@rynx-ai/server 0.1.0 → 0.1.10-beta.2

package/dist/direct-runtime-browser-inspect-server.js

@@ -0,0 +1,749 @@
+import { decodeDirectRuntimeFrame, DIRECT_RUNTIME_BROWSER_INSPECT_BINDING_PROTOCOL, DIRECT_RUNTIME_BROWSER_INSPECT_PATH, DIRECT_RUNTIME_CLOSE_CODE, DIRECT_RUNTIME_MAX_HANDSHAKE_FRAME_BYTES, encodeDirectRuntimeFrame, parseServerAccepted, parseServerHello, } from "@rynx-ai/protocol/direct-runtime";
+import { encodeRuntimeBrowserInspectServerFrame, parseRuntimeBrowserInspectOpenFrame, RUNTIME_BROWSER_INSPECT_HEARTBEAT_INTERVAL_MS, RUNTIME_BROWSER_INSPECT_MAX_CONTROL_FRAME_BYTES, RUNTIME_BROWSER_INSPECT_MAX_MESSAGE_BYTES, RUNTIME_BROWSER_INSPECT_PEER_LIVENESS_TIMEOUT_MS, } from "@rynx-ai/protocol/runtime-browser-inspect";
+import { createServerE2EEChannel, DIRECT_RUNTIME_E2EE_MAX_ENVELOPE_BYTES, } from "@rynx-ai/remote-runtime-e2ee";
+import { WebSocket, WebSocketServer } from "ws";
+const CLOSE_BAD_PROTOCOL = DIRECT_RUNTIME_CLOSE_CODE.badProtocol;
+const CLOSE_UNAUTHORIZED = DIRECT_RUNTIME_CLOSE_CODE.unauthorized;
+const CLOSE_AUTH_TIMEOUT = DIRECT_RUNTIME_CLOSE_CODE.authenticationTimeout;
+const CLOSE_CAPACITY = DIRECT_RUNTIME_CLOSE_CODE.capacity;
+const CLOSE_INTERNAL = DIRECT_RUNTIME_CLOSE_CODE.internal;
+const DEFAULT_MAX_CONNECTIONS = 64;
+const DEFAULT_MAX_UNAUTHENTICATED_CONNECTIONS_PER_SOURCE = 4;
+const DEFAULT_MAX_AUTHENTICATION_ATTEMPTS_PER_SOURCE = 20;
+const DEFAULT_AUTHENTICATION_ATTEMPT_WINDOW_MS = 60_000;
+const DEFAULT_MAX_TRACKED_AUTHENTICATION_SOURCES = 1_024;
+const DEFAULT_MAX_CONNECTIONS_PER_GRANT = 8;
+const DEFAULT_MAX_QUEUED_BYTES = 32 * 1024 * 1024;
+const DEFAULT_MAX_BUFFERED_BYTES = 32 * 1024 * 1024;
+const DEFAULT_SHUTDOWN_DEADLINE_MS = 5_000;
+const CONNECTION_CLOSE_DEADLINE_MS = 1_000;
+export class DirectRuntimeBrowserInspectHostError extends Error {
+    reason;
+    constructor(reason, message, options) {
+        super(message, options);
+        this.reason = reason;
+        this.name = "DirectRuntimeBrowserInspectHostError";
+    }
+}
+/** Attach only the V5 dedicated Browser Inspect route to a Direct listener. */
+export function attachDirectRuntimeBrowserInspectServer(server, options) {
+    const limits = resolveLimits(options.limits);
+    const wss = new WebSocketServer({
+        noServer: true,
+        clientTracking: true,
+        perMessageDeflate: false,
+        maxPayload: Math.max(DIRECT_RUNTIME_E2EE_MAX_ENVELOPE_BYTES, RUNTIME_BROWSER_INSPECT_MAX_MESSAGE_BYTES),
+    });
+    const connections = new Set();
+    const pendingUpgradesBySource = new Map();
+    const unauthenticatedConnectionsBySource = new Map();
+    const authenticationAttempts = new SourceAuthenticationAttemptLimiter({
+        maxAttempts: limits.maxAuthenticationAttemptsPerSource,
+        windowMs: limits.authenticationAttemptWindowMs,
+        maxSources: limits.maxTrackedAuthenticationSources,
+    });
+    let pendingUpgrades = 0;
+    let stopping = false;
+    let heartbeatTimer;
+    let shutdownPromise;
+    const handleUpgrade = (request, socket, head) => {
+        if (request.url !== DIRECT_RUNTIME_BROWSER_INSPECT_PATH)
