@sema-agent/server 7.135.0 → 7.137.0

package/dist/broker/http1.js

@@ -0,0 +1,256 @@
+export const MAX_HEAD_BYTES = 16 * 1024;
+const CHUNK_LINE_MAX = 64;
+const PIECE_MAX = 64 * 1024;
+const HIGH_WATER = 1024 * 1024;
+export class WireError extends Error {
+    status;
+    rule;
+    constructor(status, rule) {
+        super(rule);
+        this.status = status;
+        this.rule = rule;
+    }
+}
+export class ByteReader {
+    stream;
+    bufs = [];
+    len = 0;
+    ended = false;
+    failure;
+    wake;
+    constructor(stream) {
+        this.stream = stream;
+        stream.on("data", (d) => {
+            this.bufs.push(d);
+            this.len += d.length;
+            if (this.len > HIGH_WATER)
+                stream.pause();
+            this.notify();
+        });
+        stream.on("end", () => {
+            this.ended = true;
+            this.notify();
+        });
+        stream.on("close", () => {
+            this.ended = true;
+            this.notify();
+        });
+        stream.on("error", (e) => {
+            this.failure = e;
+            this.notify();
+        });
+    }
+    notify() {
+        const w = this.wake;
+        this.wake = undefined;
+        w?.();
+    }
+    wait() {
+        return new Promise((r) => (this.wake = r));
+    }
+    take(n) {
+        const all = this.bufs.length === 1 ? this.bufs[0] : Buffer.concat(this.bufs);
+        const out = all.subarray(0, n);
+        const rest = all.subarray(n);
+        this.bufs = rest.length > 0 ? [rest] : [];
+        this.len = rest.length;
+        if (this.len < HIGH_WATER / 2 && this.stream.isPaused())
+            this.stream.resume();
+        return out;
+    }
+    async readUntil(delim, max) {
+        for (;;) {
+            const all = this.bufs.length === 1 ? this.bufs[0] : Buffer.concat(this.bufs);
+            this.bufs = all.length > 0 ? [all] : [];
+            const at = all.indexOf(delim, 0, "latin1");
+            if (at >= 0 && at + delim.length <= max)
+                return this.take(at + delim.length);
+            if (all.length > max)
+                throw new WireError(400, "a head or line is longer than allowed");
+            if (this.failure)
+                throw this.failure;
+            if (this.ended)
+                return undefined;
+            await this.wait();
+        }
+    }
+    async readSome(max) {
+        for (;;) {
+            if (this.len > 0)
+                return this.take(Math.min(max, this.len));
+            if (this.failure)
+                throw this.failure;
+            if (this.ended)
+                return undefined;
+            await this.wait();
+        }
+    }
+    async readExact(n) {
+        for (;;) {
+            if (this.len >= n)
+                return this.take(n);
+            if (this.failure)
+                throw this.failure;
+            if (this.ended)
+                throw new WireError(400, "the stream ended inside a declared body");
+            await this.wait();
+        }
+    }
+}
+const TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+const REQUEST_LINE = /^([!#$%&'*+.^_`|~0-9A-Za-z-]+) ([\x21-\x7e]+) HTTP\/1\.1$/;
+const STATUS_LINE = /^HTTP\/1\.[01] ([1-5][0-9]{2})(?: ([\t\x20-\x7e\x80-\xff]*))?$/;
+const FIELD_VALUE = /^[\t\x20-\x7e\x80-\xff]*$/;
+function splitHead(buf) {
+    const text = buf.subarray(0, buf.length - 4).toString("latin1");
+    const lines = text.split("\r\n");
+    for (const l of lines)
+        if (l.includes("\r") || l.includes("\n"))
+            throw new WireError(400, "a bare CR or LF in the head");
+    const [first, ...rest] = lines;
+    const headers = rest.map((line) => {
+        if (line.startsWith(" ") || line.startsWith("\t"))
+            throw new WireError(400, "a folded header line");
+        const c = line.indexOf(":");
+        const name = c > 0 ? line.slice(0, c) : "";
+        if (!TOKEN.test(name))
+            throw new WireError(400, "a header line without a token name");
+        const value = line.slice(c + 1).replace(/^[ \t]+|[ \t]+$/g, "");
