@playcraft/cli 0.1.52 → 0.1.53-beta

package/dist/workspace-runtime/server/connectivity.js

@@ -0,0 +1,211 @@
+import { randomUUID } from 'node:crypto';
+import { z } from 'zod';
+import { PLATFORM_ROUTES, modelConnectivityPath, platformEndpoint, } from '@playcraft/common/cloud-workspace/runtime';
+const PROBE_TIMEOUT_MS = 4_000;
+// Issuance performs current authority reads and signing, rather than an endpoint echo.
+const CREDENTIAL_TIMEOUT_MS = 10_000;
+const CACHE_MS = 15_000;
+const CREDENTIAL_RENEW_BEFORE_MS = 30_000;
+const MAX_RESPONSE_BYTES = 16 * 1024;
+const credentialSchema = z.object({
+    token: z.string().min(1), expiresAt: z.string().datetime(),
+    configId: z.string().uuid(), model: z.string().min(1).max(128),
+    claims: z.object({
+        environment: z.string(), userId: z.string(), workspaceId: z.string(), runtimeId: z.string(),
+        generation: z.number().int(), runtimeEpoch: z.number().int(),
+    }),
+});
+const caches = new WeakMap();
+const ready = () => ({ status: 'ready' });
+const unavailable = (reason) => ({ status: 'unavailable', reason });
+function snapshot(state, workspaceId) {
+    let nativeReady = false;
+    try {
+        nativeReady = Boolean(state.native?.ready());
+    }
+    catch { /* A failed adapter stays unavailable. */ }
+    const { publicBaseUrl, controlToken, environment, userId, runtimeId, generation } = state.config;
+    return { publicBaseUrl, controlToken, environment, userId, runtimeId, generation,
+        runtimeEpoch: state.runtimeEpoch, workspaceId, nativeReady, destroyed: state.journal.destroyed(),
+        registered: state.config.workspaceMode !== 'multi' || Boolean(state.journal.getWorkspace(workspaceId)) };
+}
+function safeEndpoint(value) {
+    const url = new URL(value);
+    if (url.username || url.password || url.search || url.hash || /[%\\]/.test(url.pathname)
+        || (url.protocol !== 'https:' && !(url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)))) {
+        throw new Error('insecure_endpoint');
+    }
+    return url;
+}
+async function responseJson(response) {
+    const reader = response.body?.getReader();
+    if (!reader)
+        throw new Error('invalid_probe_response');
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const item = await reader.read();
+            if (item.done)
+                break;
+            size += item.value.byteLength;
+            if (size > MAX_RESPONSE_BYTES)
+                throw new Error('invalid_probe_response');
+            chunks.push(item.value);
+        }
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+        reader.releaseLock();
+    }
+}
+async function requestProbe(target, init, options = {}) {
+    const { credentials = false, serverFailureReason = 'endpoint_unreachable' } = options;
+    const signal = AbortSignal.timeout(credentials ? CREDENTIAL_TIMEOUT_MS : PROBE_TIMEOUT_MS);
+    try {
+        const response = await fetch(target, { ...init, redirect: 'error', signal });
+        if (!response.ok) {
+            const offline = response.headers.has('ngrok-error-code');
+            const rejected = response.status === 401 || response.status === 403;
+            let reason = rejected ? 'endpoint_rejected' : offline ? 'endpoint_offline'
+                : response.status >= 500 ? serverFailureReason : 'endpoint_unreachable';
+            if (credentials && !offline && !rejected) {
+                const body = await responseJson(response).catch(() => undefined);
+                if (signal.aborted)
+                    return { state: unavailable('endpoint_timeout') };
+                if (body && typeof body === 'object' && 'reason' in body && body.reason === 'model_config_required')
+                    reason = 'model_config_required';
+            }
+            else
+                await response.body?.cancel().catch(() => undefined);
+            return { state: unavailable(reason) };
+        }
+        let body;
+        try {
+            body = await responseJson(response);
+        }
+        catch {