+            return;
+        const sourceAddress = socketSourceAddress(request);
+        if (stopping) {
+            rejectUpgrade(socket, 503, "Browser Inspect is stopping");
+            return;
+        }
+        if (connections.size + pendingUpgrades >= limits.maxConnections) {
+            rejectUpgrade(socket, 503, "Browser Inspect connection capacity reached");
+            return;
+        }
+        if ((unauthenticatedConnectionsBySource.get(sourceAddress) ?? 0) +
+            (pendingUpgradesBySource.get(sourceAddress) ?? 0) >=
+            limits.maxUnauthenticatedConnectionsPerSource) {
+            rejectUpgrade(socket, 503, "Browser Inspect authentication capacity reached");
+            return;
+        }
+        pendingUpgrades += 1;
+        incrementCount(pendingUpgradesBySource, sourceAddress);
+        let pending = true;
+        const releasePending = () => {
+            if (!pending)
+                return;
+            pending = false;
+            pendingUpgrades -= 1;
+            decrementCount(pendingUpgradesBySource, sourceAddress);
+        };
+        try {
+            wss.handleUpgrade(request, socket, head, (ws) => {
+                releasePending();
+                connections.add(acceptConnection(ws, sourceAddress));
+            });
+        }
+        catch (error) {
+            releasePending();
+            options.onError?.(error, "Browser Inspect websocket upgrade");
+            rejectUpgrade(socket, 400, "invalid Browser Inspect WebSocket upgrade");
+        }
+    };
+    server.on("upgrade", handleUpgrade);
+    function acceptConnection(ws, sourceAddress) {
+        const abortController = new AbortController();
+        let connection;
+        const authenticationTimer = setTimeout(() => {
+            abortController.abort(new Error("Browser Inspect authentication timed out"));
+            connection.close(CLOSE_AUTH_TIMEOUT, "Browser Inspect authentication timed out");
+        }, limits.authenticationTimeoutMs);
+        authenticationTimer.unref?.();
+        connection = {
+            ws,
+            sourceAddress,
+            countedAsUnauthenticated: true,
+            state: "awaiting_e2ee_hello",
+            attachmentClosed: false,
+            abortController,
+            authenticationTimer,
+            receiveTail: Promise.resolve(),
+            queuedBytes: 0,
+            authenticationFrameQueued: false,
+            lastInboundActivityAt: Date.now(),
+            close(code, reason) {
+                closeConnection(connection, code, reason);
+            },
+        };
+        incrementCount(unauthenticatedConnectionsBySource, sourceAddress);
+        ws.on("message", (data, isBinary) => {
+            connection.lastInboundActivityAt = Date.now();
+            if (isClosed(connection))
+                return;
+            // Stop reading more transport data while this ordered E2EE record is
+            // being opened and forwarded. Frames already decoded from the current
+            // TCP chunk may still arrive below and remain bounded by queuedBytes.
