAM,CAAC;CAC3C,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,eAAiJ,CAAC;AAEzL,MAAM,MAAM,gBAAgB,GAAG;IAC3B,gHAAgH;IAChH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAClC,gIAAgI;IAChI,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;IACzD,qGAAqG;IACrG,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;CAC1C,CAAC;AAIF,KAAK,wBAAwB,GAAG;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC;AAEvE,6GAA6G;AAC7G,wBAAgB,iBAAiB,CAAC,EAAC,GAAc,EAAE,OAAgB,EAAC,GAAE,wBAA6B,GAAG,WAAW,CAwBhH;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB;4BAchB,OAAO,KAAG,OAAO,CAAC,OAAO,CAAC;IAM3D,mDAAmD;;IAEnD,2FAA2F;0BAC/D,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAMnD;;;;OAIG;gCAC+B,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAMzD,wGAAwG;0BAC5E,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,kGAAkG;gCAChE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;EAOhE;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;AAE3D;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAInF"}
+{"version":3,"file":"admission.d.ts","sourceRoot":"","sources":["../src/admission.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,YAAY,CAAC;AAE/C,sGAAsG;AACtG,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D,eAAO,MAAM,qBAAqB,kFAAkF,CAAC;AAErH,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,8CAA8C,CAAC;AAE9E,MAAM,MAAM,SAAS,GAAG;IAAC,SAAS,EAAE,MAAM,CAAA;CAAC,CAAC;AAE5C,MAAM,MAAM,YAAY,GAAG;IAAC,EAAE,EAAE,IAAI,CAAA;CAAC,GAAG;IAAC,EAAE,EAAE,KAAK,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAC,CAAC;AAE1E,2HAA2H;AAC3H,MAAM,WAAW,WAAW;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAC5E;AAED,MAAM,MAAM,eAAe,GAAG;IAC1B,6CAA6C;IAC7C,yBAAyB,EAAE,MAAM,CAAC;IAClC,iGAAiG;IACjG,yBAAyB,EAAE,MAAM,CAAC;IAClC,+EAA+E;IAC/E,qBAAqB,EAAE,MAAM,CAAC;IAC9B,sHAAsH;IACtH,+BAA+B,EAAE,MAAM,CAAC;CAC3C,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,eAAiJ,CAAC;AAEzL,MAAM,MAAM,gBAAgB,GAAG;IAC3B,gHAAgH;IAChH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAClC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gKAAgK;IAChK,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,KAAK,MAAM,GAAG,SAAS,CAAC;IAClF,qGAAqG;IACrG,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC;CACnE,CAAC;AAIF,KAAK,wBAAwB,GAAG;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC;AAEvE,6GAA6G;AAC7G,wBAAgB,iBAAiB,CAAC,EAAC,GAAc,EAAE,OAAgB,EAAC,GAAE,wBAA6B,GAAG,WAAW,CAwBhH;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB;4BAgBhB,OAAO,KAAG,OAAO,CAAC,OAAO,CAAC;IAM3D,mDAAmD;;IAEnD,2FAA2F;0BAC/D,OAAO,YAAW,cAAc,GAAQ,OAAO,CAAC,IAAI,CAAC;IAMjF;;;;OAIG;gCAC+B,OAAO,YAAW,cAAc,GAAQ,OAAO,CAAC,IAAI,CAAC;IAMvF,wGAAwG;0BAC5E,OAAO,YAAW,cAAc,GAAQ,OAAO,CAAC,IAAI,CAAC;IAIjF,kGAAkG;gCAChE,OAAO,YAAW,cAAc,GAAQ,OAAO,CAAC,IAAI,CAAC;EAO9F;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;AAE3D;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAInF"}