+            return { state: unavailable(signal.aborted ? 'endpoint_timeout' : 'invalid_probe_response') };
+        }
+        return { state: ready(), body };
+    }
+    catch {
+        return { state: unavailable(signal.aborted ? 'endpoint_timeout' : 'endpoint_unreachable') };
+    }
+}
+function echoMatches(body, expected) {
+    return Boolean(body && typeof body === 'object' && !Array.isArray(body)
+        && Object.entries(expected).every(([key, value]) => body[key] === value));
+}
+function scope(config) {
+    return { runtimeId: config.runtimeId, environment: config.environment, workspaceId: config.workspaceId,
+        generation: config.generation, runtimeEpoch: config.runtimeEpoch };
+}
+function entrance(config, route) {
+    return safeEndpoint(platformEndpoint(config.publicBaseUrl, route));
+}
+async function callbackProbe(config) {
+    if (!config.publicBaseUrl)
+        return unavailable('endpoint_not_configured');
+    let endpoint;
+    try {
+        endpoint = entrance(config, PLATFORM_ROUTES.eventsProbe);
+    }
+    catch {
+        return unavailable('insecure_endpoint');
+    }
+    const nonce = randomUUID();
+    const response = await requestProbe(endpoint, {
+        method: 'POST', headers: { authorization: `Bearer ${config.controlToken}`, 'content-type': 'application/json', 'playcraft-env': config.environment },
+        body: JSON.stringify({ runtimeId: config.runtimeId, generation: config.generation,
+            runtimeEpoch: config.runtimeEpoch, workspaceId: config.workspaceId, nonce }),
+    });
+    if (response.state.status !== 'ready')
+        return response.state;
+    return echoMatches(response.body, { service: 'playcraft-runtime', ...scope(config), nonce }) ? ready() : unavailable('invalid_probe_response');
+}
+async function modelProxyProbe(config, entry) {
+    if (!config.publicBaseUrl)
+        return unavailable('endpoint_not_configured');
+    let credentialEndpoint;
+    try {
+        credentialEndpoint = entrance(config, PLATFORM_ROUTES.modelCredentials);
+        entrance(config, PLATFORM_ROUTES.modelProxy);
+    }
+    catch {
+        return unavailable('insecure_endpoint');
+    }
+    if (entry.credential && Date.parse(entry.credential.expiresAt) <= Date.now() + CREDENTIAL_RENEW_BEFORE_MS)
+        entry.credential = undefined;
+    const reusedCredential = Boolean(entry.credential);
+    if (!entry.credential) {
+        const response = await requestProbe(credentialEndpoint, {
+            method: 'POST', headers: { authorization: `Bearer ${config.controlToken}`, 'content-type': 'application/json', 'playcraft-env': config.environment },
+            body: JSON.stringify({ runtimeId: config.runtimeId, generation: config.generation, runtimeEpoch: config.runtimeEpoch, workspaceId: config.workspaceId }),
+        }, { credentials: true, serverFailureReason: 'model_credential_unavailable' });
+        if (response.state.status !== 'ready')
+            return response.state;
+        const parsed = credentialSchema.safeParse(response.body);
+        if (!parsed.success || !echoMatches(parsed.data.claims, { ...scope(config), userId: config.userId })
+            || Date.parse(parsed.data.expiresAt) <= Date.now() + 1_000)
+            return unavailable('invalid_probe_response');
+        entry.credential = parsed.data;
+    }
+    const credential = entry.credential;
+    const nonce = randomUUID();
+    const target = new URL(platformEndpoint(config.publicBaseUrl, modelConnectivityPath(credential.configId)));
+    target.searchParams.set('nonce', nonce);
+    const result = await requestProbe(target, { method: 'GET', headers: { authorization: `Bearer ${credential.token}`, 'playcraft-env': config.environment } }, { serverFailureReason: 'model_proxy_unavailable' });
+    if (result.state.reason === 'endpoint_rejected') {
+        entry.credential = undefined;
+        // A restore can invalidate an otherwise unexpired credential. Reissue once for this
+        // read-only echo; a fresh refusal remains a refusal. Model turns are never replayed here.