+            ws.pause();
+            if (connection.state !== "active" &&
+                connection.authenticationFrameQueued) {
+                connection.close(CLOSE_BAD_PROTOCOL, "Browser Inspect traffic must wait for the opening barrier");
+                return;
+            }
+            if (connection.state !== "active") {
+                connection.authenticationFrameQueued = true;
+            }
+            const wireBytes = rawDataBytes(data);
+            connection.queuedBytes += wireBytes.byteLength;
+            if (connection.queuedBytes > limits.maxQueuedBytes) {
+                connection.queuedBytes -= wireBytes.byteLength;
+                connection.close(CLOSE_CAPACITY, "Browser Inspect input queue is full");
+                return;
+            }
+            connection.receiveTail = connection.receiveTail
+                .then(() => handleFrame(connection, wireBytes, isBinary))
+                .catch((error) => {
+                if (isClosed(connection))
+                    return;
+                options.onError?.(error, "Browser Inspect frame");
+                connection.close(CLOSE_INTERNAL, "Browser Inspect frame handling failed");
+            })
+                .finally(() => {
+                connection.queuedBytes -= wireBytes.byteLength;
+                if (connection.queuedBytes === 0 &&
+                    !isClosed(connection) &&
+                    connection.ws.readyState === WebSocket.OPEN) {
+                    connection.ws.resume();
+                }
+            });
+        });
+        ws.on("ping", () => {
+            connection.lastInboundActivityAt = Date.now();
+        });
+        ws.on("pong", () => {
+            connection.lastInboundActivityAt = Date.now();
+        });
+        ws.on("close", () => void cleanupConnection(connection, "client_closed"));
+        ws.on("error", (error) => {
+            options.onError?.(error, "Browser Inspect socket");
+            void cleanupConnection(connection, "transport_error");
+        });
+        return connection;
+    }
+    async function handleFrame(connection, wireBytes, isBinary) {
+        if (isClosed(connection))
+            return;
+        if (connection.state === "awaiting_e2ee_hello") {
+            if (isBinary) {
+                connection.close(CLOSE_BAD_PROTOCOL, "Browser Inspect E2EE hello must be text");
+                return;
+            }
+            await establishE2EE(connection, wireBytes);
+            return;
+        }
+        if (connection.state === "awaiting_authentication") {
+            if (isBinary) {
+                connection.close(CLOSE_BAD_PROTOCOL, "Browser Inspect authentication must be text");
+                return;
+            }
+            await authenticateConnection(connection, wireBytes);
+            return;
+        }
+        if (connection.state === "authenticating" ||
+            connection.state === "opening") {
+            connection.close(CLOSE_BAD_PROTOCOL, "Browser Inspect opening is already in progress");
+            return;
+        }
+        if (connection.state === "awaiting_open") {
+            if (isBinary) {
+                connection.close(CLOSE_BAD_PROTOCOL, "Browser Inspect open frame must be text");
+                return;
+            }
+            await handleOpen(connection, {
+                binary: false,
+                data: decodeText(wireBytes),
+            });
+            return;
+        }
+        if (connection.state !== "active" ||
+            !connection.peer ||
+            !connection.attachment) {
+            connection.close(CLOSE_BAD_PROTOCOL, "Browser Inspect connection is not active");
+            return;
+        }
+        // The authenticated open barrier checks the persisted grant immediately
+        // before attaching. Active revocation is fenced synchronously by the
+        // shared connection hub, so raw CDP traffic must not hit the grant store
+        // (and SQLite) for every message.
+        try {
+            await connection.attachment.send(isBinary
+                ? { binary: true, data: new Uint8Array(wireBytes) }
+                : { binary: false, data: decodeText(wireBytes) });
+        }
+        catch (error) {
+            options.onError?.(error, "Browser Inspect local page input");
+            connection.close(CLOSE_INTERNAL, "Browser Inspect local page send failed");
+        }
+    }
+    async function establishE2EE(connection, bytes) {
+        if (bytes.byteLength > DIRECT_RUNTIME_MAX_HANDSHAKE_FRAME_BYTES) {
+            connection.close(CLOSE_BAD_PROTOCOL, "Browser Inspect E2EE hello is too large");