+        if (!FIELD_VALUE.test(value))
+            throw new WireError(400, "a control character in a header value");
+        return [name.toLowerCase(), value];
+    });
+    return { first: first ?? "", headers };
+}
+export function parseRequestHead(buf) {
+    const { first, headers } = splitHead(buf);
+    const m = REQUEST_LINE.exec(first);
+    if (!m)
+        throw new WireError(400, "the request line is not `<method> <target> HTTP/1.1`");
+    return { method: m[1], target: m[2], headers };
+}
+export function parseResponseHead(buf) {
+    const { first, headers } = splitHead(buf);
+    const m = STATUS_LINE.exec(first);
+    if (!m)
+        throw new WireError(502, "the upstream status line is malformed");
+    return { status: Number(m[1]), reason: m[2] ?? "", headers };
+}
+export const valuesOf = (headers, name) => headers.filter(([n]) => n === name).map(([, v]) => v);
+export const ROUTE_PATH = /^\/o\/(0|[1-9][0-9]?)\/([A-Za-z0-9][A-Za-z0-9._-]{0,99})\/([A-Za-z0-9][A-Za-z0-9._-]{0,99})\/(info\/refs|git-upload-pack|git-receive-pack)$/;
+export const UPSTREAM_PATH = /^\/([A-Za-z0-9][A-Za-z0-9._-]{0,99})\/([A-Za-z0-9][A-Za-z0-9._-]{0,99})\/(info\/refs|git-upload-pack|git-receive-pack)$/;
+export const INFO_REFS_QUERIES = { "service=git-upload-pack": "git-upload-pack", "service=git-receive-pack": "git-receive-pack" };
+const PACK_CONTENT_TYPE = {
+    "git-upload-pack": "application/x-git-upload-pack-request",
+    "git-receive-pack": "application/x-git-receive-pack-request",
+};
+export const FORWARDED_REQUEST_HEADERS = new Set(["accept", "accept-encoding", "content-type", "content-encoding", "git-protocol", "user-agent", "pragma", "cache-control"]);
+export const FORWARDED_RESPONSE_HEADERS = new Set(["content-type", "content-encoding", "cache-control", "pragma", "expires", "date"]);
+const no = (rule, status = 400) => ({ ok: false, status, rule });
+export function judgeRequest(head, hasEntry) {
+    if (!head.target.startsWith("/"))
+        return no("the request target is not origin-form");
+    const q = head.target.indexOf("?");
+    const path = q < 0 ? head.target : head.target.slice(0, q);
+    const query = q < 0 ? undefined : head.target.slice(q + 1);
+    const m = ROUTE_PATH.exec(path);
+    if (!m)
+        return no("the path is not /o/<i>/<owner>/<repo>/<git endpoint> (raw, never decoded: no percent-escape)");
+    const i = Number(m[1]);
+    if (!hasEntry(i))
+        return no("the path names no configured origin");
+    const endpoint = m[4];
+    let service;
+    if (endpoint === "info/refs") {
+        if (head.method !== "GET")
+            return no("info/refs takes GET only");
+        service = query !== undefined && Object.hasOwn(INFO_REFS_QUERIES, query) ? INFO_REFS_QUERIES[query] : undefined;
+        if (service === undefined)
+            return no("info/refs takes exactly service=git-upload-pack or service=git-receive-pack");
+    }
+    else {
+        if (head.method !== "POST")
+            return no("a pack endpoint takes POST only");
+        if (query !== undefined)
+            return no("a pack endpoint takes no query");
+        const ct = valuesOf(head.headers, "content-type");
+        if (ct.length !== 1 || ct[0] !== PACK_CONTENT_TYPE[endpoint])
+            return no(`${endpoint} takes exactly one Content-Type: ${PACK_CONTENT_TYPE[endpoint]}`);
+    }
+    if (valuesOf(head.headers, "trailer").length > 0)
+        return no("a Trailer header");
+    const cl = valuesOf(head.headers, "content-length");
+    const te = valuesOf(head.headers, "transfer-encoding");
+    let framing;
+    if (head.method === "GET") {
+        if (te.length > 0)
+            return no("a GET with Transfer-Encoding");
+        if (cl.length > 1 || (cl.length === 1 && cl[0] !== "0"))
+            return no("a GET with a body");
+        framing = { kind: "none" };
+    }
+    else if (cl.length === 1 && te.length === 0 && /^[0-9]{1,15}$/.test(cl[0])) {
+        framing = { kind: "length", n: Number(cl[0]) };
+    }