+        if (reusedCredential)
+            return modelProxyProbe(config, entry);
+    }
+    if (result.state.status !== 'ready')
+        return result.state;
+    return echoMatches(result.body, { service: 'playcraft-model-proxy', ...scope(config), configId: credential.configId, nonce })
+        ? ready() : unavailable('invalid_probe_response');
+}
+async function probe(config, entry) {
+    if (config.destroyed || !config.registered) {
+        const state = unavailable(config.destroyed ? 'runtime_destroyed' : 'workspace_not_registered');
+        return { ...scope(config), checkedAt: new Date().toISOString(), callback: state, modelProxy: state, conversation: state };
+    }
+    const [callback, modelProxy] = await Promise.all([callbackProbe(config), modelProxyProbe(config, entry)]);
+    const conversation = !config.nativeReady ? unavailable('adapter_not_started')
+        : callback.status !== 'ready' ? unavailable('callback_unavailable')
+            : modelProxy.status !== 'ready' ? unavailable('model_proxy_unavailable') : ready();
+    return { ...scope(config), checkedAt: new Date().toISOString(), callback, modelProxy, conversation };
+}
+/** Check the configured services without starting a thread or generating a model response. */
+export function probeRuntimeConnectivity(state, workspaceId) {
+    const config = snapshot(state, workspaceId);
+    const key = JSON.stringify(config);
+    let cache = caches.get(state);
+    if (!cache) {
+        cache = new Map();
+        caches.set(state, cache);
+    }
+    const previous = cache.get(workspaceId);
+    if (previous?.key === key) {
+        if (previous.pending)
+            return previous.pending;
+        if (previous.value && previous.expiresAt > Date.now())
+            return Promise.resolve(previous.value);
+    }
+    const entry = previous?.key === key ? previous : { key, expiresAt: 0 };
+    cache.set(workspaceId, entry);
+    if (cache.size > 256)
+        cache.delete(cache.keys().next().value);
+    entry.pending = probe(config, entry).then((value) => {
+        if (JSON.stringify(snapshot(state, workspaceId)) !== key)
+            return probeRuntimeConnectivity(state, workspaceId);
+        entry.value = value;
+        entry.expiresAt = Date.now() + CACHE_MS;
+        return value;
+    }).finally(() => { entry.pending = undefined; });
+    return entry.pending;
+}

package/dist/workspace-runtime/server/desktop-host.js

@@ -0,0 +1,429 @@
+import { connect as connectTcp } from 'node:net';
+import { WebSocket, WebSocketServer } from 'ws';
+import { desktopHealthSchema, desktopResourceName, runtimeError, } from '@playcraft/common/cloud-workspace/runtime';
+import { controlTokenMatches, extractControlToken } from './auth.js';
+import { createRfbWatchGate } from './rfb-watch-gate.js';
+import { DesktopPreviewError, DesktopPreviewHost } from './desktop-preview.js';
+import { WorkspaceContextError } from '../workspaces/context-error.js';
+/**
+ * A takeover holds the desktop for this long, whether or not a page is watching, and ends on its
+ * own unless the user renews it.
+ */
+const HOLD_MS = 20 * 60_000;
+const sources = new WeakMap();
+const hosts = new WeakMap();
+export function setDesktopSource(state, source) {
+    if (source)
+        sources.set(state, source);
+    else
+        sources.delete(state);
+    hosts.get(state)?.replaceSource(source);
+}
+export function desktopHost(state) {
+    let host = hosts.get(state);
+    if (!host) {
+        host = new DesktopHost(state);
+        hosts.set(state, host);
+    }
+    return host;
+}
+export async function disposeDesktopHost(state) {
+    const host = hosts.get(state);
+    hosts.delete(state);
+    sources.delete(state);
+    await host?.dispose();
+}
+export class DesktopHost {
+    state;
+    generation = 0;
+    holder = 'none';
+    probed = 'display_not_started';
+    viewers = new Set();
+    sockets = new WebSocketServer({ noServer: true });
+    source;
+    upstream = loopbackUpstream(process.env.PLAYCRAFT_DESKTOP_UPSTREAM);
+    holdMs = holdDuration(process.env.PLAYCRAFT_DESKTOP_HOLD_MS);
+    holdExpiresAt;
+    holdTimer;
+    preview;
+    disposed = false;
+    constructor(state) {
+        this.state = state;
+        this.source = sources.get(state);
+    }
+    replaceSource(source) {
+        this.source = source;
+    }
+    snapshot() {
+        return desktopHealthSchema.parse({
+            status: this.currentStatus(),
+            streamGeneration: this.generation,
+            holder: this.holder,
+            agentInput: this.holder === 'human' ? 'revoked' : 'open',
+            ...(this.holder === 'human' && this.holdExpiresAt
+                ? { holdExpiresAt: new Date(this.holdExpiresAt).toISOString() }