+            return;
+        }
+        try {
+            const frame = decodeDirectRuntimeFrame(bytes);
+            if (frame.type !== "e2ee.client-hello") {
+                throw new Error("first Browser Inspect frame must be e2ee.client-hello");
+            }
+            const input = {
+                sharedSecret: options.e2ee.deriveSharedSecret(frame.clientEphemeralPublicKey),
+                serverEncryptionPublicKey: options.e2ee.serverPublicKey,
+                clientHello: frame,
+            };
+            connection.authenticationChannel = createServerE2EEChannel(input);
+            await sendWire(connection, encodeDirectRuntimeFrame({ type: "e2ee.ready" }), false);
+            await initializeServerHello(connection);
+        }
+        catch {
+            connection.close(CLOSE_BAD_PROTOCOL, "invalid Browser Inspect E2EE client hello");
+        }
+    }
+    async function initializeServerHello(connection) {
+        try {
+            const channel = connection.authenticationChannel;
+            if (!channel) {
+                throw new Error("Browser Inspect authentication channel is unavailable");
+            }
+            const hello = parseServerHello(await options.authenticator.createServerHello({
+                channelBinding: channel.channelBinding,
+                role: "browser-inspect",
+                signal: connection.abortController.signal,
+            }));
+            if (hello.role !== "browser-inspect" ||
+                hello.bindingProtocolVersion !==
+                    DIRECT_RUNTIME_BROWSER_INSPECT_BINDING_PROTOCOL.currentVersion ||
+                hello.minimumCompatibleBindingVersion !==
+                    DIRECT_RUNTIME_BROWSER_INSPECT_BINDING_PROTOCOL.minimumCompatibleVersion) {
+                throw new Error("Browser Inspect authenticator returned an incompatible hello");
+            }
+            const encoded = encodeDirectRuntimeFrame(hello);
+            connection.serverHello = hello;
+            connection.serverHelloBytes = Uint8Array.from(Buffer.from(encoded, "utf8"));
+            connection.authenticationFrameQueued = false;
+            connection.state = "awaiting_authentication";
+            await sendAuthenticationText(connection, encoded);
+        }
+        catch (error) {
+            if (isClosed(connection))
+                return;
+            options.onError?.(error, "Browser Inspect server hello");
+            connection.close(CLOSE_INTERNAL, "Browser Inspect authentication setup failed");
+        }
+    }
+    async function authenticateConnection(connection, wireBytes) {
+        if (!authenticationAttempts.tryConsume(connection.sourceAddress)) {
+            connection.close(CLOSE_CAPACITY, "Browser Inspect authentication limit reached");
+            return;
+        }
+        const channel = connection.authenticationChannel;
+        const serverHello = connection.serverHello;
+        const serverHelloBytes = connection.serverHelloBytes;
+        if (!channel || !serverHello || !serverHelloBytes) {
+            connection.close(CLOSE_INTERNAL, "Browser Inspect server hello is unavailable");
+            return;
+        }
+        let plaintext;
+        let authenticate;
+        try {
+            if (wireBytes.byteLength > DIRECT_RUNTIME_E2EE_MAX_ENVELOPE_BYTES) {
+                throw new Error("Browser Inspect authentication envelope is too large");
+            }
+            plaintext = channel.open(decodeText(wireBytes));
+            const bytes = Uint8Array.from(Buffer.from(plaintext, "utf8"));
+            if (bytes.byteLength > DIRECT_RUNTIME_MAX_HANDSHAKE_FRAME_BYTES) {
+                throw new Error("Browser Inspect authentication frame is too large");
+            }
+            const frame = decodeDirectRuntimeFrame(bytes);
+            if (frame.type !== "client.authenticate" ||
+                frame.role !== "browser-inspect" ||
+                frame.mode !== "connect") {
+                throw new Error("Browser Inspect client role or mode is invalid");
+            }
+            authenticate = frame;
+        }
+        catch {
+            connection.close(CLOSE_BAD_PROTOCOL, "invalid Browser Inspect authentication frame");
+            return;
+        }
+        connection.state = "authenticating";
+        try {
+            const result = await options.authenticator.authenticate({
+                channelBinding: channel.channelBinding,
+                role: "browser-inspect",
+                serverHello,
+                serverHelloBytes: new Uint8Array(serverHelloBytes),