package/dist/admission.js

@@ -38,9 +38,11 @@ export function memoryRateLimiter({ now = Date.now, maxKeys = 10_000 } = {}) {
 export function createAdmission(options) {
     const limits = { ...DEFAULT_ADMISSION_LIMITS, ...options.limits };
     const tokenDigest = options.createToken ? hashCredential(options.createToken) : null;
-    const address = (request) => options.clientAddress?.(request) ?? 'unknown';
-    const take = async (request, key, cost, limit) => {
-        if (!options.limiter || options.exempt?.(request)) {
+    const header = options.trustedProxyHeader;
+    const clientAddress = options.clientAddress ?? ((request, context) => (header ? proxiedAddress(request, header) : undefined) ?? context.peerAddress);
+    const address = (request, context) => clientAddress(request, context) ?? 'unknown';
+    const take = async (request, context, key, cost, limit) => {
+        if (!options.limiter || options.exempt?.(request, context)) {
             return;
         }
         const decision = await options.limiter.take(key, cost, limit);
@@ -58,34 +60,34 @@ export function createAdmission(options) {
         /** Creating a room needs the create token here. */
         createTokenRequired: tokenDigest !== null,
         /** Refuses a room creation without the create token, then counts it against the caller. */
-        async beforeCreate(request) {
+        async beforeCreate(request, context = {}) {
             if (tokenDigest && !(await tokenMatches(request))) {
                 throw new ProtocolError('unauthorized', CREATE_TOKEN_REQUIRED);
             }
-            await take(request, `create:address:${address(request)}`, 1, { perMinute: limits.createPerMinutePerAddress });
+            await take(request, context, `create:address:${address(request, context)}`, 1, { perMinute: limits.createPerMinutePerAddress });
         },
         /**
          * The team token check behind token-mode login: counted first, in its own bucket so
          * guessing cannot spend the create budget, then refused the same way whether the
          * token is missing or wrong.
          */
-        async beforeAccountCheck(request) {
-            await take(request, `account-check:address:${address(request)}`, 1, { perMinute: limits.accountCheckPerMinutePerAddress });
+        async beforeAccountCheck(request, context = {}) {
+            await take(request, context, `account-check:address:${address(request, context)}`, 1, { perMinute: limits.accountCheckPerMinutePerAddress });
             if (!(await tokenMatches(request))) {
                 throw new ProtocolError('unauthorized', TEAM_TOKEN_REFUSED);
             }
         },
         /** Counts an invite redemption against the caller and the whole relay, before the code is looked up. */
-        async beforeRedeem(request) {
-            await take(request, `redeem:address:${address(request)}`, 1, { perMinute: limits.redeemPerMinutePerAddress });
-            await take(request, 'redeem:global', 1, { perMinute: limits.redeemPerMinuteGlobal });
+        async beforeRedeem(request, context = {}) {
+            await take(request, context, `redeem:address:${address(request, context)}`, 1, { perMinute: limits.redeemPerMinutePerAddress });
+            await take(request, context, 'redeem:global', 1, { perMinute: limits.redeemPerMinuteGlobal });
         },
         /** A code that matched nothing costs the caller once more, so guessing is slower than joining. */
-        async afterUnknownInvite(request) {
-            if (!options.limiter || options.exempt?.(request)) {
+        async afterUnknownInvite(request, context = {}) {
+            if (!options.limiter || options.exempt?.(request, context)) {
                 return;
             }
-            await options.limiter.take(`redeem:address:${address(request)}`, 1, { perMinute: limits.redeemPerMinutePerAddress });
+            await options.limiter.take(`redeem:address:${address(request, context)}`, 1, { perMinute: limits.redeemPerMinutePerAddress });
         }
     };
 }

