@rynx-ai/server 0.1.0 → 0.1.9

package/dist/direct-runtime-server.js

@@ -0,0 +1,1931 @@
+import { createServer, } from "node:http";
+import { decodeDirectRuntimeFrame, DIRECT_RUNTIME_CLOSE_CODE, DIRECT_RUNTIME_BROWSER_SURFACE_PATH, DIRECT_RUNTIME_CONTROL_PATH, DIRECT_RUNTIME_MAX_HANDSHAKE_FRAME_BYTES, encodeDirectRuntimeFrame, parseServerAccepted, parseServerHello, } from "@rynx-ai/protocol/direct-runtime";
+import { createServerE2EEChannel, DIRECT_RUNTIME_E2EE_MAX_ENVELOPE_BYTES, } from "@rynx-ai/remote-runtime-e2ee";
+import { encodeRemoteRuntimeSessionEventsFrame, encodeRemoteRuntimeSessionTerminalServerFrame, encodeRemoteRuntimeRpcResponse, parseRemoteRuntimeRpcFrame, parseRemoteRuntimeSessionEventsFrame, parseRemoteRuntimeSessionTerminalClientFrame, REMOTE_RUNTIME_SESSION_TERMINAL_MAX_DATA_BYTES, REMOTE_RUNTIME_RPC_MAX_FRAME_BYTES, REMOTE_RUNTIME_RPC_MAX_ID_CHARS, REMOTE_RUNTIME_RPC_METHOD_METADATA, } from "@rynx-ai/protocol/remote-runtime-rpc";
+import { encodeRuntimeEmulatorSurfaceServerFrame, parseRuntimeEmulatorSurfaceClientFrame, RUNTIME_EMULATOR_SURFACE_CHUNK_BYTES, RUNTIME_EMULATOR_SURFACE_MAX_FRAME_BYTES, } from "@rynx-ai/protocol/runtime-emulator-surface";
+import { WebSocket, WebSocketServer } from "ws";
+import { attachDirectRuntimeBrowserSurfaceServer, } from "./direct-runtime-browser-surface-server.js";
+export { DIRECT_RUNTIME_CONTROL_PATH };
+const CLOSE_BAD_PROTOCOL = DIRECT_RUNTIME_CLOSE_CODE.badProtocol;
+const CLOSE_UNAUTHORIZED = DIRECT_RUNTIME_CLOSE_CODE.unauthorized;
+const CLOSE_AUTH_TIMEOUT = DIRECT_RUNTIME_CLOSE_CODE.authenticationTimeout;
+const CLOSE_CAPACITY = DIRECT_RUNTIME_CLOSE_CODE.capacity;
+const CLOSE_INTERNAL = DIRECT_RUNTIME_CLOSE_CODE.internal;
+const DEFAULT_AUTH_TIMEOUT_MS = 10_000;
+const DEFAULT_MAX_CONNECTIONS = 64;
+const DEFAULT_MAX_UNAUTHENTICATED_CONNECTIONS_PER_SOURCE = 4;
+const DEFAULT_MAX_AUTHENTICATION_ATTEMPTS_PER_SOURCE = 20;
+const DEFAULT_AUTHENTICATION_ATTEMPT_WINDOW_MS = 60_000;
+const DEFAULT_MAX_TRACKED_AUTHENTICATION_SOURCES = 1_024;
+const DEFAULT_MAX_CONNECTIONS_PER_GRANT = 8;
+const DEFAULT_MAX_QUEUED_FRAMES = 32;
+const DEFAULT_MAX_REQUEST_IDS = 4_096;
+const DEFAULT_MAX_BUFFERED_BYTES = 1024 * 1024;
+const DEFAULT_MAX_SESSION_SUBSCRIPTIONS = 16;
+const DEFAULT_MAX_QUEUED_SESSION_EVENTS = 128;
+const DEFAULT_MAX_QUEUED_SESSION_EVENT_BYTES = 512 * 1024;
+const DEFAULT_MAX_QUEUED_TERMINAL_OUTPUT_FRAMES = 128;
+const DEFAULT_MAX_QUEUED_TERMINAL_OUTPUT_BYTES = 512 * 1024;
+const DEFAULT_SHUTDOWN_DEADLINE_MS = 5_000;
+const DEFAULT_HEARTBEAT_INTERVAL_MS = 15_000;
+const CONNECTION_CLOSE_DEADLINE_MS = 1_000;
+const MAX_RPC_METHOD_NAME_CHARS = 256;
+const RPC_ENVELOPE_TOKEN_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._~-]*$/;
+const EMULATOR_SURFACE_ACK_TIMEOUT_MS = 10_000;
+/** Process-live connection index used to fence grants immediately after revocation. */
+export class DirectRuntimeConnectionHub {
+    connectionsByGrant = new Map();
+    grantByConnection = new Map();
+    revokedGrantIds = new Set();
+    /** @internal Called by the Direct adapter after authentication and before acceptance. */
+    register(grantId, connection) {
+        return this.registerWithinLimit(grantId, connection, Number.MAX_SAFE_INTEGER) === "registered";
+    }
+    /** @internal Atomically fence revocation and enforce a per-grant channel bound. */
+    registerWithinLimit(grantId, connection, maxConnections) {
+        if (!Number.isSafeInteger(maxConnections) || maxConnections <= 0) {
+            throw new Error("Direct Runtime per-grant connection limit must be positive");
+        }
+        if (this.revokedGrantIds.has(grantId))
+            return "revoked";
+        const connections = this.connectionsByGrant.get(grantId) ?? new Set();
+        if (connections.size >= maxConnections)
+            return "capacity";
+        connections.add(connection);
+        this.connectionsByGrant.set(grantId, connections);
+        this.grantByConnection.set(connection, grantId);
+        return "registered";
+    }
+    /** @internal Idempotent adapter cleanup. */
+    unregister(connection) {
+        const grantId = this.grantByConnection.get(connection);
+        if (!grantId)
+            return;
+        this.grantByConnection.delete(connection);
+        const connections = this.connectionsByGrant.get(grantId);
+        connections?.delete(connection);
+        if (connections?.size === 0)
+            this.connectionsByGrant.delete(grantId);
+    }
+    /** Mark a grant revoked and immediately close every matching active channel. */
+    revokeGrant(grantId, reason = "Remote Runtime grant revoked") {
+        this.revokedGrantIds.add(grantId);
+        const connections = [...(this.connectionsByGrant.get(grantId) ?? [])];
+        for (const connection of connections)
+            connection.close(CLOSE_UNAUTHORIZED, reason);
+        return connections.length;
+    }
+    get activeConnectionCount() {
+        return this.grantByConnection.size;
+    }
+}
+/** Start a fail-closed HTTP/WebSocket listener containing only the E2EE Direct route. */
+export async function startDirectRuntimeServer(options) {
+    const host = options.host.trim();
+    if (!host)
+        throw new Error("Direct Runtime bind host is required");
+    if (!Number.isInteger(options.port) || options.port < 0 || options.port > 65_535) {
+        throw new Error("Direct Runtime port must be an integer between 0 and 65535");
+    }
+    const limits = resolveLimits(options.limits);
+    const connectionHub = options.connectionHub ?? new DirectRuntimeConnectionHub();
+    const allConnections = new Set();
+    const activeDispatches = new Set();
+    const activeDispatchControllers = new Set();
+    const rawSockets = new Set();
+    const emptyWaiters = new Set();
+    const liveWebSockets = new WeakSet();
+    const unauthenticatedConnectionsBySource = new Map();
+    const pendingUpgradesBySource = new Map();
+    const authenticationAttempts = new SourceAuthenticationAttemptLimiter({
+        maxAttempts: limits.maxAuthenticationAttemptsPerSource,
+        windowMs: limits.authenticationAttemptWindowMs,
+        maxSources: limits.maxTrackedAuthenticationSources,
+    });
+    let pendingUpgrades = 0;
+    let stopping = false;
+    let heartbeatTimer;
+    let shutdownPromise;
+    const server = createServer((_request, response) => {
+        response.statusCode = 404;
+        response.setHeader("cache-control", "no-store");
+        response.setHeader("connection", "close");
+        response.end("not found\n");
+    });
+    const wss = new WebSocketServer({
+        noServer: true,
+        clientTracking: true,
+        perMessageDeflate: false,
+        maxPayload: DIRECT_RUNTIME_E2EE_MAX_ENVELOPE_BYTES,
+    });
+    server.maxConnections = limits.maxConnections;
+    server.headersTimeout = limits.authenticationTimeoutMs;
+    server.requestTimeout = limits.authenticationTimeoutMs;
+    server.keepAliveTimeout = Math.min(5_000, limits.authenticationTimeoutMs);
+    server.on("error", (error) => options.onError?.(error, "HTTP listener"));
+    server.on("connection", (socket) => {
+        rawSockets.add(socket);
+        socket.once("close", () => rawSockets.delete(socket));
+    });
+    const browserSurfaceServer = options.browserSurface
+        ? attachDirectRuntimeBrowserSurfaceServer(server, {
+            e2ee: options.e2ee,
+            authenticator: options.authenticator,
+            host: options.browserSurface.host,
+            isPeerActive: options.isPeerActive,
+            connectionHub,
+            limits: {
+                ...options.browserSurface.limits,
+                authenticationTimeoutMs: limits.authenticationTimeoutMs,
+                maxConnections: limits.maxConnections,
+                maxUnauthenticatedConnectionsPerSource: limits.maxUnauthenticatedConnectionsPerSource,
+                maxAuthenticationAttemptsPerSource: limits.maxAuthenticationAttemptsPerSource,
+                authenticationAttemptWindowMs: limits.authenticationAttemptWindowMs,
+                maxTrackedAuthenticationSources: limits.maxTrackedAuthenticationSources,
+                maxConnectionsPerGrant: limits.maxConnectionsPerGrant,
+                heartbeatIntervalMs: limits.heartbeatIntervalMs,
+                shutdownDeadlineMs: limits.shutdownDeadlineMs,
+            },
+            onError: options.onError,
+        })
+        : undefined;
+    server.on("upgrade", (request, socket, head) => {
+        const sourceAddress = socketSourceAddress(request);
+        if (stopping) {
+            rejectUpgrade(socket, 503, "Direct Runtime is stopping");
+            return;
+        }
+        if (browserSurfaceServer && request.url === DIRECT_RUNTIME_BROWSER_SURFACE_PATH) {
+            return;
+        }
+        if (request.url !== DIRECT_RUNTIME_CONTROL_PATH) {
+            rejectUpgrade(socket, 404, "Direct Runtime route not found");
+            return;
+        }
+        if (allConnections.size + pendingUpgrades >= limits.maxConnections) {
+            rejectUpgrade(socket, 503, "Direct Runtime connection capacity reached");
+            return;
+        }
+        if ((unauthenticatedConnectionsBySource.get(sourceAddress) ?? 0) +
+            (pendingUpgradesBySource.get(sourceAddress) ?? 0) >=
+            limits.maxUnauthenticatedConnectionsPerSource) {
+            rejectUpgrade(socket, 503, "Direct Runtime source authentication capacity reached");
+            return;
+        }
+        pendingUpgrades += 1;
+        incrementCount(pendingUpgradesBySource, sourceAddress);
+        let upgradePending = true;
+        const finishPendingUpgrade = () => {
+            if (!upgradePending)
+                return;
+            upgradePending = false;
+            pendingUpgrades -= 1;
+            decrementCount(pendingUpgradesBySource, sourceAddress);
+        };
+        try {
+            wss.handleUpgrade(request, socket, head, (ws) => {
+                finishPendingUpgrade();
+                const connection = acceptConnection(ws, sourceAddress);
+                allConnections.add(connection);
+                wss.emit("connection", ws, request);
+            });
+        }
+        catch (error) {
+            finishPendingUpgrade();
+            options.onError?.(error, "websocket upgrade");
+            rejectUpgrade(socket, 400, "invalid Direct Runtime WebSocket upgrade");
+        }
+    });
+    function acceptConnection(ws, sourceAddress) {
+        let connection;
+        const abortController = new AbortController();
+        const authenticationTimer = setTimeout(() => {
+            abortController.abort(new Error("Direct Runtime authentication timed out"));
+            connection.close(CLOSE_AUTH_TIMEOUT, "Direct Runtime authentication timed out");
+        }, limits.authenticationTimeoutMs);
+        authenticationTimer.unref?.();
+        connection = {
+            ws,
+            sourceAddress,
+            countedAsUnauthenticated: true,
+            state: "awaiting_e2ee_hello",
+            abortController,
+            authenticationTimer,
+            receiveTail: Promise.resolve(),
+            queuedFrames: 0,
+            authenticationFrameQueued: false,
+            seenRequestIds: new Set(),
+            seenSubscriptionIds: new Set(),
+            pendingSessionSubscriptions: new Map(),
+            sessionSubscriptions: new Map(),
+            seenTerminalAttachmentIds: new Set(),
+            seenEmulatorSurfaceIds: new Set(),
+            cleaned: false,
+            close(code, reason) {
+                closeConnection(connection, code, reason);
+            },
+        };
+        incrementCount(unauthenticatedConnectionsBySource, sourceAddress);
+        liveWebSockets.add(ws);
+        ws.on("message", (data, isBinary) => {
+            // Application traffic is also positive proof that the peer is alive.