+                clientAuthenticate: authenticate,
+                clientAuthenticateBytes: Uint8Array.from(Buffer.from(plaintext, "utf8")),
+                signal: connection.abortController.signal,
+            });
+            if (connection.state !== "authenticating")
+                return;
+            const accepted = parseServerAccepted(result.accepted);
+            assertAuthenticationResult(serverHello, authenticate, result.peer, accepted);
+            const registration = options.connectionHub.registerWithinLimit(result.peer.grantId, connection, limits.maxConnectionsPerGrant);
+            if (registration === "revoked") {
+                connection.close(CLOSE_UNAUTHORIZED, "Remote Runtime grant is not active");
+                return;
+            }
+            if (registration === "capacity") {
+                connection.close(CLOSE_CAPACITY, "Remote Runtime grant connection capacity reached");
+                return;
+            }
+            await sendAuthenticationText(connection, encodeDirectRuntimeFrame(accepted));
+            connection.peer = result.peer;
+            connection.accepted = accepted;
+            connection.authenticationChannel = undefined;
+            connection.state = "awaiting_open";
+            connection.authenticationFrameQueued = false;
+            releaseUnauthenticated(connection);
+            clearTimeout(connection.authenticationTimer);
+        }
+        catch (error) {
+            if (isClosed(connection))
+                return;
+            options.onError?.(error, "Browser Inspect client authentication");
+            connection.close(CLOSE_UNAUTHORIZED, "Browser Inspect authentication failed");
+        }
+    }
+    async function handleOpen(connection, message) {
+        if (message.binary) {
+            connection.close(CLOSE_BAD_PROTOCOL, "Browser Inspect open frame must be text");
+            return;
+        }
+        if (Buffer.byteLength(message.data, "utf8") >
+            RUNTIME_BROWSER_INSPECT_MAX_CONTROL_FRAME_BYTES) {
+            connection.close(CLOSE_BAD_PROTOCOL, "Browser Inspect open frame is too large");
+            return;
+        }
+        let target;
+        try {
+            const open = parseRuntimeBrowserInspectOpenFrame(JSON.parse(message.data));
+            target = {
+                sessionId: open.sessionId,
+                browserGeneration: open.browserGeneration,
+                pageId: open.pageId,
+            };
+        }
+        catch {
+            connection.close(CLOSE_BAD_PROTOCOL, "invalid Browser Inspect open frame");
+            return;
+        }
+        connection.state = "opening";
+        try {
+            const peer = connection.peer;
+            if (!peer || !(await options.isPeerActive(peer))) {
+                throw new DirectRuntimeBrowserInspectHostError("unauthorized", "Remote Runtime grant is not active");
+            }
+            const attachment = await options.host.open(target, {
+                peer,
+                signal: connection.abortController.signal,
+            });
+            if (connection.state !== "opening") {
+                await attachment.close("transport_error");
+                return;
+            }
+            connection.attachment = attachment;
+            await sendInspect(connection, {
+                binary: false,
+                data: encodeRuntimeBrowserInspectServerFrame({
+                    type: "browser.inspect.ready",
+                }),
+            });
+            connection.state = "active";
+            connection.authenticationFrameQueued = false;
+            void pumpAttachment(connection, attachment);
+        }
+        catch (error) {
+            if (isClosed(connection))
+                return;
+            const reason = error instanceof DirectRuntimeBrowserInspectHostError
+                ? error.reason
+                : "internal_error";
+            const messageText = error instanceof Error
+                ? error.message
+                : "Browser Inspect target open failed";
+            await sendInspect(connection, {
+                binary: false,
+                data: encodeRuntimeBrowserInspectServerFrame({
+                    type: "browser.inspect.closed",
+                    reason,
+                    message: boundedMessage(messageText),
+                }),
+            }).catch(() => undefined);
+            connection.close(reason === "unauthorized"
+                ? CLOSE_UNAUTHORIZED
+                : reason === "capacity"
+                    ? CLOSE_CAPACITY
+                    : reason === "internal_error"