+                : {}),
+        });
+    }
+    async refresh() {
+        if (!this.source && this.upstream) {
+            this.probed = (await probePort(this.upstream.port)) ? 'ready' : 'display_not_started';
+        }
+        return this.snapshot();
+    }
+    async handleHttp(request, response, url) {
+        if (this.disposed || this.state.journal.destroyed()) {
+            writeError(response, 'runtime_destroyed');
+            return;
+        }
+        if (request.method === 'GET' && url.pathname === '/runtime/desktop/health') {
+            writeJson(response, 200, await this.refresh());
+            return;
+        }
+        if (request.method === 'POST' && url.pathname === '/runtime/desktop/open') {
+            await this.refresh();
+            if (this.currentStatus() !== 'ready') {
+                writeError(response, this.currentStatus());
+                return;
+            }
+            if (this.holder === 'human') {
+                writeJson(response, 200, this.snapshot());
+                return;
+            }
+            try {
+                this.preview ??= new DesktopPreviewHost(this.state, {
+                    canNavigate: () => !this.disposed && !this.state.journal.destroyed() && this.holder !== 'human',
+                });
+                await this.preview.open(url.searchParams.get('workspaceId') ?? undefined, url.searchParams.get('directoryName') ?? 'basic');
+                if (this.disposed || this.state.journal.destroyed()) {
+                    writeError(response, 'runtime_destroyed');
+                    return;
+                }
+                const health = await this.refresh();
+                if (this.disposed || this.state.journal.destroyed()) {
+                    writeError(response, 'runtime_destroyed');
+                    return;
+                }
+                if (health.status !== 'ready') {
+                    writeError(response, health.status);
+                    return;
+                }
+                writeJson(response, 200, health);
+            }
+            catch (error) {
+                const reason = error instanceof DesktopPreviewError ? error.code
+                    : error instanceof WorkspaceContextError ? error.message : 'desktop_preview_start_failed';
+                writeError(response, reason);
+            }
+            return;
+        }
+        if (request.method === 'POST' && url.pathname === '/runtime/desktop/takeover') {
+            await this.refresh();
+            if (this.currentStatus() !== 'ready') {
+                writeError(response, this.currentStatus());
+                return;
+            }
+            this.holder = 'human';
+            this.cutViewers();
+            this.hold();
+            writeJson(response, 200, this.snapshot());
+            return;
+        }
+        if (request.method === 'POST' && url.pathname === '/runtime/desktop/renew') {
+            if (this.holder !== 'human') {
+                writeError(response, 'desktop_not_held');
+                return;
+            }
+            this.hold();
+            writeJson(response, 200, this.snapshot());
+            return;
+        }
+        if (request.method === 'DELETE' && url.pathname === '/runtime/desktop') {
+            this.release();
+            writeJson(response, 200, this.snapshot());
+            return;
+        }
+        if (request.method === 'GET' && url.pathname === '/runtime/desktop/connect') {
+            await this.refresh();
+            this.rejectPlainConnect(response, url);
+            return;
+        }
+        if (request.method === 'GET' && url.pathname.startsWith('/runtime/desktop/resources/')) {
+            await this.refresh();
+            await this.writeResource(response, url);
+            return;
+        }
+        writeJson(response, 404, { error: 'not_found' });
+    }
+    handleUpgrade(request, socket, head) {
+        const url = new URL(request.url ?? '/', 'http://127.0.0.1');
+        if (!controlTokenMatches(this.state.config.controlToken, extractControlToken(request.headers))) {
+            rejectUpgrade(socket, 401, runtimeError('unauthenticated', 'control_token_required'));
+            return;
+        }
+        if (this.disposed || this.state.journal.destroyed()) {
+            rejectUpgrade(socket, 409, runtimeError('capability_unavailable', 'runtime_destroyed'));
+            return;
+        }
+        if (this.currentStatus() !== 'ready') {
+            rejectUpgrade(socket, 409, runtimeError('capability_unavailable', this.currentStatus()));
+            return;
+        }
+        const generation = generationOf(url);
+        if (generation === undefined || generation !== this.generation) {