+            liveWebSockets.add(ws);
+            if (connection.state === "closing" || connection.state === "closed")
+                return;
+            if (connection.state !== "authenticated") {
+                if ((connection.state !== "awaiting_e2ee_hello" &&
+                    connection.state !== "awaiting_authentication") ||
+                    connection.authenticationFrameQueued) {
+                    connection.close(CLOSE_BAD_PROTOCOL, "client traffic must wait for Direct Runtime authentication");
+                    return;
+                }
+                connection.authenticationFrameQueued = true;
+            }
+            connection.queuedFrames += 1;
+            if (connection.queuedFrames > limits.maxQueuedFrames) {
+                connection.queuedFrames -= 1;
+                connection.close(CLOSE_CAPACITY, "Direct Runtime input queue is full");
+                return;
+            }
+            const run = () => handleFrame(connection, data, isBinary);
+            const handleFailure = (error) => {
+                if (connection.state === "closing" || connection.state === "closed")
+                    return;
+                options.onError?.(error, "control frame");
+                connection.close(CLOSE_INTERNAL, "Direct Runtime frame handling failed");
+            };
+            const releaseFrame = () => {
+                connection.queuedFrames -= 1;
+            };
+            if (connection.state === "authenticated") {
+                // Request ids correlate responses, so authenticated unary RPCs may run
+                // concurrently. Ordering/ownership belongs to each domain service;
+                // serializing the entire channel would let a long attach block status
+                // and stop controls for the same daemon.
+                void run().catch(handleFailure).finally(releaseFrame);
+                return;
+            }
+            // Authentication remains strictly single-frame and ordered.
+            connection.receiveTail = connection.receiveTail
+                .then(run)
+                .catch((error) => {
+                handleFailure(error);
+            })
+                .finally(releaseFrame);
+        });
+        ws.on("ping", () => liveWebSockets.add(ws));
+        ws.on("pong", () => liveWebSockets.add(ws));
+        ws.on("close", () => cleanupConnection(connection));
+        ws.on("error", (error) => {
+            options.onError?.(error, "control socket");
+            cleanupConnection(connection);
+        });
+        return connection;
+    }
+    async function initializeServerHello(connection) {
+        try {
+            const channel = connection.e2eeChannel;
+            if (!channel)
+                throw new Error("Direct Runtime E2EE channel is unavailable");
+            const channelBinding = channel.channelBinding;
+            const hello = parseServerHello(await options.authenticator.createServerHello({
+                channelBinding: new Uint8Array(channelBinding),
+                role: "control",
+                signal: connection.abortController.signal,
+            }));
+            if (hello.role !== "control") {
+                throw new Error("Direct Runtime authenticator returned the wrong channel role");
+            }
+            if (connection.state !== "awaiting_e2ee_hello")
+                return;
+            const encoded = encodeDirectRuntimeFrame(hello);
+            const bytes = Uint8Array.from(Buffer.from(encoded, "utf8"));
+            // Publish this connection's challenge before waiting for ws.send's
+            // callback. A client can receive the frame and answer before that local
+            // callback runs; the one-frame gate still admits only authentication.
+            connection.serverHello = hello;
+            connection.serverHelloBytes = bytes;
+            connection.authenticationFrameQueued = false;
+            connection.state = "awaiting_authentication";
+            await sendText(connection, encoded, limits.maxBufferedBytes);
+        }
+        catch (error) {
+            if (connection.state === "closing" || connection.state === "closed")
+                return;
+            options.onError?.(error, "server hello");
+            connection.close(CLOSE_INTERNAL, "Direct Runtime authentication setup failed");
+        }
+    }
+    async function handleFrame(connection, data, isBinary) {
+        if (connection.state === "closing" || connection.state === "closed")
+            return;
+        if (isBinary) {
+            connection.close(CLOSE_BAD_PROTOCOL, "Direct Runtime control frames must be text");
+            return;
+        }
+        const wireBytes = rawDataBytes(data);
+        if (wireBytes.byteLength > DIRECT_RUNTIME_E2EE_MAX_ENVELOPE_BYTES) {
+            connection.close(CLOSE_BAD_PROTOCOL, "Direct Runtime frame is too large");
+            return;
+        }
+        if (connection.state === "awaiting_e2ee_hello") {
+            await establishE2EEChannel(connection, wireBytes);
+            return;
+        }
+        const channel = connection.e2eeChannel;
+        if (!channel) {
+            connection.close(CLOSE_BAD_PROTOCOL, "Direct Runtime E2EE channel is unavailable");
+            return;
+        }
+        let plaintext;
+        try {
+            plaintext = channel.open(decodeText(wireBytes));
+        }
+        catch {
+            connection.close(CLOSE_BAD_PROTOCOL, "invalid Direct Runtime E2EE frame");
+            return;
+        }
+        const bytes = Uint8Array.from(Buffer.from(plaintext, "utf8"));
+        const maxBytes = connection.state === "authenticated"
+            ? REMOTE_RUNTIME_RPC_MAX_FRAME_BYTES
+            : DIRECT_RUNTIME_MAX_HANDSHAKE_FRAME_BYTES;
+        if (bytes.byteLength > maxBytes) {
+            connection.close(CLOSE_BAD_PROTOCOL, "Direct Runtime frame is too large");
+            return;
+        }
+        if (connection.state === "awaiting_authentication") {
+            await authenticateConnection(connection, bytes);
+            return;
+        }
+        if (connection.state !== "authenticated" || !connection.peer) {
+            connection.close(CLOSE_BAD_PROTOCOL, "Direct Runtime authentication is already in progress");
+            return;
+        }
+        let frame;
+        try {
+            frame = parseAuthenticatedClientFrame(bytes);
+        }
+        catch {
+            connection.close(CLOSE_BAD_PROTOCOL, "invalid Remote Runtime control request");
+            return;
+        }
+        if (frame.type === "session.events.subscribe" || frame.type === "session.events.cancel") {
+            await handleSessionEventsFrame(connection, frame);
+            return;
+        }
+        if (frame.type === "session.terminal.open" ||
+            frame.type === "session.terminal.input" ||
+            frame.type === "session.terminal.resize" ||
+            frame.type === "session.terminal.close") {
+            await handleTerminalFrame(connection, frame);
+            return;
+        }
+        if (frame.type === "emulator.surface.open" ||
+            frame.type === "emulator.surface.frame.ack" ||
+            frame.type === "emulator.surface.touch" ||
+            frame.type === "emulator.surface.close") {
+            await handleEmulatorSurfaceFrame(connection, frame);
+            return;
+        }
+        const request = frame;
+        if (connection.seenRequestIds.has(request.id)) {
+            await sendRpcError(connection, {
+                type: "rpc.error",
+                id: request.id,
+                error: { code: "conflict", message: "Remote Runtime request id was already used" },
+            });
+            return;
+        }
+        if (connection.seenRequestIds.size >= limits.maxRequestIds) {
+            connection.close(CLOSE_CAPACITY, "Direct Runtime request id capacity reached");
+            return;
+        }
+        connection.seenRequestIds.add(request.id);
+        let active = false;
+        try {
+            active = await options.isPeerActive(connection.peer);
+        }
+        catch (error) {
+            options.onError?.(error, "Direct Runtime peer activity check");
+        }
+        if (!active) {
+            await sendRpcError(connection, {
+                type: "rpc.error",
+                id: request.id,
+                error: { code: "unauthorized", message: "Remote Runtime grant is not active" },
+            });
+            connection.close(CLOSE_UNAUTHORIZED, "Remote Runtime grant is not active");
+            return;
+        }
+        if (stopping || isConnectionClosed(connection))
+            return;
+        if (request.type === "rpc.unknown_request") {
+            await sendRpcError(connection, {
+                type: "rpc.error",
+                id: request.id,
+                error: {
+                    code: "method_not_found",
+                    message: "Remote Runtime method is not supported",
+                },
+            });
+            return;
+        }
+        const dispatchAbortController = new AbortController();
+        const abortFromConnection = () => {
+            dispatchAbortController.abort(connection.abortController.signal.reason);
+        };
+        if (connection.abortController.signal.aborted)
+            abortFromConnection();
+        else {