package/dist/admission.js.map

@@ -1 +1 @@
-{"version":3,"file":"admission.js","sourceRoot":"","sources":["../src/admission.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,mFAAmF;AACnF,8DAA8D;AAE9D,OAAO,EAAC,aAAa,EAAE,YAAY,EAAE,cAAc,EAAC,MAAM,qBAAqB,CAAC;AAEhF,sGAAsG;AACtG,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAE/D,MAAM,CAAC,MAAM,qBAAqB,GAAG,+EAA+E,CAAC;AAErH,gGAAgG;AAChG,MAAM,CAAC,MAAM,kBAAkB,GAAG,2CAA2C,CAAC;AAsB9E,MAAM,CAAC,MAAM,wBAAwB,GAAoB,EAAC,yBAAyB,EAAE,EAAE,EAAE,yBAAyB,EAAE,EAAE,EAAE,qBAAqB,EAAE,GAAG,EAAE,+BAA+B,EAAE,EAAE,EAAC,CAAC;AAkBzL,6GAA6G;AAC7G,MAAM,UAAU,iBAAiB,CAAC,EAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,KAA8B,EAAE;IAC/F,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,OAAO;QACH,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAC,SAAS,EAAC;YAC7B,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,SAAS,GAAG,MAAM,CAAC;YACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/G,IAAI,MAAM,GAAG,IAAI,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAC,MAAM,EAAE,SAAS,EAAE,EAAE,EAAC,CAAC,CAAC;gBAC1C,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,EAAC,CAAC;YACzE,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,EAAC,CAAC,CAAC;YACzD,IAAI,OAAO,CAAC,IAAI,GAAG,OAAO,EAAE,CAAC;gBACzB,8EAA8E;gBAC9E,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACnC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,IAAI,SAAS,EAAE,CAAC;wBAC/D,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBACzB,CAAC;gBACL,CAAC;YACL,CAAC;YACD,OAAO,EAAC,EAAE,EAAE,IAAI,EAAC,CAAC;QACtB,CAAC;KACJ,CAAC;AACN,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,OAAyB;IACrD,MAAM,MAAM,GAAG,EAAC,GAAG,wBAAwB,EAAE,GAAG,OAAO,CAAC,MAAM,EAAC,CAAC;IAChE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IACpF,MAAM,IAAI,GAAG,KAAK,EAAE,OAAgB,EAAE,GAAW,EAAE,IAAY,EAAE,KAAgB,EAAE,EAAE;QACjF,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YAChD,OAAO;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,0DAA0D,EAAE,EAAC,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAC,CAAC,CAAC;QAC/I,CAAC;IACL,CAAC,CAAC;IACF,iHAAiH;IACjH,MAAM,YAAY,GAAG,KAAK,EAAE,OAAgB,EAAoB,EAAE;QAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACzD,OAAO,OAAO,CAAC,WAAW,IAAI,OAAO,IAAI,YAAY,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC;IAC7G,CAAC,CAAC;IACF,OAAO;QACH,YAAY;QACZ,mDAAmD;QACnD,mBAAmB,EAAE,WAAW,KAAK,IAAI;QACzC,2FAA2F;QAC3F,KAAK,CAAC,YAAY,CAAC,OAAgB;YAC/B,IAAI,WAAW,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,qBAAqB,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,IAAI,CAAC,OAAO,EAAE,kBAAkB,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE,EAAC,SAAS,EAAE,MAAM,CAAC,yBAAyB,EAAC,CAAC,CAAC;QAChH,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,kBAAkB,CAAC,OAAgB;YACrC,MAAM,IAAI,CAAC,OAAO,EAAE,yBAAyB,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE,EAAC,SAAS,EAAE,MAAM,CAAC,+BAA+B,EAAC,CAAC,CAAC;YACzH,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAChE,CAAC;QACL,CAAC;QACD,wGAAwG;QACxG,KAAK,CAAC,YAAY,CAAC,OAAgB;YAC/B,MAAM,IAAI,CAAC,OAAO,EAAE,kBAAkB,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE,EAAC,SAAS,EAAE,MAAM,CAAC,yBAAyB,EAAC,CAAC,CAAC;YAC5G,MAAM,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,EAAC,SAAS,EAAE,MAAM,CAAC,qBAAqB,EAAC,CAAC,CAAC;QACvF,CAAC;QACD,kGAAkG;QAClG,KAAK,CAAC,kBAAkB,CAAC,OAAgB;YACrC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChD,OAAO;YACX,CAAC;YACD,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE,EAAC,SAAS,EAAE,MAAM,CAAC,yBAAyB,EAAC,CAAC,CAAC;QACvH,CAAC;KACJ,CAAC;AACN,CAAC;AAID;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB,EAAE,MAAc;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,IAAI,IAAI,SAAS,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"admission.js","sourceRoot":"","sources":["../src/admission.