+    else if (te.length === 1 && cl.length === 0 && te[0].toLowerCase() === "chunked") {
+        framing = { kind: "chunked" };
+    }
+    else {
+        return no("a POST needs exactly one Content-Length (one decimal) or exactly one Transfer-Encoding: chunked");
+    }
+    const expect = valuesOf(head.headers, "expect");
+    if (expect.length > 1 || (expect.length === 1 && expect[0].toLowerCase() !== "100-continue"))
+        return no("an Expect other than 100-continue", 417);
+    const ce = valuesOf(head.headers, "content-encoding");
+    if (ce.length > 1 || (ce.length === 1 && !["gzip", "identity"].includes(ce[0].toLowerCase())))
+        return no("Content-Encoding other than gzip / identity");
+    return { ok: true, route: { i, owner: m[2], repo: m[3], endpoint, ...(service !== undefined ? { service } : {}) }, framing, expectContinue: expect.length === 1 && framing.kind !== "none" };
+}
+export function judgeResponseFraming(head) {
+    if (head.status === 204 || head.status === 304)
+        return { kind: "none" };
+    const cl = valuesOf(head.headers, "content-length");
+    const te = valuesOf(head.headers, "transfer-encoding");
+    if (cl.length > 0 && te.length > 0)
+        return { problem: "the upstream response carries both Content-Length and Transfer-Encoding" };
+    if (cl.length > 1)
+        return { problem: "the upstream response repeats Content-Length" };
+    if (cl.length === 1)
+        return /^[0-9]{1,15}$/.test(cl[0]) ? { kind: "length", n: Number(cl[0]) } : { problem: "the upstream Content-Length is not one decimal" };
+    if (te.length > 1 || (te.length === 1 && te[0].toLowerCase() !== "chunked"))
+        return { problem: "the upstream Transfer-Encoding is not exactly chunked" };
+    return te.length === 1 ? { kind: "chunked" } : { kind: "close" };
+}
+export async function* readChunked(reader, trailers, failStatus) {
+    for (;;) {
+        const line = await reader.readUntil("\r\n", CHUNK_LINE_MAX);
+        if (line === undefined)
+            throw new WireError(failStatus, "the stream ended inside a chunked body");
+        const size = line.subarray(0, line.length - 2).toString("latin1");
+        if (!/^[0-9A-Fa-f]{1,8}$/.test(size))
+            throw new WireError(failStatus, "a malformed chunk-size line");
+        let left = parseInt(size, 16);
+        if (left === 0)
+            break;
+        while (left > 0) {
+            const piece = await reader.readSome(Math.min(left, PIECE_MAX));
+            if (piece === undefined)
+                throw new WireError(failStatus, "the stream ended inside a chunk");
+            left -= piece.length;
+            yield piece;
+        }
+        const crlf = await reader.readExact(2).catch(() => undefined);
+        if (crlf === undefined || crlf.toString("latin1") !== "\r\n")
+            throw new WireError(failStatus, "a chunk not followed by CRLF");
+    }
+    for (;;) {
+        const line = await reader.readUntil("\r\n", MAX_HEAD_BYTES);
+        if (line === undefined)
+            throw new WireError(failStatus, "the stream ended inside the trailer section");
+        if (line.length === 2)
+            return;
+        if (trailers === "refuse")
+            throw new WireError(failStatus, "a trailer field");
+    }
+}
+//# sourceMappingURL=http1.js.map

package/dist/broker/lease-book.d.ts

@@ -0,0 +1,87 @@
+/** The monotonic clock the law runs on (production: {@link systemMonotonicClock}; the pins drive a hand clock). */
+export interface MonotonicClock {
+    nowNs(): bigint;
+    setTimer(delayMs: number, fn: () => void): unknown;
+    clearTimer(handle: unknown): void;
+}
+export declare const systemMonotonicClock: MonotonicClock;
+/** One exchange the broker attached a credential to — cut by {@link AuthenticatedExchange.destroy} (both sockets, no graceful close). */
+export interface AuthenticatedExchange {
+    destroy(): void;
+}
+/** What the request path needs of an entry: where it goes and what to say when git must be told no. Never the credential. */
+export interface LeaseEntryView {
+    readonly origin: string;