+                        ? CLOSE_INTERNAL
+                        : 1000, messageText);
+        }
+    }
+    async function pumpAttachment(connection, attachment) {
+        try {
+            for await (const message of attachment.messages) {
+                if (isClosed(connection) ||
+                    connection.attachment !== attachment) {
+                    return;
+                }
+                await sendInspect(connection, message);
+            }
+            if (!isClosed(connection)) {
+                connection.close(1000, "Browser Inspect page stream closed");
+            }
+        }
+        catch (error) {
+            if (isClosed(connection))
+                return;
+            options.onError?.(error, "Browser Inspect local page output");
+            connection.close(CLOSE_INTERNAL, "Browser Inspect page stream failed");
+        }
+    }
+    async function sendAuthenticationText(connection, plaintext) {
+        const channel = connection.authenticationChannel;
+        if (!channel) {
+            throw new Error("Browser Inspect authentication channel is unavailable");
+        }
+        await sendWire(connection, channel.seal(plaintext), false);
+    }
+    async function sendInspect(connection, message) {
+        await sendWire(connection, message.data, message.binary);
+    }
+    async function sendWire(connection, frame, binary) {
+        if (connection.ws.readyState !== WebSocket.OPEN) {
+            throw new Error("Browser Inspect WebSocket is not open");
+        }
+        const byteLength = typeof frame === "string"
+            ? Buffer.byteLength(frame, "utf8")
+            : frame.byteLength;
+        if (byteLength > limits.maxBufferedBytes ||
+            connection.ws.bufferedAmount + byteLength > limits.maxBufferedBytes) {
+            connection.close(CLOSE_CAPACITY, "Browser Inspect output buffer is full");
+            throw new Error("Browser Inspect output buffer is full");
+        }
+        await new Promise((resolve, reject) => {
+            connection.ws.send(frame, { binary, compress: false }, (error) => {
+                if (error)
+                    reject(error);
+                else
+                    resolve();
+            });
+        });
+    }
+    function closeConnection(connection, code, reason) {
+        if (isClosed(connection))
+            return;
+        const closeReason = code === CLOSE_UNAUTHORIZED
+            ? "grant_revoked"
+            : "transport_error";
+        connection.state = "closing";
+        connection.abortController.abort(new Error(reason));
+        if (connection.ws.readyState === WebSocket.OPEN) {
+            connection.ws.close(code, boundedCloseReason(reason));
+            connection.closeTimer = setTimeout(() => {
+                if (connection.ws.readyState !== WebSocket.CLOSED) {
+                    connection.ws.terminate();
+                }
+            }, CONNECTION_CLOSE_DEADLINE_MS);
+            connection.closeTimer.unref?.();
+        }
+        else if (connection.ws.readyState !== WebSocket.CLOSED) {
+            connection.ws.terminate();
+        }
+        void closeAttachment(connection, closeReason);
+    }
+    async function cleanupConnection(connection, reason) {
+        if (connection.state === "closed")
+            return;
+        connection.state = "closed";
+        clearTimeout(connection.authenticationTimer);
+        if (connection.closeTimer)
+            clearTimeout(connection.closeTimer);
+        connection.abortController.abort(new Error("Browser Inspect connection closed"));
+        releaseUnauthenticated(connection);
+        options.connectionHub.unregister(connection);
+        connections.delete(connection);
+        await closeAttachment(connection, reason);
+    }
+    async function closeAttachment(connection, reason) {
+        if (connection.attachmentClosed)
+            return;
+        connection.attachmentClosed = true;
+        try {
+            await connection.attachment?.close(reason);
+        }
+        catch (error) {
+            options.onError?.(error, "Browser Inspect attachment cleanup");
+        }
+    }
+    function releaseUnauthenticated(connection) {
+        if (!connection.countedAsUnauthenticated)
+            return;
+        connection.countedAsUnauthenticated = false;
+        decrementCount(unauthenticatedConnectionsBySource, connection.sourceAddress);
+    }
+    heartbeatTimer = setInterval(() => {
+        const now = Date.now();
+        for (const connection of connections) {
+            if (connection.ws.readyState !== WebSocket.OPEN)