+            connection.abortController.signal.addEventListener("abort", abortFromConnection, {
+                once: true,
+            });
+        }
+        activeDispatchControllers.add(dispatchAbortController);
+        let responsePromise;
+        try {
+            responsePromise = options.dispatcher.dispatch(request, {
+                subject: connection.peer.subject,
+                signal: dispatchAbortController.signal,
+            });
+        }
+        catch (error) {
+            connection.abortController.signal.removeEventListener("abort", abortFromConnection);
+            activeDispatchControllers.delete(dispatchAbortController);
+            throw error;
+        }
+        let settledDispatch;
+        settledDispatch = responsePromise
+            .then(() => undefined, () => undefined)
+            .finally(() => {
+            connection.abortController.signal.removeEventListener("abort", abortFromConnection);
+            activeDispatchControllers.delete(dispatchAbortController);
+            activeDispatches.delete(settledDispatch);
+        });
+        activeDispatches.add(settledDispatch);
+        const response = await responsePromise;
+        await sendText(connection, encodeRemoteRuntimeRpcResponse(response, request.method), limits.maxBufferedBytes);
+    }
+    async function establishE2EEChannel(connection, bytes) {
+        if (bytes.byteLength > DIRECT_RUNTIME_MAX_HANDSHAKE_FRAME_BYTES) {
+            connection.close(CLOSE_BAD_PROTOCOL, "Direct Runtime E2EE hello is too large");
+            return;
+        }
+        try {
+            const frame = decodeDirectRuntimeFrame(bytes);
+            if (frame.type !== "e2ee.client-hello") {
+                throw new Error("first client frame must be e2ee.client-hello");
+            }
+            const sharedSecret = options.e2ee.deriveSharedSecret(frame.clientEphemeralPublicKey);
+            connection.e2eeChannel = createServerE2EEChannel({
+                sharedSecret,
+                serverEncryptionPublicKey: options.e2ee.serverPublicKey,
+                clientHello: frame,
+            });
+            await sendPlainText(connection, encodeDirectRuntimeFrame({ type: "e2ee.ready" }), limits.maxBufferedBytes);
+            await initializeServerHello(connection);
+        }
+        catch {
+            connection.close(CLOSE_BAD_PROTOCOL, "invalid Direct Runtime E2EE client hello");
+        }
+    }
+    async function handleSessionEventsFrame(connection, frame) {
+        const peer = connection.peer;
+        if (!peer) {
+            connection.close(CLOSE_BAD_PROTOCOL, "Direct Runtime peer identity is unavailable");
+            return;
+        }
+        if (frame.type === "session.events.cancel") {
+            const pending = connection.pendingSessionSubscriptions.get(frame.subscriptionId);
+            if (pending) {
+                // Cancellation is a transport-lifecycle reduction, so record it before
+                // any asynchronous work. The opening handler owns eventual source
+                // cleanup even if its application call resolves after this close.
+                await cancelPendingSessionSubscription(connection, pending, true);
+                return;
+            }
+            const subscription = connection.sessionSubscriptions.get(frame.subscriptionId);
+            if (subscription) {
+                finishSessionSubscription(connection, subscription, "cancelled", undefined, true);
+            }
+            else if (!connection.seenSubscriptionIds.has(frame.subscriptionId)) {
+                connection.close(CLOSE_BAD_PROTOCOL, "Remote Session subscription id is unknown");
+            }
+            // Otherwise the id is a terminal tombstone. Do not emit a second close
+            // after a capacity/open/normal-close frame the client may have consumed.
+            return;
+        }
+        let admissionFailure;
+        let pending;
+        if (connection.seenSubscriptionIds.has(frame.subscriptionId)) {
+            admissionFailure = "duplicate";
+        }
+        else if (connection.seenSubscriptionIds.size >= limits.maxRequestIds) {
+            admissionFailure = "id_capacity";
+        }
+        else {
+            connection.seenSubscriptionIds.add(frame.subscriptionId);
+            if (connection.pendingSessionSubscriptions.size + connection.sessionSubscriptions.size >=
+                limits.maxSessionSubscriptions) {
+                admissionFailure = "subscription_capacity";
+            }
+            else {
+                pending = {
+                    subscriptionId: frame.subscriptionId,
+                    sessionId: frame.sessionId,
+                    abortController: new AbortController(),
+                    cancelRequested: false,
+                    closeFrameClaimed: false,
+                };
+                // Reserve the id and capacity before the first await. Authenticated
+                // frame handlers run concurrently, so a following cancel can now hit
+                // this pending state instead of falling through the seen-id tombstone.
+                connection.pendingSessionSubscriptions.set(frame.subscriptionId, pending);
+            }
+        }
+        let active = false;
+        try {
+            active = await options.isPeerActive(peer);
+        }
+        catch (error) {
+            options.onError?.(error, "Direct Runtime peer activity check");
+        }
+        if (!active) {
+            if (pending) {
+                connection.pendingSessionSubscriptions.delete(pending.subscriptionId);
+                abortPendingSessionSubscription(pending);
+            }
+            if (!pending?.closeFrameClaimed) {
+                if (pending)
+                    pending.closeFrameClaimed = true;
+                await sendSessionEventsClosed(connection, frame.subscriptionId, "unauthorized");
+            }
+            connection.close(CLOSE_UNAUTHORIZED, "Remote Runtime grant is not active");
+            return;
+        }
+        if (admissionFailure === "duplicate") {
+            await sendSessionEventsClosed(connection, frame.subscriptionId, "capacity", "Remote Session subscription id was already used");
+            return;
+        }
+        if (admissionFailure === "id_capacity") {
+            connection.close(CLOSE_CAPACITY, "Direct Runtime subscription id capacity reached");
+            return;
+        }
+        if (admissionFailure === "subscription_capacity") {
+            await sendSessionEventsClosed(connection, frame.subscriptionId, "capacity", "Remote Session subscription capacity reached");
+            return;
+        }
+        if (!pending) {
+            connection.close(CLOSE_INTERNAL, "Remote Session pending subscription is unavailable");
+            return;
+        }
+        if (pending.cancelRequested) {
+            await cancelPendingSessionSubscription(connection, pending, true);
+            connection.pendingSessionSubscriptions.delete(pending.subscriptionId);
+            return;
+        }
+        let opened;
+        try {
+            opened = await options.dispatcher.openSessionEvents(frame.sessionId, {
+                subject: peer.subject,
+                signal: pending.abortController.signal,
+            });
+        }
+        catch (error) {
+            connection.pendingSessionSubscriptions.delete(pending.subscriptionId);
+            if (pending.cancelRequested) {
+                await cancelPendingSessionSubscription(connection, pending, true);
+                return;
+            }
+            options.onError?.(error, "Remote Session subscription open");
+            await sendSessionEventsClosed(connection, frame.subscriptionId, remoteSessionOpenCloseReason(error));
+            return;
+        }
+        if (opened.sessionId !== frame.sessionId) {
+            connection.pendingSessionSubscriptions.delete(pending.subscriptionId);
+            await opened.cancel().catch(() => undefined);
+            connection.close(CLOSE_INTERNAL, "Remote Session subscription identity mismatch");
+            return;
+        }
+        if (pending.cancelRequested || isConnectionClosed(connection)) {
+            connection.pendingSessionSubscriptions.delete(pending.subscriptionId);
+            await opened.cancel().catch((error) => {
+                options.onError?.(error, "Remote Session pending subscription cancel");
+            });
+            if (!isConnectionClosed(connection)) {
+                await cancelPendingSessionSubscription(connection, pending, true);
+            }
+            return;
+        }
+        const subscription = {
+            subscriptionId: frame.subscriptionId,
+            sessionId: frame.sessionId,
+            output: new BoundedTextQueue(limits.maxQueuedSessionEvents, limits.maxQueuedSessionEventBytes),
+            cancelSource: () => opened.cancel(),
+            finishing: false,
+        };
+        connection.pendingSessionSubscriptions.delete(pending.subscriptionId);
+        connection.sessionSubscriptions.set(subscription.subscriptionId, subscription);
+        // Drain the process bus into our own bounded queue immediately. The
+        // accepted frame is still awaited before the writer starts, preserving the
+        // ready barrier without allowing the bus implementation to become the
+        // transport's unbounded buffer.