+            rejectUpgrade(socket, 409, runtimeError('capability_unavailable', 'desktop_stale'));
+            return;
+        }
+        this.sockets.handleUpgrade(request, socket, head, (ws) => this.attach(ws, generation));
+    }
+    async dispose() {
+        this.disposed = true;
+        this.release();
+        this.sockets.close();
+        await this.preview?.dispose();
+    }
+    release() {
+        this.clearHold();
+        this.holder = 'none';
+        this.cutViewers();
+    }
+    /** Starts or renews the hold; when it runs out the desktop is released as if by hand. */
+    hold() {
+        this.clearHold();
+        this.holdExpiresAt = Date.now() + this.holdMs;
+        this.holdTimer = setTimeout(() => {
+            this.holdTimer = undefined;
+            if (this.holder === 'human')
+                this.release();
+        }, this.holdMs);
+        this.holdTimer.unref?.();
+    }
+    clearHold() {
+        if (this.holdTimer)
+            clearTimeout(this.holdTimer);
+        this.holdTimer = undefined;
+        this.holdExpiresAt = undefined;
+    }
+    currentStatus() {
+        if (this.source)
+            return this.source.health().status;
+        if (this.upstream)
+            return this.probed;
+        return 'display_not_started';
+    }
+    cutViewers() {
+        this.generation += 1;
+        for (const viewer of this.viewers)
+            this.drop(viewer);
+        this.viewers.clear();
+    }
+    drop(viewer) {
+        viewer.detach();
+        viewer.upstream?.close();
+        if (viewer.ws.readyState === WebSocket.OPEN)
+            viewer.ws.close();
+    }
+    attach(ws, generation) {
+        const viewer = { generation, ws, detach: () => undefined };
+        const send = (chunk, binary = true) => {
+            if (this.generation !== generation || ws.readyState !== WebSocket.OPEN)
+                return;
+            ws.send(chunk, { binary });
+        };
+        if (this.source) {
+            viewer.detach = this.source.attach(generation, (chunk) => send(chunk));
+        }
+        else if (this.upstream) {
+            const upstream = new WebSocket(`ws://127.0.0.1:${this.upstream.port}/`);
+            const watch = createRfbWatchGate();
+            viewer.upstream = upstream;
+            viewer.detach = () => upstream.close();
+            upstream.on('error', () => {
+                if (!this.source && this.generation === generation)
+                    this.probed = 'display_unavailable';
+                if (ws.readyState === WebSocket.OPEN)
+                    ws.close(1011, 'desktop_unavailable');
+            });
+            upstream.on('message', (data, isBinary) => {
+                if (this.generation !== generation) {
+                    this.drop(viewer);
+                    return;
+                }
+                const chunk = Buffer.isBuffer(data) ? data : Buffer.from(data);
+                watch.observeServer(chunk);
+                if (watch.failed) {
+                    ws.close(1008, 'desktop_protocol_error');
+                    upstream.close();
+                    return;
+                }
+                send(chunk, isBinary);
+            });
+            upstream.on('close', () => {
+                if (ws.readyState === WebSocket.OPEN)
+                    ws.close();
+            });
+            ws.on('message', (data, isBinary) => {
+                if (this.generation !== generation)
+                    return;
+                const chunk = Buffer.isBuffer(data) ? data : Buffer.from(data);
+                if (viewer.upstream?.readyState !== WebSocket.OPEN)
+                    return;
+                const outgoing = watch.clientBytes(chunk, this.holder === 'human');
+                if (watch.failed) {
+                    ws.close(1008, 'desktop_protocol_error');
+                    upstream.close();
+                    return;
+                }
+                for (const message of outgoing) {
+                    viewer.upstream.send(message, { binary: isBinary });
+                }
+            });
+        }
+        this.viewers.add(viewer);
+        let closed = false;
+        const close = () => {
+            if (closed)
+                return;
+            closed = true;
+            this.viewers.delete(viewer);
+            viewer.detach();
+            viewer.upstream?.close();
+        };
+        ws.on('close', close);
+        ws.on('error', close);
+    }
+    rejectPlainConnect(response, url) {
+        if (this.currentStatus() !== 'ready') {
+            writeError(response, this.currentStatus());
+            return;
+        }
+        const generation = generationOf(url);
+        if (generation === undefined || generation !== this.generation) {