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,mFAAmF;AACnF,8DAA8D;AAE9D,OAAO,EAAC,aAAa,EAAE,YAAY,EAAE,cAAc,EAAC,MAAM,qBAAqB,CAAC;AAIhF,sGAAsG;AACtG,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAE/D,MAAM,CAAC,MAAM,qBAAqB,GAAG,+EAA+E,CAAC;AAErH,gGAAgG;AAChG,MAAM,CAAC,MAAM,kBAAkB,GAAG,2CAA2C,CAAC;AAsB9E,MAAM,CAAC,MAAM,wBAAwB,GAAoB,EAAC,yBAAyB,EAAE,EAAE,EAAE,yBAAyB,EAAE,EAAE,EAAE,qBAAqB,EAAE,GAAG,EAAE,+BAA+B,EAAE,EAAE,EAAC,CAAC;AAuBzL,6GAA6G;AAC7G,MAAM,UAAU,iBAAiB,CAAC,EAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,KAA8B,EAAE;IAC/F,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,OAAO;QACH,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAC,SAAS,EAAC;YAC7B,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,SAAS,GAAG,MAAM,CAAC;YACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/G,IAAI,MAAM,GAAG,IAAI,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAC,MAAM,EAAE,SAAS,EAAE,EAAE,EAAC,CAAC,CAAC;gBAC1C,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,EAAC,CAAC;YACzE,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,EAAC,CAAC,CAAC;YACzD,IAAI,OAAO,CAAC,IAAI,GAAG,OAAO,EAAE,CAAC;gBACzB,8EAA8E;gBAC9E,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACnC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,IAAI,SAAS,EAAE,CAAC;wBAC/D,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBACzB,CAAC;gBACL,CAAC;YACL,CAAC;YACD,OAAO,EAAC,EAAE,EAAE,IAAI,EAAC,CAAC;QACtB,CAAC;KACJ,CAAC;AACN,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,OAAyB;IACrD,MAAM,MAAM,GAAG,EAAC,GAAG,wBAAwB,EAAE,GAAG,OAAO,CAAC,MAAM,EAAC,CAAC;IAChE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,MAAM,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAC1C,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC,OAAgB,EAAE,OAAuB,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9K,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAE,OAAuB,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,SAAS,CAAC;IAC5G,MAAM,IAAI,GAAG,KAAK,EAAE,OAAgB,EAAE,OAAuB,EAAE,GAAW,EAAE,IAAY,EAAE,KAAgB,EAAE,EAAE;QAC1G,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YACzD,OAAO;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,0DAA0D,EAAE,EAAC,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAC,CAAC,CAAC;QAC/I,CAAC;IACL,CAAC,CAAC;IACF,iHAAiH;IACjH,MAAM,YAAY,GAAG,KAAK,EAAE,OAAgB,EAAoB,EAAE;QAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACzD,OAAO,OAAO,CAAC,WAAW,IAAI,OAAO,IAAI,YAAY,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC;IAC7G,CAAC,CAAC;IACF,OAAO;QACH,YAAY;QACZ,mDAAmD;QACnD,mBAAmB,EAAE,WAAW,KAAK,IAAI;QACzC,2FAA2F;QAC3F,KAAK,CAAC,YAAY,CAAC,OAAgB,EAAE,UAA0B,EAAE;YAC7D,IAAI,WAAW,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,qBAAqB,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,kBAAkB,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE,EAAC,SAAS,EAAE,MAAM,CAAC,yBAAyB,EAAC,CAAC,CAAC;QAClI,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,kBAAkB,CAAC,OAAgB,EAAE,UAA0B,EAAE;YACnE,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,yBAAyB,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE,EAAC,SAAS,EAAE,MAAM,CAAC,+BAA+B,EAAC,CAAC,CAAC;YAC3I,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAChE,CAAC;QACL,CAAC;QACD,wGAAwG;QACxG,KAAK,CAAC,YAAY,CAAC,OAAgB,EAAE,UAA0B,EAAE;YAC7D,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,kBAAkB,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE,EAAC,SAAS,EAAE,MAAM,CAAC,yBAAyB,EAAC,CAAC,CAAC;YAC9H,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,EAAC,SAAS,EAAE,MAAM,CAAC,qBAAqB,EAAC,CAAC,CAAC;QAChG,CAAC;QACD,kGAAkG;QAClG,KAAK,CAAC,kBAAkB,CAAC,OAAgB,EAAE,UAA0B,EAAE;YACnE,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;gBACzD,OAAO;YACX,CAAC;YACD,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE,EAAC,SAAS,EAAE,MAAM,CAAC,yBAAyB,EAAC,CAAC,CAAC;QAChI,CAAC;KACJ,CAAC;AACN,CAAC;AAID;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB,EAAE,MAAc;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,IAAI,IAAI,SAAS,CAAC;AAC7B,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,6 @@
 export * from './admission.js';
+export * from './ports.js';
+export * from './relay.js';
 export * from './router.js';
 export * from './service.js';
 export * from './stable-json.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAE7B,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAE7B,cAAc,uBAAuB,CAAC"}