+        void readSessionEvents(connection, subscription, opened.events);
+        try {
+            await sendText(connection, encodeRemoteRuntimeSessionEventsFrame({
+                type: "session.events.accepted",
+                subscriptionId: subscription.subscriptionId,
+                sessionId: subscription.sessionId,
+                daemonInstanceId: opened.daemonInstanceId,
+            }), limits.maxBufferedBytes);
+            void writeSessionEvents(connection, subscription);
+        }
+        catch (error) {
+            finishSessionSubscription(connection, subscription, undefined, undefined, true);
+            throw error;
+        }
+    }
+    async function handleEmulatorSurfaceFrame(connection, frame) {
+        const peer = connection.peer;
+        if (!peer) {
+            connection.close(CLOSE_BAD_PROTOCOL, "Direct Runtime peer identity is unavailable");
+            return;
+        }
+        if (frame.type === "emulator.surface.frame.ack") {
+            const surface = connection.emulatorSurface;
+            const awaiting = surface?.awaitingAck;
+            if (!surface || surface.frame.surfaceId !== frame.surfaceId || !awaiting || awaiting.sequence !== frame.frameSequence) {
+                connection.close(CLOSE_BAD_PROTOCOL, "Emulator Surface ACK does not match the pending frame");
+                return;
+            }
+            if (awaiting.timer)
+                clearTimeout(awaiting.timer);
+            surface.awaitingAck = undefined;
+            awaiting.resolve();
+            return;
+        }
+        if (frame.type === "emulator.surface.touch") {
+            const surface = connection.emulatorSurface;
+            if (!surface ||
+                surface.frame.surfaceId !== frame.surfaceId ||
+                frame.inputSequence !== surface.nextInputSequence) {
+                connection.close(CLOSE_BAD_PROTOCOL, "Emulator Surface touch does not match the active input sequence");
+                return;
+            }
+            surface.nextInputSequence += 1;
+            await surface.attachment.handle(frame);
+            return;
+        }
+        if (frame.type === "emulator.surface.close") {
+            const pending = connection.pendingEmulatorSurface;
+            if (pending?.frame.surfaceId === frame.surfaceId) {
+                pending.closeRequested = true;
+                pending.abortController.abort(new Error("Emulator Surface opening was cancelled"));
+                connection.pendingEmulatorSurface = undefined;
+                await sendEmulatorSurfaceClosed(connection, frame.surfaceId, "client_closed");
+                return;
+            }
+            const surface = connection.emulatorSurface;
+            if (surface?.frame.surfaceId === frame.surfaceId) {
+                await finishEmulatorSurface(connection, surface, "client_closed");
+            }
+            else if (!connection.seenEmulatorSurfaceIds.has(frame.surfaceId)) {
+                connection.close(CLOSE_BAD_PROTOCOL, "Emulator Surface id is unknown");
+            }
+            return;
+        }
+        if (!options.emulatorSurface) {
+            await sendEmulatorSurfaceClosed(connection, frame.surfaceId, "unsupported", "Runtime does not provide Emulator Surface");
+            return;
+        }
+        if (connection.seenEmulatorSurfaceIds.has(frame.surfaceId)) {
+            await sendEmulatorSurfaceClosed(connection, frame.surfaceId, "capacity", "Emulator Surface id was already used");
+            return;
+        }
+        if (connection.seenEmulatorSurfaceIds.size >= limits.maxRequestIds) {
+            connection.close(CLOSE_CAPACITY, "Direct Runtime Emulator Surface id capacity reached");
+            return;
+        }
+        connection.seenEmulatorSurfaceIds.add(frame.surfaceId);
+        if (connection.pendingEmulatorSurface || connection.emulatorSurface) {
+            await sendEmulatorSurfaceClosed(connection, frame.surfaceId, "capacity", "One Emulator Surface is admitted per connection");
+            return;
+        }
+        // Reserve the one Surface slot before awaiting peer activity. Otherwise
+        // two raw open frames can both pass admission while the check is pending.
+        const pending = {
+            frame,
+            abortController: new AbortController(),
+            closeRequested: false,
+        };
+        connection.pendingEmulatorSurface = pending;
+        let active = false;
+        try {
+            active = await options.isPeerActive(peer);
+        }
+        catch (error) {
+            options.onError?.(error, "Emulator Surface peer activity check");
+        }
+        if (pending.closeRequested ||
+            isConnectionClosed(connection) ||
+            connection.pendingEmulatorSurface !== pending)
+            return;
+        if (!active) {
+            connection.pendingEmulatorSurface = undefined;
+            await sendEmulatorSurfaceClosed(connection, frame.surfaceId, "unauthorized");
+            connection.close(CLOSE_UNAUTHORIZED, "Remote Runtime grant is not active");
+            return;
+        }
+        let attachment;
+        try {
+            attachment = await options.emulatorSurface.host.open(frame, {
+                peer,
+                signal: pending.abortController.signal,
+            });
+        }
+        catch (error) {
+            if (connection.pendingEmulatorSurface === pending)
+                connection.pendingEmulatorSurface = undefined;
+            if (pending.closeRequested || pending.abortController.signal.aborted)
+                return;
+            options.onError?.(error, "Emulator Surface open");
+            await sendEmulatorSurfaceClosed(connection, frame.surfaceId, emulatorSurfaceCloseReason(error), error instanceof Error ? error.message : undefined);
+            return;
+        }
+        if (pending.closeRequested ||
+            isConnectionClosed(connection) ||
+            connection.pendingEmulatorSurface !== pending) {
+            if (connection.pendingEmulatorSurface === pending)
+                connection.pendingEmulatorSurface = undefined;
+            await Promise.resolve(attachment.close()).catch(() => undefined);
+            return;
+        }
+        if (attachment.ready.surfaceId !== frame.surfaceId ||
+            attachment.ready.sessionId !== frame.sessionId ||
+            attachment.ready.bindingId !== frame.bindingId) {
+            connection.pendingEmulatorSurface = undefined;
+            await Promise.resolve(attachment.close()).catch(() => undefined);
+            connection.close(CLOSE_INTERNAL, "Emulator Surface host changed the requested identity");
+            return;
+        }
+        const surface = {
+            frame,
+            attachment,
+            abortController: pending.abortController,
+            nextInputSequence: 0,
+            finishing: false,
+            closedFrameSent: false,
+        };
+        connection.pendingEmulatorSurface = undefined;
+        connection.emulatorSurface = surface;
+        await sendText(connection, encodeRuntimeEmulatorSurfaceServerFrame(attachment.ready), limits.maxBufferedBytes);
+        void runEmulatorSurface(connection, surface);
+    }
+    async function runEmulatorSurface(connection, surface) {
+        let frameSequence = 0;
+        let consecutiveCaptureFailures = 0;
+        const intervalMs = Math.ceil(1_000 / surface.frame.maximumFrameRate);
+        try {
+            while (!surface.finishing && !isConnectionClosed(connection)) {
+                const startedAt = Date.now();
+                let bytes;
+                try {
+                    bytes = await surface.attachment.capture();
+                    consecutiveCaptureFailures = 0;
+                }
+                catch (error) {
+                    if (surface.finishing || isConnectionClosed(connection) || connection.emulatorSurface !== surface)
+                        return;
+                    const reason = emulatorSurfaceCloseReason(error);
+                    if (reason !== "internal" || consecutiveCaptureFailures >= 4)
+                        throw error;
+                    consecutiveCaptureFailures += 1;
+                    const retryMs = Math.min(1_000, 100 * 2 ** (consecutiveCaptureFailures - 1));
+                    await new Promise((resolve) => setTimeout(resolve, retryMs));
+                    continue;
+                }
+                if (surface.finishing || isConnectionClosed(connection) || connection.emulatorSurface !== surface)
+                    return;
+                const validImage = surface.attachment.ready.format === "png"
+                    ? bytes[0] === 0x89 && bytes[1] === 0x50 && bytes[2] === 0x4e && bytes[3] === 0x47
+                    : bytes[0] === 0xff && bytes[1] === 0xd8 && bytes.at(-2) === 0xff && bytes.at(-1) === 0xd9;
+                if (bytes.byteLength === 0 ||
+                    bytes.byteLength > RUNTIME_EMULATOR_SURFACE_MAX_FRAME_BYTES ||
+                    !validImage)
+                    throw new Error(`Emulator Surface host returned an invalid ${surface.attachment.ready.format} frame`);
+                const sequence = frameSequence;
+                frameSequence += 1;
+                const timestampMilliseconds = Date.now();
+                let acknowledgedResolve;
+                let acknowledgedReject;
+                const acknowledged = new Promise((resolve, reject) => {
+                    acknowledgedResolve = resolve;
+                    acknowledgedReject = reject;
+                });
+                // A close can reject this before the writer reaches the await below.
+                void acknowledged.catch(() => undefined);
+                const awaitingAck = {
+                    sequence,
+                    resolve: acknowledgedResolve,
+                    reject: acknowledgedReject,
+                };
+                surface.awaitingAck = awaitingAck;
+                const chunkCount = Math.ceil(bytes.byteLength / RUNTIME_EMULATOR_SURFACE_CHUNK_BYTES);
+                for (let chunkIndex = 0; chunkIndex < chunkCount; chunkIndex += 1) {
+                    if (surface.finishing ||
+                        isConnectionClosed(connection) ||
+                        connection.emulatorSurface !== surface)
+                        return;
+                    const start = chunkIndex * RUNTIME_EMULATOR_SURFACE_CHUNK_BYTES;
+                    const chunk = bytes.subarray(start, Math.min(start + RUNTIME_EMULATOR_SURFACE_CHUNK_BYTES, bytes.byteLength));
+                    await sendText(connection, encodeRuntimeEmulatorSurfaceServerFrame({
+                        type: "emulator.surface.frame.chunk",
+                        surfaceId: surface.frame.surfaceId,
+                        frameSequence: sequence,
+                        timestampMilliseconds,
+                        chunkIndex,
+                        chunkCount,
+                        data: Buffer.from(chunk).toString("base64"),
+                    }), limits.maxBufferedBytes);
+                    if (surface.finishing ||
+                        isConnectionClosed(connection) ||
+                        connection.emulatorSurface !== surface)
+                        return;
+                }
+                if (surface.awaitingAck === awaitingAck) {
+                    const timer = setTimeout(() => awaitingAck.reject(new Error("Emulator Surface frame ACK timed out")), EMULATOR_SURFACE_ACK_TIMEOUT_MS);
+                    timer.unref?.();
+                    awaitingAck.timer = timer;
+                }
+                await acknowledged;
+                const waitMs = intervalMs - (Date.now() - startedAt);
+                if (waitMs > 0)
+                    await new Promise((resolve) => setTimeout(resolve, waitMs));
+            }
+        }
+        catch (error) {
+            if (!surface.finishing && !isConnectionClosed(connection)) {
+                options.onError?.(error, "Emulator Surface capture");
+                await finishEmulatorSurface(connection, surface, emulatorSurfaceCloseReason(error), error instanceof Error ? error.message : undefined);
+            }
+        }
+    }
+    async function finishEmulatorSurface(connection, surface, reason, message) {
+        if (surface.finishing)
+            return;
+        surface.finishing = true;
+        if (connection.emulatorSurface === surface)
+            connection.emulatorSurface = undefined;
+        surface.abortController.abort(new Error("Emulator Surface closed"));
+        const awaiting = surface.awaitingAck;
+        surface.awaitingAck = undefined;
+        if (awaiting) {
+            if (awaiting.timer)
+                clearTimeout(awaiting.timer);
+            awaiting.reject(new Error("Emulator Surface closed"));
+        }
+        await Promise.resolve(surface.attachment.close()).catch((error) => {
+            options.onError?.(error, "Emulator Surface close");
+        });
+        if (reason && !surface.closedFrameSent && !isConnectionClosed(connection)) {