+            writeError(response, 'desktop_stale');
+            return;
+        }
+        writeError(response, 'websocket_required');
+    }
+    async writeResource(response, url) {
+        if (this.currentStatus() !== 'ready') {
+            writeError(response, this.currentStatus());
+            return;
+        }
+        const name = desktopResourceName(decodeURIComponent(url.pathname.slice('/runtime/desktop/resources/'.length)));
+        if (!name) {
+            writeJson(response, 400, { error: 'invalid_desktop_resource' });
+            return;
+        }
+        const generation = url.searchParams.get('generation');
+        const document = name === 'vnc.html' || name.endsWith('/vnc.html');
+        if (document && Number(generation) !== this.generation) {
+            writeError(response, 'desktop_stale');
+            return;
+        }
+        if (generation !== null && Number(generation) !== this.generation) {
+            writeError(response, 'desktop_stale');
+            return;
+        }
+        if (this.source) {
+            const file = this.source.readResource(name);
+            if (!file) {
+                writeJson(response, 404, { error: 'not_found' });
+                return;
+            }
+            writeBytes(response, 200, file.contentType, file.body);
+            return;
+        }
+        if (!this.upstream) {
+            writeError(response, 'display_not_started');
+            return;
+        }
+        const upstream = await fetch(`http://127.0.0.1:${this.upstream.port}/${name}`, {
+            redirect: 'error',
+            signal: AbortSignal.timeout(5_000),
+        }).catch(() => undefined);
+        if (!upstream) {
+            writeError(response, 'display_unavailable');
+            return;
+        }
+        const body = Buffer.from(await upstream.arrayBuffer());
+        if (!upstream.ok) {
+            writeBytes(response, upstream.status, upstream.headers.get('content-type') ?? 'application/octet-stream', body);
+            return;
+        }
+        writeBytes(response, 200, upstream.headers.get('content-type') ?? 'application/octet-stream', body);
+    }
+}
+export function desktopRoute(pathname) {
+    return (pathname === '/runtime/desktop/health' ||
+        pathname === '/runtime/desktop/open' ||
+        pathname === '/runtime/desktop/connect' ||
+        pathname === '/runtime/desktop/takeover' ||
+        pathname === '/runtime/desktop/renew' ||
+        pathname === '/runtime/desktop' ||
+        pathname.startsWith('/runtime/desktop/resources/'));
+}
+function generationOf(url) {
+    const value = url.searchParams.get('generation');
+    if (!value || !/^\d+$/.test(value))
+        return undefined;
+    return Number(value);
+}
+function loopbackUpstream(value) {
+    if (!value)
+        return undefined;
+    const match = /^(?:127\.0\.0\.1|localhost):(\d+)$/.exec(value.trim());
+    if (!match)
+        return undefined;
+    const port = Number(match[1]);
+    if (port < 1 || port > 65535)
+        return undefined;
+    return { port };
+}
+function holdDuration(value) {
+    const parsed = Number(value);
+    return Number.isInteger(parsed) && parsed > 0 ? parsed : HOLD_MS;
+}
+function probePort(port) {
+    return new Promise((resolve) => {
+        const socket = connectTcp({ host: '127.0.0.1', port });
+        const timer = setTimeout(() => {
+            socket.destroy();
+            resolve(false);
+        }, 200);
+        socket.once('connect', () => {
+            clearTimeout(timer);
+            socket.end();
+            resolve(true);
+        });
+        socket.once('error', () => {
+            clearTimeout(timer);
+            resolve(false);
+        });
+    });
+}
+function writeError(response, reason) {
+    writeJson(response, 409, runtimeError('capability_unavailable', reason));
+}
+function writeJson(response, status, body) {
+    const payload = JSON.stringify(body);
+    response.writeHead(status, {
+        'content-type': 'application/json; charset=utf-8',
+        'content-length': Buffer.byteLength(payload),
+        'cache-control': 'no-store',
+    });
+    response.end(payload);
+}
+function writeBytes(response, status, contentType, body) {
+    response.writeHead(status, {
+        'content-type': contentType,
+        'content-length': body.length,
+        'cache-control': 'no-store',
+    });
+    response.end(body);
+}
+function rejectUpgrade(socket, status, body) {
+    const payload = JSON.stringify(body);
+    const title = status === 401 ? 'Unauthorized' : 'Conflict';
+    socket.write(`HTTP/1.1 ${status} ${title}\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: ${Buffer.byteLength(payload)}\r\nconnection: close\r\n\r\n${payload}`);
+    socket.destroy();
+}