package/dist/index.js

@@ -1,4 +1,6 @@
 export * from './admission.js';
+export * from './ports.js';
+export * from './relay.js';
 export * from './router.js';
 export * from './service.js';
 export * from './stable-json.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAE7B,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAE7B,cAAc,uBAAuB,CAAC"}

package/dist/ports.d.ts

@@ -0,0 +1,34 @@
+/** What the transport knows about a request and no header can claim. */
+export type RequestContext = {
+    /** The address of the connection the request arrived on; absent when the platform cannot see it. */
+    peerAddress?: string;
+};
+/**
+ * Runs a room's work in order. `write` is false for a request that changes nothing, which may
+ * start once the writes queued before it are done but does not hold up the ones after it.
+ */
+export interface RoomExecutor {
+    run<T>(roomId: string | null, write: boolean, action: () => Promise<T>): Promise<T>;
+    /** Resolves once every write already queued has finished. */
+    idle(): Promise<void>;
+}
+/** Wakes the kernel's `tick` at a time; `null` cancels the wake-up. A later call replaces an earlier one. */
+export interface Scheduler {
+    plan(at: number | null): void;
+}
+/** Runs everything as it comes, for a platform that already orders a room's work, such as a Durable Object. */
+export declare function directExecutor(): RoomExecutor;
+/**
+ * One queue for every room, for a relay with one process over one store: two writes never
+ * interleave, so two cannot both choose the same next event sequence.
+ */
+export declare function queueExecutor(): RoomExecutor;
+type TimerSchedulerOptions = {
+    now?: () => number;
+};
+/** A `setTimeout` per wake-up that never keeps the process alive; `stop` cancels it for good. */
+export declare function timerScheduler(wake: () => void, { now }?: TimerSchedulerOptions): Scheduler & {
+    stop(): void;
+};
+export {};
+//# sourceMappingURL=ports.d.ts.map

package/dist/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../src/ports.ts"],"names":[],"mappings":"AAIA,wEAAwE;AACxE,MAAM,MAAM,cAAc,GAAG;IACzB,oGAAoG;IACpG,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,YAAY;IACzB,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpF,6DAA6D;IAC7D,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED,6GAA6G;AAC7G,MAAM,WAAW,SAAS;IACtB,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;CACjC;AAED,+GAA+G;AAC/G,wBAAgB,cAAc,IAAI,YAAY,CAK7C;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,YAAY,CAY5C;AAED,KAAK,qBAAqB,GAAG;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAC,CAAC;AAElD,iGAAiG;AACjG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,EAAC,GAAc,EAAC,GAAE,qBAA0B,GAAG,SAAS,GAAG;IAAC,IAAI,IAAI,IAAI,CAAA;CAAC,CAkBzH"}