+            surface.closedFrameSent = true;
+            await sendEmulatorSurfaceClosed(connection, surface.frame.surfaceId, reason, message);
+        }
+    }
+    async function sendEmulatorSurfaceClosed(connection, surfaceId, reason, message) {
+        await sendText(connection, encodeRuntimeEmulatorSurfaceServerFrame({
+            type: "emulator.surface.closed",
+            surfaceId,
+            reason,
+            ...(message ? { message: message.slice(0, 1_024) } : {}),
+        }), limits.maxBufferedBytes);
+    }
+    async function readSessionEvents(connection, subscription, events) {
+        try {
+            for await (const event of events) {
+                if (subscription.finishing)
+                    return;
+                const encoded = encodeRemoteRuntimeSessionEventsFrame({
+                    type: "session.events.event",
+                    subscriptionId: subscription.subscriptionId,
+                    event,
+                });
+                if (!subscription.output.push(encoded)) {
+                    finishSessionSubscription(connection, subscription, "backpressure", "Remote Session consumer is too slow", true);
+                    return;
+                }
+            }
+            finishSessionSubscription(connection, subscription, "session_closed", undefined, false);
+        }
+        catch (error) {
+            if (subscription.finishing)
+                return;
+            options.onError?.(error, "Remote Session event projection");
+            finishSessionSubscription(connection, subscription, "internal", "Remote Session event stream failed", true);
+        }
+    }
+    async function writeSessionEvents(connection, subscription) {
+        try {
+            for (;;) {
+                const frame = await subscription.output.shift();
+                if (frame === undefined)
+                    return;
+                await sendText(connection, frame, limits.maxBufferedBytes);
+            }
+        }
+        catch (error) {
+            if (!isConnectionClosed(connection)) {
+                options.onError?.(error, "Remote Session event delivery");
+                connection.close(CLOSE_INTERNAL, "Remote Session event delivery failed");
+            }
+        }
+        finally {
+            finishSessionSubscription(connection, subscription, undefined, undefined, true);
+        }
+    }
+    function abortPendingSessionSubscription(pending) {
+        pending.cancelRequested = true;
+        if (!pending.abortController.signal.aborted) {
+            pending.abortController.abort(new Error("Remote Session subscription cancelled"));
+        }
+    }
+    async function cancelPendingSessionSubscription(connection, pending, emitClosed) {
+        abortPendingSessionSubscription(pending);
+        if (!emitClosed || pending.closeFrameClaimed || isConnectionClosed(connection))
+            return;
+        pending.closeFrameClaimed = true;
+        await sendSessionEventsClosed(connection, pending.subscriptionId, "cancelled");
+    }
+    function finishSessionSubscription(connection, subscription, reason, message, discardPending) {
+        if (subscription.finishing)
+            return;
+        subscription.finishing = true;
+        connection.sessionSubscriptions.delete(subscription.subscriptionId);
+        void subscription.cancelSource().catch((error) => {
+            options.onError?.(error, "Remote Session subscription cancel");
+        });
+        const finalFrame = reason === undefined
+            ? undefined
+            : encodeRemoteRuntimeSessionEventsFrame({
+                type: "session.events.closed",
+                subscriptionId: subscription.subscriptionId,
+                reason,
+                ...(message === undefined ? {} : { message }),
+            });
+        if (discardPending)
+            subscription.output.replaceAndFinish(finalFrame);
+        else
+            subscription.output.finish(finalFrame);
+    }
+    async function sendSessionEventsClosed(connection, subscriptionId, reason, message) {
+        await sendText(connection, encodeRemoteRuntimeSessionEventsFrame({
+            type: "session.events.closed",
+            subscriptionId,
+            reason,
+            ...(message === undefined ? {} : { message }),
+        }), limits.maxBufferedBytes);
+    }
+    async function handleTerminalFrame(connection, frame) {
+        const peer = connection.peer;
+        if (!peer) {
+            connection.close(CLOSE_BAD_PROTOCOL, "Direct Runtime peer identity is unavailable");
+            return;
+        }
+        if (frame.type === "session.terminal.close") {
+            const pending = connection.pendingTerminal;
+            if (pending?.attachmentId === frame.attachmentId) {
+                pending.cancelRequested = true;
+                if (!pending.abortController.signal.aborted) {
+                    pending.abortController.abort(new Error("Remote Session terminal open cancelled"));
+                }
+                if (!pending.closeFrameClaimed && !isConnectionClosed(connection)) {
+                    pending.closeFrameClaimed = true;
+                    await sendTerminalClosed(connection, frame.attachmentId, "client_closed");
+                }
+                return;
+            }
+            const terminal = connection.terminal;
+            if (terminal?.attachmentId === frame.attachmentId) {
+                finishTerminal(connection, terminal, "client_closed", undefined, true);
+            }
+            else if (!connection.seenTerminalAttachmentIds.has(frame.attachmentId)) {
+                connection.close(CLOSE_BAD_PROTOCOL, "Remote Session terminal attachment id is unknown");
+            }
+            return;
+        }
+        if (frame.type === "session.terminal.input" || frame.type === "session.terminal.resize") {
+            const terminal = connection.terminal;
+            if (!terminal || terminal.attachmentId !== frame.attachmentId || terminal.finishing) {
+                connection.close(CLOSE_BAD_PROTOCOL, "Remote Session terminal attachment is not active");
+                return;
+            }
+            const control = terminal.controlTail.then(async () => {
+                if (terminal.finishing)
+                    return;
+                let active = false;
+                try {
+                    active = await options.isPeerActive(peer);
+                }
+                catch (error) {
+                    options.onError?.(error, "Direct Runtime terminal peer activity check");
+                }
+                if (!active) {
+                    finishTerminal(connection, terminal, "unauthorized", undefined, true);
+                    connection.close(CLOSE_UNAUTHORIZED, "Remote Runtime grant is not active");
+                    return;
+                }
+                try {
+                    if (frame.type === "session.terminal.input") {
+                        if (terminal.attachment.role === "owner") {
+                            await terminal.attachment.write(Uint8Array.from(Buffer.from(frame.data, "base64")));
+                        }
+                    }
+                    else {
+                        await terminal.attachment.resize(frame.cols, frame.rows);
+                    }
+                }
+                catch (error) {
+                    options.onError?.(error, "Remote Session terminal control");
+                    finishTerminal(connection, terminal, "internal", "Remote Session terminal control failed", true);
+                }
+            });
+            terminal.controlTail = control.catch(() => undefined);
+            await control;
+            return;
+        }
+        let admissionFailure;
+        let pending;
+        if (connection.seenTerminalAttachmentIds.has(frame.attachmentId)) {
+            admissionFailure = "duplicate";
+        }
+        else if (connection.seenTerminalAttachmentIds.size >= limits.maxRequestIds) {
+            admissionFailure = "id_capacity";
+        }
+        else {
+            connection.seenTerminalAttachmentIds.add(frame.attachmentId);
+            if (connection.pendingTerminal || connection.terminal) {
+                admissionFailure = "attachment_capacity";
+            }
+            else {
+                pending = {
+                    attachmentId: frame.attachmentId,
+                    sessionId: frame.sessionId,
+                    abortController: new AbortController(),
+                    cancelRequested: false,
+                    closeFrameClaimed: false,
+                };
+                // Reserve the id before awaiting peer status or application open. A
+                // following close can now tombstone this pending attach and abort it.
+                connection.pendingTerminal = pending;
+            }
+        }
+        let active = false;
+        try {
+            active = await options.isPeerActive(peer);
+        }
+        catch (error) {
+            options.onError?.(error, "Direct Runtime terminal peer activity check");
+        }
+        if (!active) {
+            if (pending) {
+                connection.pendingTerminal = undefined;
+                pending.cancelRequested = true;
+                pending.abortController.abort(new Error("Remote Runtime grant is not active"));
+            }
+            if (!pending?.closeFrameClaimed) {
+                if (pending)
+                    pending.closeFrameClaimed = true;
+                await sendTerminalClosed(connection, frame.attachmentId, "unauthorized");
+            }
+            connection.close(CLOSE_UNAUTHORIZED, "Remote Runtime grant is not active");
+            return;
+        }
+        if (admissionFailure === "duplicate") {
+            await sendTerminalClosed(connection, frame.attachmentId, "capacity", "Remote Session terminal attachment id was already used");
+            return;
+        }
+        if (admissionFailure === "id_capacity") {
+            connection.close(CLOSE_CAPACITY, "Direct Runtime terminal id capacity reached");
+            return;
+        }
+        if (admissionFailure === "attachment_capacity") {
+            await sendTerminalClosed(connection, frame.attachmentId, "capacity", "Direct Runtime V1 admits one Session terminal per connection");
+            return;
+        }
+        if (!pending) {
+            connection.close(CLOSE_INTERNAL, "Remote Session pending terminal is unavailable");
+            return;
+        }
+        let opened;
+        try {
+            opened = await options.dispatcher.openSessionTerminal(frame.sessionId, { role: frame.role, cols: frame.cols, rows: frame.rows }, { subject: peer.subject, signal: pending.abortController.signal });
+        }
+        catch (error) {
+            if (connection.pendingTerminal === pending)
+                connection.pendingTerminal = undefined;
+            if (pending.cancelRequested) {
+                if (!pending.closeFrameClaimed && !isConnectionClosed(connection)) {
+                    pending.closeFrameClaimed = true;
+                    await sendTerminalClosed(connection, frame.attachmentId, "client_closed");
+                }
+                return;
+            }
+            options.onError?.(error, "Remote Session terminal open");
+            await sendTerminalClosed(connection, frame.attachmentId, remoteTerminalOpenCloseReason(error));
+            return;
+        }
+        if (pending.cancelRequested ||
+            isConnectionClosed(connection) ||
+            connection.pendingTerminal !== pending) {
+            if (connection.pendingTerminal === pending)
+                connection.pendingTerminal = undefined;
+            await opened.close().catch((error) => {
+                options.onError?.(error, "Remote Session late terminal detach");
+            });
+            if (!pending.closeFrameClaimed && !isConnectionClosed(connection)) {
+                pending.closeFrameClaimed = true;
+                await sendTerminalClosed(connection, frame.attachmentId, "client_closed");
+            }
+            return;
+        }
+        if (opened.sessionId !== frame.sessionId) {
+            connection.pendingTerminal = undefined;
+            await opened.close().catch(() => undefined);
+            connection.close(CLOSE_INTERNAL, "Remote Session terminal identity mismatch");
+            return;
+        }
+        const terminal = {
+            attachmentId: frame.attachmentId,
+            sessionId: frame.sessionId,
+            attachment: opened,
+            output: new BoundedTextQueue(limits.maxQueuedTerminalOutputFrames, limits.maxQueuedTerminalOutputBytes),
+            controlTail: Promise.resolve(),
+            finishing: false,
+        };
+        connection.pendingTerminal = undefined;
+        connection.terminal = terminal;
+        // Drain into the bounded application queue before awaiting the opened send;
+        // output can begin synchronously with the runner attach.