+                continue;
+            if (now - connection.lastInboundActivityAt >
+                limits.peerLivenessTimeoutMs) {
+                connection.ws.terminate();
+                continue;
+            }
+            try {
+                connection.ws.ping();
+            }
+            catch {
+                connection.ws.terminate();
+            }
+        }
+    }, limits.heartbeatIntervalMs);
+    heartbeatTimer.unref?.();
+    return {
+        path: DIRECT_RUNTIME_BROWSER_INSPECT_PATH,
+        get activeConnectionCount() {
+            return connections.size;
+        },
+        shutdown() {
+            if (shutdownPromise)
+                return shutdownPromise;
+            shutdownPromise = (async () => {
+                stopping = true;
+                server.removeListener("upgrade", handleUpgrade);
+                if (heartbeatTimer)
+                    clearInterval(heartbeatTimer);
+                heartbeatTimer = undefined;
+                for (const connection of [...connections]) {
+                    connection.state = "closing";
+                    connection.abortController.abort(new Error("Browser Inspect server is shutting down"));
+                    void closeAttachment(connection, "server_shutdown");
+                    if (connection.ws.readyState === WebSocket.OPEN) {
+                        connection.ws.close(1001, "Browser Inspect server is shutting down");
+                    }
+                    else if (connection.ws.readyState !== WebSocket.CLOSED) {
+                        connection.ws.terminate();
+                    }
+                }
+                const deadline = Date.now() + limits.shutdownDeadlineMs;
+                while (connections.size > 0 && Date.now() < deadline) {
+                    await new Promise((resolve) => setTimeout(resolve, 10));
+                }
+                for (const connection of [...connections]) {
+                    connection.ws.terminate();
+                }
+                await closeWebSocketServer(wss);
+            })();
+            return shutdownPromise;
+        },
+    };
+}
+function assertAuthenticationResult(hello, authenticate, peer, accepted) {
+    if (hello.role !== "browser-inspect" ||
+        authenticate.role !== "browser-inspect" ||
+        accepted.role !== "browser-inspect" ||
+        authenticate.mode !== "connect" ||
+        accepted.daemonId !== hello.daemonId ||
+        accepted.daemonInstanceId !== hello.daemonInstanceId ||
+        authenticate.daemonId !== hello.daemonId ||
+        authenticate.daemonInstanceId !== hello.daemonInstanceId ||
+        authenticate.bindingProtocolVersion !==
+            DIRECT_RUNTIME_BROWSER_INSPECT_BINDING_PROTOCOL.currentVersion ||
+        accepted.bindingProtocolVersion !== authenticate.bindingProtocolVersion ||
+        accepted.coreProtocolVersion !== authenticate.coreProtocolVersion ||
+        accepted.clientId !== authenticate.clientId ||
+        accepted.clientId !== peer.clientId ||
+        accepted.grantId !== authenticate.grantId ||
+        accepted.grantId !== peer.grantId ||
+        accepted.authorities.length !== peer.subject.effectiveAuthorities.length ||
+        accepted.authorities.some((authority, index) => authority !== peer.subject.effectiveAuthorities[index])) {
+        throw new Error("Browser Inspect authenticator returned an inconsistent identity");
+    }
+}
+function isClosed(connection) {
+    return connection.state === "closing" || connection.state === "closed";
+}
+function rawDataBytes(data) {
+    if (data instanceof ArrayBuffer)
+        return new Uint8Array(data);
+    if (Array.isArray(data))
+        return Uint8Array.from(Buffer.concat(data));
+    return new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+}
+function decodeText(bytes) {
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch (error) {
+        throw new Error("Browser Inspect frame must be valid UTF-8", {
+            cause: error,
+        });
+    }
+}
+function socketSourceAddress(request) {
+    const address = request.socket.remoteAddress;
+    if (!address)
+        return "unknown";
+    return address.startsWith("::ffff:")
+        ? address.slice("::ffff:".length)
+        : address;
+}
+function rejectUpgrade(socket, status, message) {
+    if (socket.destroyed)
+        return;
+    const body = `${message}\n`;
+    socket.end(`HTTP/1.1 ${status} ${statusText(status)}\r\n` +
+        "Connection: close\r\n" +
+        "Cache-Control: no-store\r\n" +
+        "Content-Type: text/plain; charset=utf-8\r\n" +