package/dist/ports.js

@@ -0,0 +1,48 @@
+//! What a relay's platform supplies to the shared kernel (`relay.ts`): how room work is
+//! ordered, when the kernel is woken again, and what the transport saw of the caller.
+//! Each platform implements these once; no protocol rule lives on that side.
+/** Runs everything as it comes, for a platform that already orders a room's work, such as a Durable Object. */
+export function directExecutor() {
+    return {
+        run: (_roomId, _write, action) => action(),
+        idle: () => Promise.resolve()
+    };
+}
+/**
+ * One queue for every room, for a relay with one process over one store: two writes never
+ * interleave, so two cannot both choose the same next event sequence.
+ */
+export function queueExecutor() {
+    let writes = Promise.resolve();
+    return {
+        run(_roomId, write, action) {
+            const result = writes.then(action);
+            if (write) {
+                writes = result.catch(() => { });
+            }
+            return result;
+        },
+        idle: () => writes.then(() => { })
+    };
+}
+/** A `setTimeout` per wake-up that never keeps the process alive; `stop` cancels it for good. */
+export function timerScheduler(wake, { now = Date.now } = {}) {
+    let timer;
+    let stopped = false;
+    return {
+        plan(at) {
+            clearTimeout(timer);
+            timer = undefined;
+            if (stopped || at === null) {
+                return;
+            }
+            timer = setTimeout(wake, Math.min(Math.max(0, at - now()), 2 ** 31 - 1));
+            timer.unref?.();
+        },
+        stop() {
+            stopped = true;
+            clearTimeout(timer);
+        }
+    };
+}
+//# sourceMappingURL=ports.js.map

package/dist/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../src/ports.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,sFAAsF;AACtF,6EAA6E;AAuB7E,+GAA+G;AAC/G,MAAM,UAAU,cAAc;IAC1B,OAAO;QACH,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE;QAC1C,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE;KAChC,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa;IACzB,IAAI,MAAM,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IACjD,OAAO;QACH,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM;YACtB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,KAAK,EAAE,CAAC;gBACR,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACpC,CAAC;YACD,OAAO,MAAM,CAAC;QAClB,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;KACpC,CAAC;AACN,CAAC;AAID,iGAAiG;AACjG,MAAM,UAAU,cAAc,CAAC,IAAgB,EAAE,EAAC,GAAG,GAAG,IAAI,CAAC,GAAG,KAA2B,EAAE;IACzF,IAAI,KAAgD,CAAC;IACrD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,OAAO;QACH,IAAI,CAAC,EAAE;YACH,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,KAAK,GAAG,SAAS,CAAC;YAClB,IAAI,OAAO,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBACzB,OAAO;YACX,CAAC;YACD,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;YACxE,KAA8B,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9C,CAAC;QACD,IAAI;YACA,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;KACJ,CAAC;AACN,CAAC"}