+        void readTerminalOutput(connection, terminal);
+        try {
+            await sendText(connection, encodeRemoteRuntimeSessionTerminalServerFrame({
+                type: "session.terminal.opened",
+                attachmentId: terminal.attachmentId,
+                sessionId: terminal.sessionId,
+                role: opened.role,
+            }), limits.maxBufferedBytes);
+            void writeTerminalOutput(connection, terminal);
+        }
+        catch (error) {
+            finishTerminal(connection, terminal, undefined, undefined, true);
+            throw error;
+        }
+    }
+    async function readTerminalOutput(connection, terminal) {
+        try {
+            for await (const data of terminal.attachment) {
+                if (terminal.finishing)
+                    return;
+                for (let offset = 0; offset < data.byteLength; offset += REMOTE_RUNTIME_SESSION_TERMINAL_MAX_DATA_BYTES) {
+                    const chunk = data.subarray(offset, Math.min(offset + REMOTE_RUNTIME_SESSION_TERMINAL_MAX_DATA_BYTES, data.byteLength));
+                    if (chunk.byteLength === 0)
+                        continue;
+                    const encoded = encodeRemoteRuntimeSessionTerminalServerFrame({
+                        type: "session.terminal.output",
+                        attachmentId: terminal.attachmentId,
+                        data: Buffer.from(chunk).toString("base64"),
+                    });
+                    if (!terminal.output.push(encoded)) {
+                        finishTerminal(connection, terminal, "backpressure", "Remote Session terminal consumer is too slow", true);
+                        return;
+                    }
+                }
+            }
+            if (terminal.finishing)
+                return;
+            const closed = await terminal.attachment.closed;
+            const reason = closed.reason === "terminal_exited"
+                ? "terminal_exited"
+                : closed.reason === "backpressure"
+                    ? "backpressure"
+                    : "internal";
+            finishTerminal(connection, terminal, reason, undefined, reason !== "terminal_exited", closed.exitCode);
+        }
+        catch (error) {
+            if (terminal.finishing)
+                return;
+            options.onError?.(error, "Remote Session terminal output");
+            finishTerminal(connection, terminal, "internal", "Remote Session terminal output failed", true);
+        }
+    }
+    async function writeTerminalOutput(connection, terminal) {
+        try {
+            for (;;) {
+                const frame = await terminal.output.shift();
+                if (frame === undefined)
+                    return;
+                await sendText(connection, frame, limits.maxBufferedBytes);
+            }
+        }
+        catch (error) {
+            if (!isConnectionClosed(connection)) {
+                options.onError?.(error, "Remote Session terminal delivery");
+                connection.close(CLOSE_INTERNAL, "Remote Session terminal delivery failed");
+            }
+        }
+        finally {
+            finishTerminal(connection, terminal, undefined, undefined, true);
+        }
+    }
+    function finishTerminal(connection, terminal, reason, message, discardPending, exitCode) {
+        if (terminal.finishing)
+            return;
+        terminal.finishing = true;
+        if (connection.terminal === terminal)
+            connection.terminal = undefined;
+        void terminal.attachment.close().catch((error) => {
+            options.onError?.(error, "Remote Session terminal detach");
+        });
+        const finalFrame = reason === undefined
+            ? undefined
+            : encodeRemoteRuntimeSessionTerminalServerFrame({
+                type: "session.terminal.closed",
+                attachmentId: terminal.attachmentId,
+                reason,
+                ...(exitCode === undefined ? {} : { exitCode }),
+                ...(message === undefined ? {} : { message }),
+            });
+        if (discardPending)
+            terminal.output.replaceAndFinish(finalFrame);
+        else
+            terminal.output.finish(finalFrame);
+    }
+    async function sendTerminalClosed(connection, attachmentId, reason, message) {
+        await sendText(connection, encodeRemoteRuntimeSessionTerminalServerFrame({
+            type: "session.terminal.closed",
+            attachmentId,
+            reason,
+            ...(message === undefined ? {} : { message }),
+        }), limits.maxBufferedBytes);
+    }
+    async function authenticateConnection(connection, bytes) {
+        if (!authenticationAttempts.tryConsume(connection.sourceAddress)) {
+            connection.close(CLOSE_CAPACITY, "Direct Runtime authentication attempt limit reached");
+            return;
+        }
+        let authenticate;
+        try {
+            const frame = decodeDirectRuntimeFrame(bytes);
+            if (frame.type !== "client.authenticate") {
+                throw new Error("first client frame must be client.authenticate");
+            }
+            authenticate = frame;
+        }
+        catch {
+            connection.close(CLOSE_BAD_PROTOCOL, "invalid Direct Runtime authentication frame");
+            return;
+        }
+        const serverHello = connection.serverHello;
+        const serverHelloBytes = connection.serverHelloBytes;
+        if (!serverHello || !serverHelloBytes) {
+            connection.close(CLOSE_INTERNAL, "Direct Runtime server hello is unavailable");
+            return;
+        }
+        connection.state = "authenticating";
+        try {
+            const channelBinding = connection.e2eeChannel?.channelBinding;
+            if (!channelBinding)
+                throw new Error("Direct Runtime E2EE channel is unavailable");
+            const result = await options.authenticator.authenticate({
+                channelBinding: new Uint8Array(channelBinding),
+                role: "control",
+                serverHello,
+                serverHelloBytes: new Uint8Array(serverHelloBytes),
+                clientAuthenticate: authenticate,
+                clientAuthenticateBytes: new Uint8Array(bytes),
+                signal: connection.abortController.signal,
+            });
+            if (connection.state !== "authenticating")
+                return;
+            const accepted = parseServerAccepted(result.accepted);
+            assertAuthenticationResult(serverHello, authenticate, result.peer, accepted);
+            connection.peer = result.peer;
+            const registration = connectionHub.registerWithinLimit(result.peer.grantId, connection, limits.maxConnectionsPerGrant);
+            if (registration === "revoked") {
+                connection.close(CLOSE_UNAUTHORIZED, "Remote Runtime grant is not active");
+                return;
+            }
+            if (registration === "capacity") {
+                connection.close(CLOSE_CAPACITY, "Remote Runtime grant connection capacity reached");
+                return;
+            }
+            const acceptedSend = sendText(connection, encodeDirectRuntimeFrame(accepted), limits.maxBufferedBytes);
+            // ws.send queues the accepted frame synchronously. Publish the authenticated
+            // state before its callback: a client may receive the frame and issue its
+            // first RPC before that local callback runs.
+            if (connection.state === "authenticating") {
+                connection.state = "authenticated";
+                releaseUnauthenticatedConnection(connection);
+                clearTimeout(connection.authenticationTimer);
+            }
+            await acceptedSend;
+        }
+        catch (error) {
+            if (isConnectionClosed(connection))
+                return;
+            options.onError?.(error, "client authentication");
+            connection.close(CLOSE_UNAUTHORIZED, "Direct Runtime authentication failed");
+        }
+    }
+    async function sendRpcError(connection, error) {
+        await sendText(connection, encodeRemoteRuntimeRpcResponse(error), limits.maxBufferedBytes);
+    }
+    function closeConnection(connection, code, reason) {
+        if (connection.state === "closing" || connection.state === "closed")
+            return;
+        connection.state = "closing";
+        clearTimeout(connection.authenticationTimer);
+        connection.abortController.abort(new Error(reason));
+        for (const pending of connection.pendingSessionSubscriptions.values()) {
+            abortPendingSessionSubscription(pending);
+        }
+        connection.pendingSessionSubscriptions.clear();
+        for (const subscription of [...connection.sessionSubscriptions.values()]) {
+            finishSessionSubscription(connection, subscription, undefined, undefined, true);
+        }
+        if (connection.pendingTerminal) {
+            connection.pendingTerminal.cancelRequested = true;
+            connection.pendingTerminal.abortController.abort(new Error(reason));
+            connection.pendingTerminal = undefined;
+        }
+        if (connection.terminal) {
+            finishTerminal(connection, connection.terminal, undefined, undefined, true);
+        }
+        finalizeConnectionEmulatorSurface(connection, reason);
+        if (connection.ws.readyState === WebSocket.OPEN) {
+            connection.ws.close(code, boundedCloseReason(reason));
+            connection.closeTimer = setTimeout(() => {
+                if (connection.ws.readyState !== WebSocket.CLOSED)
+                    connection.ws.terminate();
+            }, CONNECTION_CLOSE_DEADLINE_MS);
+            connection.closeTimer.unref?.();
+        }
+        else if (connection.ws.readyState !== WebSocket.CLOSED) {
+            connection.ws.terminate();
+        }
+    }
+    function cleanupConnection(connection) {
+        if (connection.cleaned)
+            return;
+        connection.cleaned = true;
+        connection.state = "closed";
+        clearTimeout(connection.authenticationTimer);
+        if (connection.closeTimer)
+            clearTimeout(connection.closeTimer);
+        connection.abortController.abort(new Error("Direct Runtime connection closed"));
+        for (const pending of connection.pendingSessionSubscriptions.values()) {
+            abortPendingSessionSubscription(pending);
+        }
+        connection.pendingSessionSubscriptions.clear();
+        for (const subscription of [...connection.sessionSubscriptions.values()]) {
+            finishSessionSubscription(connection, subscription, undefined, undefined, true);
+        }
+        if (connection.pendingTerminal) {
+            connection.pendingTerminal.cancelRequested = true;
+            connection.pendingTerminal.abortController.abort(new Error("Direct Runtime connection closed"));
+            connection.pendingTerminal = undefined;
+        }
+        if (connection.terminal) {
+            finishTerminal(connection, connection.terminal, undefined, undefined, true);
+        }
+        finalizeConnectionEmulatorSurface(connection, "Direct Runtime connection closed");
+        releaseUnauthenticatedConnection(connection);
+        connectionHub.unregister(connection);
+        allConnections.delete(connection);
+        if (allConnections.size === 0) {
+            for (const resolve of emptyWaiters)
+                resolve();
+            emptyWaiters.clear();
+        }
+    }
+    function finalizeConnectionEmulatorSurface(connection, reason) {
+        if (connection.pendingEmulatorSurface) {
+            connection.pendingEmulatorSurface.closeRequested = true;
+            connection.pendingEmulatorSurface.abortController.abort(new Error(reason));
+            connection.pendingEmulatorSurface = undefined;
+        }
+        if (connection.emulatorSurface) {
+            void finishEmulatorSurface(connection, connection.emulatorSurface);
+        }
+    }
+    function releaseUnauthenticatedConnection(connection) {
+        if (!connection.countedAsUnauthenticated)
+            return;
+        connection.countedAsUnauthenticated = false;
+        decrementCount(unauthenticatedConnectionsBySource, connection.sourceAddress);
+    }
+    await listen(server, options.port, host);
+    heartbeatTimer = setInterval(() => {
+        for (const connection of allConnections) {
+            const ws = connection.ws;
+            if (ws.readyState !== WebSocket.OPEN)
+                continue;
+            if (!liveWebSockets.has(ws)) {
+                // A graceful close can wait for the operating system's TCP timeout on
+                // a half-open route. Terminate so cleanup and reconnect can run now.