+        `Content-Length: ${Buffer.byteLength(body)}\r\n\r\n${body}`);
+}
+function statusText(status) {
+    if (status === 400)
+        return "Bad Request";
+    if (status === 404)
+        return "Not Found";
+    if (status === 503)
+        return "Service Unavailable";
+    return "Error";
+}
+function boundedMessage(message) {
+    const bytes = Buffer.from(message.replaceAll("\0", ""), "utf8");
+    if (bytes.byteLength <= 1_024)
+        return message.replaceAll("\0", "");
+    return bytes.subarray(0, 1_024).toString("utf8").replace(/\uFFFD+$/u, "");
+}
+function boundedCloseReason(reason) {
+    const bytes = Buffer.from(reason, "utf8");
+    if (bytes.byteLength <= 123)
+        return reason;
+    return bytes.subarray(0, 123).toString("utf8").replace(/\uFFFD+$/u, "");
+}
+function incrementCount(counts, key) {
+    counts.set(key, (counts.get(key) ?? 0) + 1);
+}
+function decrementCount(counts, key) {
+    const current = counts.get(key);
+    if (current === undefined || current <= 1)
+        counts.delete(key);
+    else
+        counts.set(key, current - 1);
+}
+function resolveLimits(limits) {
+    const resolved = {
+        authenticationTimeoutMs: positiveInteger(limits?.authenticationTimeoutMs, 10_000),
+        maxConnections: positiveInteger(limits?.maxConnections, DEFAULT_MAX_CONNECTIONS),
+        maxUnauthenticatedConnectionsPerSource: positiveInteger(limits?.maxUnauthenticatedConnectionsPerSource, DEFAULT_MAX_UNAUTHENTICATED_CONNECTIONS_PER_SOURCE),
+        maxAuthenticationAttemptsPerSource: positiveInteger(limits?.maxAuthenticationAttemptsPerSource, DEFAULT_MAX_AUTHENTICATION_ATTEMPTS_PER_SOURCE),
+        authenticationAttemptWindowMs: positiveInteger(limits?.authenticationAttemptWindowMs, DEFAULT_AUTHENTICATION_ATTEMPT_WINDOW_MS),
+        maxTrackedAuthenticationSources: positiveInteger(limits?.maxTrackedAuthenticationSources, DEFAULT_MAX_TRACKED_AUTHENTICATION_SOURCES),
+        maxConnectionsPerGrant: positiveInteger(limits?.maxConnectionsPerGrant, DEFAULT_MAX_CONNECTIONS_PER_GRANT),
+        maxQueuedBytes: positiveInteger(limits?.maxQueuedBytes, DEFAULT_MAX_QUEUED_BYTES),
+        maxBufferedBytes: positiveInteger(limits?.maxBufferedBytes, DEFAULT_MAX_BUFFERED_BYTES),
+        heartbeatIntervalMs: positiveInteger(limits?.heartbeatIntervalMs, RUNTIME_BROWSER_INSPECT_HEARTBEAT_INTERVAL_MS),
+        peerLivenessTimeoutMs: positiveInteger(limits?.peerLivenessTimeoutMs, RUNTIME_BROWSER_INSPECT_PEER_LIVENESS_TIMEOUT_MS),
+        shutdownDeadlineMs: positiveInteger(limits?.shutdownDeadlineMs, DEFAULT_SHUTDOWN_DEADLINE_MS),
+    };
+    if (resolved.maxConnectionsPerGrant > resolved.maxConnections) {
+        throw new Error("Browser Inspect per-grant limit must not exceed maxConnections");
+    }
+    if (resolved.peerLivenessTimeoutMs <= resolved.heartbeatIntervalMs) {
+        throw new Error("Browser Inspect liveness timeout must exceed its heartbeat interval");
+    }
+    if (resolved.maxQueuedBytes <
+        RUNTIME_BROWSER_INSPECT_MAX_MESSAGE_BYTES ||
+        resolved.maxBufferedBytes <
+            RUNTIME_BROWSER_INSPECT_MAX_MESSAGE_BYTES) {
+        throw new Error("Browser Inspect byte limits must admit one maximum CDP frame");
+    }
+    return resolved;
+}
+function positiveInteger(value, fallback) {
+    const resolved = value ?? fallback;
+    if (!Number.isSafeInteger(resolved) || resolved <= 0) {
+        throw new Error("Browser Inspect limits must be positive safe integers");
+    }
+    return resolved;
+}
+class SourceAuthenticationAttemptLimiter {
+    options;
+    entries = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    tryConsume(sourceAddress, now = Date.now()) {
+        const existing = this.entries.get(sourceAddress);
+        if (existing && now - existing.startedAt < this.options.windowMs) {
+            existing.attempts += 1;
+            this.entries.delete(sourceAddress);
+            this.entries.set(sourceAddress, existing);
+            return existing.attempts <= this.options.maxAttempts;
+        }
+        if (existing)
+            this.entries.delete(sourceAddress);
+        while (this.entries.size >= this.options.maxSources) {
+            const oldest = this.entries.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.entries.delete(oldest);
+        }
+        this.entries.set(sourceAddress, { startedAt: now, attempts: 1 });
+        return true;
+    }
+}
+function closeWebSocketServer(server) {
+    return new Promise((resolve) => {
+        try {
+            server.close(() => resolve());
+        }
+        catch {
+            resolve();
+        }
+    });
+}