package/dist/relay.d.ts

@@ -0,0 +1,128 @@
+import type { LiveTransport, LocalRoom, RelayLimits, ServerDescription } from '@pairlobby/protocol';
+import type { Admission } from './admission.js';
+import type { ChangeNotifier } from './changes.js';
+import type { RequestContext, RoomExecutor, Scheduler } from './ports.js';
+import type { RoomService } from './service.js';
+export interface RelayOptions {
+    service: RoomService;
+    /** Orders each room's work; defaults to running it as it comes, for a platform that orders it already. */
+    executor?: RoomExecutor;
+    /** Wakes `tick` for the next auto-close. Absent means the platform runs `tick` itself, such as from a Durable Object alarm. */
+    scheduler?: Scheduler;
+    /**
+     * The room an invite code's digest belongs to, which `edge` needs before any room sees the code.
+     * Defaults to the service's own store; a relay with one store per room passes its directory.
+     */
+    inviteRoom?: (digest: string) => Promise<string | null>;
+    /**
+     * True when the relay sits behind a proxy or a public address. Every caller then arrives from
+     * the proxy, so no connection proves a caller is local, and joining by name is refused.
+     */
+    behindProxy?: boolean;
+    /**
+     * Exact origins a browser may call from. A CLI sends no `Origin`, so an
+     * unexpected one means a web page is talking to us — including a malicious
+     * page reaching for loopback.
+     */
+    allowedOrigins?: string[];
+    /** `Host` values to accept, defeating DNS rebinding against a local server. */
+    allowedHosts?: string[] | ((host: string) => boolean);
+    /** What only the adapter knows for `GET /v1/server`: its share addresses and its build. Every relay answers the path. */
+    serverInfo?: () => ServerInfo;
+    /**
+     * Wakes held reads. Present means the relay offers long-poll: `GET .../events?wait=` waits for a change
+     * instead of answering empty. Only a relay whose writes all pass through one process can offer it.
+     */
+    changes?: ChangeNotifier;
+    /**
+     * How clients hear about new events, when the relay knows. Defaults to `long-poll` with `changes` and is
+     * otherwise left out, so a client keeps its own rule; a relay with a socket hub says `websocket`.
+     */
+    transport?: LiveTransport;
+    /** Features beyond those the router can see for itself. */
+    features?: string[];
+    /**
+     * Answers `GET /v1/invites/probe?prefix=`: whether any invite this server issued
+     * has a digest starting with that prefix. Lets a client on the same network find
+     * the relay behind a bare code; absent means the path is unknown.
+     */
+    inviteProbe?: (prefix: string) => Promise<boolean>;
+    /**
+     * Whether this request came from the relay's own device, its local network or its
+     * tailnet. Only a transport that sees the connection's real address can say; absent
+     * means never, so joining by name is refused.
+     */
+    peerIsLocal?: (request: Request, context: RequestContext) => boolean;
+    /** Open rooms that allow local joins, matching a name or all of them; answers `GET /v1/rooms/local[?name=]`. */
+    localRooms?: (name?: string) => Promise<LocalRoom[]>;
+    /** The create token and rate limits; absent means anyone who reaches the relay may create rooms and try codes freely. */
+    admission?: Admission;
+    /** Answers `GET /.well-known/pairlobby.json`, which tells `pairlobby setup` who this relay is and how to log in. */
+    discovery?: () => DiscoveryDocument;
+    /**
+     * Token-mode login: answers `GET /api/online/account` for a caller holding the team
+     * token (the create token). Absent means the path is unknown. Needs `admission`.
+     */
+    accountCheck?: (request: Request) => TeamAccount;
+}
+/** Where `edge` sends a request that needs a room: the room's id, and the request to run there. */
+export type RoomRoute = {
+    roomId: string;
+    request: Request;
+};
+export interface Relay {
+    /** Both halves in one process. */
+    handle(request: Request, context?: RequestContext): Promise<Response>;
+    /** Admission and every route that needs no room. A request reaching `inRoom` must have come through here. */
+    edge(request: Request, context?: RequestContext): Promise<Response | RoomRoute>;
+    /** A request `edge` sent to `roomId`, run in that room's order. */
+    inRoom(request: Request, roomId: string, context?: RequestContext): Promise<Response>;
+    /** Closes rooms whose auto-close time has passed, then plans the next wake-up. */
+    tick(kind: 'auto-close'): Promise<void>;
+}
+/** What a deployment says about itself to `pairlobby setup`. */
+export interface DiscoveryDocument {
+    version: 1;
+    name?: string;
+    login: {
+        mode: 'token' | 'none';
+        tokenHelp?: string;
+        verify?: string;
+    };
+    relays: string[];
+    features: string[];
+    support?: string;
+}
+/** The account a team token stands for: no person, just where its rooms go. */
+export interface TeamAccount {
+    email: null;
+    userId: 'team';
+    name: string | null;
+    server: string;
+    handle: null;
+}
+export interface ServerInfo {
+    /** Addresses other devices can use to reach this server; empty when it only listens on this device. */
+    shareUrls: string[];
+    /** True when a device on the same network or tailnet can find this server from an invite code alone. */
+    discoverable?: boolean;
+    /** The relay's own version, so a client can tell when it runs an older build than the CLI. */
+    version?: string;
+}
+export declare function createRelay(options: RelayOptions): Relay;
+/** The relay's own account of itself, from what this router was given: nothing is claimed that it was not. */
+export declare function describe(options: RelayOptions): ServerDescription;
+export type RelayDescriptionInput = {
+    limits: RelayLimits;
+    features: string[];
+    transport?: LiveTransport;
+    info?: ServerInfo;
+};
+/**
+ * `GET /v1/server` for any relay, including one that answers it outside this router, such as
+ * a Worker in front of Durable Objects. Every relay speaking this protocol has message stages.
+ */
+export declare function describeRelay({ limits, features, transport, info }: RelayDescriptionInput): ServerDescription;
+/** Refuses a request declaring another protocol version, before anything else looks at it. Null when it may go on. */
+export declare function protocolVersionRefusal(request: Request): Response | null;
+//# sourceMappingURL=relay.d.ts.map