+                ws.terminate();
+                continue;
+            }
+            liveWebSockets.delete(ws);
+            try {
+                ws.ping();
+            }
+            catch {
+                ws.terminate();
+            }
+        }
+    }, limits.heartbeatIntervalMs);
+    heartbeatTimer.unref?.();
+    const managed = {
+        connectionHub,
+        get listening() {
+            return server.listening;
+        },
+        address: () => server.address(),
+        shutdown() {
+            if (shutdownPromise)
+                return shutdownPromise;
+            stopping = true;
+            shutdownPromise = shutdownDirectServer();
+            return shutdownPromise;
+        },
+    };
+    return managed;
+    async function shutdownDirectServer() {
+        if (heartbeatTimer) {
+            clearInterval(heartbeatTimer);
+            heartbeatTimer = undefined;
+        }
+        const deadline = Date.now() + limits.shutdownDeadlineMs;
+        const browserSurfaceClosed = browserSurfaceServer?.shutdown() ?? Promise.resolve();
+        const httpClosed = closeHttpServer(server);
+        const shutdownReason = new Error("Direct Runtime server is shutting down");
+        for (const controller of activeDispatchControllers)
+            controller.abort(shutdownReason);
+        for (const connection of [...allConnections]) {
+            connection.close(1001, "Direct Runtime server is shutting down");
+        }
+        // `stopping` is set synchronously before this function starts, and frame
+        // handlers recheck it immediately before dispatch. The snapshot therefore
+        // contains every application dispatch that shutdown must drain.
+        const drained = Promise.all([
+            httpClosed,
+            browserSurfaceClosed,
+            waitForConnectionsEmpty(allConnections, emptyWaiters),
+            Promise.allSettled([...activeDispatches]),
+        ]);
+        if (!(await settleBefore(drained, deadline))) {
+            for (const connection of [...allConnections])
+                connection.ws.terminate();
+            for (const socket of rawSockets)
+                socket.destroy();
+            server.closeAllConnections?.();
+            await settleBefore(drained, deadline + 250);
+        }
+        await settleBefore(closeWebSocketServer(wss), deadline + 250);
+    }
+}
+function parseAuthenticatedClientFrame(bytes) {
+    let value;
+    try {
+        const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+        value = JSON.parse(text);
+    }
+    catch {
+        throw new Error("Direct Runtime control frame must be valid UTF-8 JSON");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Direct Runtime control frame must be an object");
+    }
+    const record = value;
+    const type = record.type;
+    if (type === "rpc.request") {
+        try {
+            const frame = parseRemoteRuntimeRpcFrame(record);
+            if (frame.type !== "rpc.request")
+                throw new Error("client sent an RPC response");
+            return frame;
+        }
+        catch (error) {
+            const unknown = parseUnknownRpcRequestEnvelope(record);
+            if (unknown)
+                return unknown;
+            throw error;
+        }
+    }
+    if (type === "session.events.subscribe" || type === "session.events.cancel") {
+        const frame = parseRemoteRuntimeSessionEventsFrame(record);
+        if (frame.type !== "session.events.subscribe" && frame.type !== "session.events.cancel") {
+            throw new Error("client sent a Remote Session server frame");
+        }
+        return frame;
+    }
+    if (type === "session.terminal.open" ||
+        type === "session.terminal.input" ||
+        type === "session.terminal.resize" ||
+        type === "session.terminal.close") {
+        return parseRemoteRuntimeSessionTerminalClientFrame(record);
+    }
+    if (type === "emulator.surface.open" ||
+        type === "emulator.surface.frame.ack" ||
+        type === "emulator.surface.touch" ||
+        type === "emulator.surface.close") {
+        return parseRuntimeEmulatorSurfaceClientFrame(record);
+    }
+    throw new Error("unknown Direct Runtime control frame type");
+}
+/**
+ * Preserve additive method compatibility without weakening strict parsing for
+ * known methods. Only a bounded, syntactically safe request envelope reaches
+ * method_not_found; malformed ids, method names, or params remain fatal.
+ */
+function parseUnknownRpcRequestEnvelope(value) {
+    const id = value.id;
+    const method = value.method;
+    const params = value.params;
+    if (value.type !== "rpc.request" ||
+        Object.keys(value).some((key) => key !== "type" && key !== "id" && key !== "method" && key !== "params") ||
+        typeof id !== "string" ||
+        id.length === 0 ||
+        id.length > REMOTE_RUNTIME_RPC_MAX_ID_CHARS ||
+        !RPC_ENVELOPE_TOKEN_PATTERN.test(id) ||
+        typeof method !== "string" ||
+        method.length === 0 ||
+        method.length > MAX_RPC_METHOD_NAME_CHARS ||
+        !RPC_ENVELOPE_TOKEN_PATTERN.test(method) ||
+        Object.hasOwn(REMOTE_RUNTIME_RPC_METHOD_METADATA, method) ||
+        !params ||
+        typeof params !== "object" ||
+        Array.isArray(params)) {
+        return undefined;
+    }
+    return { type: "rpc.unknown_request", id, method };
+}
+function remoteSessionOpenCloseReason(error) {
+    if (!error || typeof error !== "object" || !("code" in error))
+        return "internal";
+    const code = error.code;
+    if (code === "unauthorized")
+        return "unauthorized";
+    if (code === "not_found" || code === "method_not_found")
+        return "not_found";
+    if (code === "capacity")
+        return "capacity";
+    return "internal";
+}
+function remoteTerminalOpenCloseReason(error) {
+    if (!error || typeof error !== "object" || !("code" in error))
+        return "internal";
+    const code = error.code;
+    if (code === "unauthorized")
+        return "unauthorized";
+    if (code === "not_live")
+        return "not_live";
+    if (code === "capacity")
+        return "capacity";
+    return "internal";
+}
+function emulatorSurfaceCloseReason(error) {
+    if (!error || typeof error !== "object")
+        return "internal";
+    const code = "code" in error ? error.code : undefined;
+    if (code === "binding_mismatch")
+        return "binding_changed";
+    if (code === "emulator_unavailable" || code === "device_not_found")
+        return "device_unavailable";
+    if (code === "unauthorized")
+        return "unauthorized";
+    if (code === "capacity")
+        return "capacity";
+    if (code === "unsupported")
+        return "unsupported";
+    return "internal";
+}
+/** One-reader queue with explicit frame and UTF-8 byte bounds. */
+class BoundedTextQueue {
+    maxItems;
+    maxBytes;
+    items = [];
+    queuedBytes = 0;
+    waiter;
+    finished = false;
+    constructor(maxItems, maxBytes) {
+        this.maxItems = maxItems;
+        this.maxBytes = maxBytes;
+    }
+    push(text) {
+        if (this.finished)
+            return false;
+        const bytes = Buffer.byteLength(text, "utf8");
+        if (this.waiter) {
+            const resolve = this.waiter;
+            this.waiter = undefined;
+            resolve(text);
+            return true;
+        }
+        if (this.items.length >= this.maxItems || this.queuedBytes + bytes > this.maxBytes) {
+            return false;
+        }
+        this.items.push({ text, bytes });
+        this.queuedBytes += bytes;
+        return true;
+    }
+    shift() {
+        const item = this.items.shift();
+        if (item) {
+            this.queuedBytes -= item.bytes;
+            return Promise.resolve(item.text);
+        }
+        if (this.finished)
+            return Promise.resolve(undefined);
+        return new Promise((resolve) => {
+            this.waiter = resolve;
+        });
+    }
+    finish(finalFrame) {
+        if (this.finished)
+            return;
+        this.finished = true;
+        if (finalFrame !== undefined) {
+            if (this.waiter) {
+                const resolve = this.waiter;
+                this.waiter = undefined;
+                resolve(finalFrame);
+            }
+            else {
+                const bytes = Buffer.byteLength(finalFrame, "utf8");
+                this.items.push({ text: finalFrame, bytes });
+                this.queuedBytes += bytes;
+            }
+            return;
+        }
+        if (this.waiter) {
+            const resolve = this.waiter;
+            this.waiter = undefined;
+            resolve(undefined);
+        }
+    }
+    replaceAndFinish(finalFrame) {
+        if (this.finished)
+            return;
+        this.items.length = 0;
+        this.queuedBytes = 0;
+        this.finish(finalFrame);
+    }
+}
+function assertAuthenticationResult(hello, authenticate, peer, accepted) {
+    if (hello.role !== "control" ||
+        authenticate.role !== "control" ||
+        accepted.role !== "control" ||
+        accepted.daemonId !== hello.daemonId ||
+        accepted.daemonInstanceId !== hello.daemonInstanceId ||
+        authenticate.daemonId !== hello.daemonId ||
+        authenticate.daemonInstanceId !== hello.daemonInstanceId ||
+        authenticate.coreProtocolVersion < hello.minimumCompatibleCoreVersion ||
+        authenticate.coreProtocolVersion > hello.coreProtocolVersion ||
+        accepted.coreProtocolVersion !== authenticate.coreProtocolVersion ||
+        accepted.clientId !== authenticate.clientId ||
+        accepted.clientId !== peer.clientId ||
+        accepted.grantId !== peer.grantId ||
+        peer.subject.subjectId.length === 0 ||