package/dist/relay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay.d.ts","sourceRoot":"","sources":["../src/relay.ts"],"names":[],"mappings":"AA6CA,OAAO,KAAK,EAAY,aAAa,EAAE,SAAS,EAAgB,WAAW,EAAE,iBAAiB,EAAC,MAAM,qBAAqB,CAAC;AAE3H,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,cAAc,CAAC;AAEjD,OAAO,KAAK,EAAC,cAAc,EAAE,YAAY,EAAE,SAAS,EAAC,MAAM,YAAY,CAAC;AACxE,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,cAAc,CAAC;AAE9C,MAAM,WAAW,YAAY;IACzB,OAAO,EAAE,WAAW,CAAC;IACrB,0GAA0G;IAC1G,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,+HAA+H;IAC/H,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxD;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC;IACtD,yHAAyH;IACzH,UAAU,CAAC,EAAE,MAAM,UAAU,CAAC;IAC9B;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC;IACrE,gHAAgH;IAChH,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACrD,yHAAyH;IACzH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,oHAAoH;IACpH,SAAS,CAAC,EAAE,MAAM,iBAAiB,CAAC;IACpC;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,WAAW,CAAC;CACpD;AAED,mGAAmG;AACnG,MAAM,MAAM,SAAS,GAAG;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAC,CAAC;AAE3D,MAAM,WAAW,KAAK;IAClB,kCAAkC;IAClC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtE,6GAA6G;IAC7G,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAChF,mEAAmE;IACnE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtF,kFAAkF;IAClF,IAAI,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAED,gEAAgE;AAChE,MAAM,WAAW,iBAAiB;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE;QAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC;IACrE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IACxB,KAAK,EAAE,IAAI,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACvB,uGAAuG;IACvG,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,wGAAwG;IACxG,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAID,wBAAgB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,KAAK,CAsDxD;AA2GD,8GAA8G;AAC9G,wBAAgB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,iBAAiB,CAYjE;AAED,MAAM,MAAM,qBAAqB,GAAG;IAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IAAC,IAAI,CAAC,EAAE,UAAU,CAAA;CAAC,CAAC;AAE5H;;;GAGG;AACH,wBAAgB,aAAa,CAAC,EAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAC,EAAE,qBAAqB,GAAG,iBAAiB,CAQ3G;AA4OD,sHAAsH;AACtH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAGxE"}