+        accepted.authorities.length !== peer.subject.effectiveAuthorities.length ||
+        accepted.authorities.some((authority, index) => authority !== peer.subject.effectiveAuthorities[index])) {
+        throw new Error("Direct Runtime authenticator returned an inconsistent identity");
+    }
+}
+function isConnectionClosed(connection) {
+    return connection.state === "closing" || connection.state === "closed";
+}
+async function sendText(connection, text, maxBufferedBytes) {
+    const channel = connection.e2eeChannel;
+    if (!channel) {
+        throw new Error("Direct Runtime E2EE channel is unavailable");
+    }
+    const encrypted = channel.seal(text);
+    await sendWireText(connection, encrypted, maxBufferedBytes);
+}
+async function sendPlainText(connection, text, maxBufferedBytes) {
+    await sendWireText(connection, text, maxBufferedBytes);
+}
+async function sendWireText(connection, text, maxBufferedBytes) {
+    if (connection.ws.readyState !== WebSocket.OPEN) {
+        throw new Error("Direct Runtime WebSocket is not open");
+    }
+    if (connection.ws.bufferedAmount + Buffer.byteLength(text, "utf8") > maxBufferedBytes) {
+        connection.close(CLOSE_CAPACITY, "Direct Runtime output buffer is full");
+        throw new Error("Direct Runtime output buffer is full");
+    }
+    await new Promise((resolve, reject) => {
+        connection.ws.send(text, { binary: false, compress: false }, (error) => {
+            if (error)
+                reject(error);
+            else
+                resolve();
+        });
+    });
+}
+function rawDataBytes(data) {
+    if (Buffer.isBuffer(data))
+        return Uint8Array.from(data);
+    if (data instanceof ArrayBuffer)
+        return new Uint8Array(data.slice(0));
+    if (Array.isArray(data))
+        return Uint8Array.from(Buffer.concat(data));
+    return Uint8Array.from(Buffer.from(data));
+}
+function decodeText(bytes) {
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+}
+function rejectUpgrade(socket, status, message) {
+    if (socket.destroyed)
+        return;
+    const body = `${message}\n`;
+    socket.end(`HTTP/1.1 ${status} ${httpStatusText(status)}\r\n` +
+        "Connection: close\r\n" +
+        "Content-Type: text/plain; charset=utf-8\r\n" +
+        `Content-Length: ${Buffer.byteLength(body, "utf8")}\r\n` +
+        "Cache-Control: no-store\r\n\r\n" +
+        body);
+}
+function httpStatusText(status) {
+    if (status === 400)
+        return "Bad Request";
+    if (status === 404)
+        return "Not Found";
+    return "Service Unavailable";
+}
+function boundedCloseReason(reason) {
+    if (Buffer.byteLength(reason, "utf8") <= 123)
+        return reason;
+    let bounded = "";
+    let bytes = 0;
+    for (const character of reason) {
+        const characterBytes = Buffer.byteLength(character, "utf8");
+        if (bytes + characterBytes > 123)
+            break;
+        bounded += character;
+        bytes += characterBytes;
+    }
+    return bounded;
+}
+function resolveLimits(input) {
+    const maxConnections = positiveInteger(input?.maxConnections, DEFAULT_MAX_CONNECTIONS);
+    const maxUnauthenticatedConnectionsPerSource = input?.maxUnauthenticatedConnectionsPerSource === undefined
+        ? Math.min(DEFAULT_MAX_UNAUTHENTICATED_CONNECTIONS_PER_SOURCE, maxConnections)
+        : positiveInteger(input.maxUnauthenticatedConnectionsPerSource, 1);
+    const maxConnectionsPerGrant = input?.maxConnectionsPerGrant === undefined
+        ? Math.min(DEFAULT_MAX_CONNECTIONS_PER_GRANT, maxConnections)
+        : positiveInteger(input.maxConnectionsPerGrant, 1);
+    if (maxUnauthenticatedConnectionsPerSource > maxConnections) {
+        throw new Error("Direct Runtime per-source unauthenticated limit must not exceed maxConnections");
+    }
+    if (maxConnectionsPerGrant > maxConnections) {
+        throw new Error("Direct Runtime per-grant limit must not exceed maxConnections");
+    }
+    return {
+        authenticationTimeoutMs: positiveInteger(input?.authenticationTimeoutMs, DEFAULT_AUTH_TIMEOUT_MS),
+        maxConnections,
+        maxUnauthenticatedConnectionsPerSource,
+        maxAuthenticationAttemptsPerSource: boundedPositiveInteger(input?.maxAuthenticationAttemptsPerSource, DEFAULT_MAX_AUTHENTICATION_ATTEMPTS_PER_SOURCE, 100_000),
+        authenticationAttemptWindowMs: boundedPositiveInteger(input?.authenticationAttemptWindowMs, DEFAULT_AUTHENTICATION_ATTEMPT_WINDOW_MS, 60 * 60_000),
+        maxTrackedAuthenticationSources: boundedPositiveInteger(input?.maxTrackedAuthenticationSources, DEFAULT_MAX_TRACKED_AUTHENTICATION_SOURCES, 65_536),
+        maxConnectionsPerGrant,
+        maxQueuedFrames: positiveInteger(input?.maxQueuedFrames, DEFAULT_MAX_QUEUED_FRAMES),
+        maxRequestIds: positiveInteger(input?.maxRequestIds, DEFAULT_MAX_REQUEST_IDS),
+        maxBufferedBytes: positiveInteger(input?.maxBufferedBytes, DEFAULT_MAX_BUFFERED_BYTES),
+        maxSessionSubscriptions: positiveInteger(input?.maxSessionSubscriptions, DEFAULT_MAX_SESSION_SUBSCRIPTIONS),
+        maxQueuedSessionEvents: positiveInteger(input?.maxQueuedSessionEvents, DEFAULT_MAX_QUEUED_SESSION_EVENTS),
+        maxQueuedSessionEventBytes: positiveInteger(input?.maxQueuedSessionEventBytes, DEFAULT_MAX_QUEUED_SESSION_EVENT_BYTES),
+        maxQueuedTerminalOutputFrames: positiveInteger(input?.maxQueuedTerminalOutputFrames, DEFAULT_MAX_QUEUED_TERMINAL_OUTPUT_FRAMES),
+        maxQueuedTerminalOutputBytes: positiveInteger(input?.maxQueuedTerminalOutputBytes, DEFAULT_MAX_QUEUED_TERMINAL_OUTPUT_BYTES),
+        heartbeatIntervalMs: boundedPositiveInteger(input?.heartbeatIntervalMs, DEFAULT_HEARTBEAT_INTERVAL_MS, 5 * 60_000),
+        shutdownDeadlineMs: positiveInteger(input?.shutdownDeadlineMs, DEFAULT_SHUTDOWN_DEADLINE_MS),
+    };
+}
+function positiveInteger(value, fallback) {
+    if (value === undefined)
+        return fallback;
+    if (!Number.isSafeInteger(value) || value <= 0) {
+        throw new Error("Direct Runtime limits must be positive safe integers");
+    }
+    return value;
+}
+function boundedPositiveInteger(value, fallback, maximum) {
+    const resolved = positiveInteger(value, fallback);
+    if (resolved > maximum) {
+        throw new Error(`Direct Runtime limit must not exceed ${maximum}`);
+    }
+    return resolved;
+}
+/** Fixed-window limiter keyed only by the real TCP peer address. */
+class SourceAuthenticationAttemptLimiter {
+    options;
+    entries = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    tryConsume(sourceAddress, now = Date.now()) {
+        const existing = this.entries.get(sourceAddress);
+        if (existing && now - existing.startedAt < this.options.windowMs) {
+            existing.attempts = Math.min(existing.attempts + 1, this.options.maxAttempts + 1);
+            // Refresh insertion order so bounded eviction prefers inactive sources.
+            this.entries.delete(sourceAddress);
+            this.entries.set(sourceAddress, existing);
+            return existing.attempts <= this.options.maxAttempts;
+        }
+        if (existing)
+            this.entries.delete(sourceAddress);
+        this.makeSpace(now);
+        this.entries.set(sourceAddress, { startedAt: now, attempts: 1 });
+        return true;
+    }
+    makeSpace(now) {
+        if (this.entries.size < this.options.maxSources)
+            return;
+        for (const [sourceAddress, entry] of this.entries) {
+            if (now - entry.startedAt >= this.options.windowMs) {
+                this.entries.delete(sourceAddress);
+            }
+        }
+        while (this.entries.size >= this.options.maxSources) {
+            const oldest = this.entries.keys().next().value;
+            if (oldest === undefined)
+                return;
+            this.entries.delete(oldest);
+        }
+    }
+}
+function socketSourceAddress(request) {
+    const address = request.socket.remoteAddress;
+    if (!address)
+        return "unknown";
+    return address.startsWith("::ffff:") ? address.slice("::ffff:".length) : address;
+}
+function incrementCount(counts, key) {
+    counts.set(key, (counts.get(key) ?? 0) + 1);
+}
+function decrementCount(counts, key) {
+    const current = counts.get(key);
+    if (current === undefined || current <= 1)
+        counts.delete(key);
+    else
+        counts.set(key, current - 1);
+}
+function listen(server, port, host) {
+    return new Promise((resolve, reject) => {
+        const onError = (error) => reject(error);
+        server.once("error", onError);
+        server.listen(port, host, () => {
+            server.removeListener("error", onError);
+            resolve();
+        });
+    });
+}
+function closeHttpServer(server) {
+    return new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error && error.code !== "ERR_SERVER_NOT_RUNNING")
+                reject(error);
+            else
+                resolve();
+        });
+    });
+}
+function closeWebSocketServer(server) {
+    return new Promise((resolve) => {
+        try {
+            server.close(() => resolve());
+        }
+        catch {
+            resolve();
+        }
+    });
+}
+function waitForConnectionsEmpty(connections, waiters) {
+    if (connections.size === 0)
+        return Promise.resolve();
+    return new Promise((resolve) => waiters.add(resolve));
+}
+async function settleBefore(promise, deadline) {
+    const remaining = Math.max(0, deadline - Date.now());
+    let timer;
+    const timedOut = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(false), remaining);
+        timer.unref?.();
+    });
+    const settled = promise.then(() => true, () => true);
+    const result = await Promise.race([settled, timedOut]);
+    if (timer)
+        clearTimeout(timer);
+    return result;
+}