+    readonly unusableMessage: string;
+    /** Present on a `ready` entry: the sentence for "the git host refused the credential we attached". */
+    readonly rejectedMessage?: string;
+}
+/** Log events of the book (closed set; no event carries a credential). */
+export type LeaseBookEvent = {
+    event: "lease_loaded";
+    i: number;
+    leaseId: string;
+    ttlMs: number;
+} | {
+    event: "lease_withdrawn";
+    i: number;
+    reason: string;
+    destroyed: number;
+} | {
+    event: "lease_expired";
+    i: number;
+    leaseId: string;
+    destroyed: number;
+} | {
+    event: "lease_rejected";
+    problem: string;
+    destroyed: number;
+};
+export declare class LeaseBook {
+    private readonly clock;
+    private readonly log;
+    /** The pinned origin table (set by the first good file). */
+    private table?;
+    /** Per entry: the last good file's entry (messages / origin answer even after the file went bad). */
+    private entries;
+    /** Per entry: the current ready lease, if any. */
+    private readonly current;
+    /** `stopAt` of every (entry, leaseId) ever seen — rule 1: a leaseId is armed once. */
+    private readonly seen;
+    /** Per entry: the exchanges holding its credential right now. */
+    private readonly held;
+    /** The last file parsed and passed rule 4. */
+    private good;
+    constructor(opts: {
+        clock: MonotonicClock;
+        log: (e: LeaseBookEvent) => void;
+    });
+    /** Load one lease file text. A refused file withdraws everything (rule 3) and leaves the pinned table as it was. */
+    load(text: string): {
+        ok: true;
+    } | {
+        ok: false;
+        problem: string;
+    };
+    /** The entry's route answer (origin + sentences), from the last good file; `undefined` for an index the pinned table does not have. */
+    view(i: number): LeaseEntryView | undefined;
+    /**
+     * Rule 2, and the hold of rule 3 in the same synchronous step: the entry usable ⇒ the `Authorization` value + a release, and `exchange` is
+     * now cut whenever the entry stops being usable; not usable ⇒ `undefined` (forward without a credential).
+     */
+    authorize(i: number, exchange: AuthenticatedExchange): {
+        authorization: string;
+        release(): void;
+    } | undefined;
+    /** Readiness: the last file parsed (and kept the pinned table) ∧ every ready entry's current lease has not reached `stopAt`. */
+    ready(): boolean;
+    private tableProblem;
+    private arm;
+    /** Every current lease whose stopAt has passed expires now (before anything new is installed or authorized). */
+    private expireDue;
+    private expire;
+    /** The entry has no lease any more: clear its timer, cut its exchanges. Returns how many were cut. */
+    private dropLease;
+    private cut;
+}
+//# sourceMappingURL=lease-book.d.ts.map

package/dist/broker/lease-book.js

@@ -0,0 +1,142 @@
+import { parseLeaseFile } from "./lease-file.js";
+export const systemMonotonicClock = {
+    nowNs: () => process.hrtime.bigint(),
+    setTimer: (delayMs, fn) => setTimeout(fn, delayMs),
+    clearTimer: (handle) => clearTimeout(handle),
+};
+const NS_PER_MS = 1000000n;
+export class LeaseBook {
+    clock;
+    log;
+    table;
+    entries = [];
+    current = new Map();
+    seen = new Map();
+    held = new Map();
+    good = false;
+    constructor(opts) {
+        this.clock = opts.clock;
+        this.log = opts.log;
+    }
+    load(text) {
+        this.expireDue();
+        const parsed = parseLeaseFile(text);
+        const problem = !parsed.ok ? parsed.problem : this.tableProblem(parsed.file.origins);
+        if (problem !== undefined || !parsed.ok) {
+            const why = problem ?? "unreadable";
+            this.good = false;
+            let destroyed = 0;
+            for (const i of [...this.current.keys()])
+                destroyed += this.dropLease(i);
+            this.log({ event: "lease_rejected", problem: why, destroyed });
+            return { ok: false, problem: why };
+        }
+        this.table ??= parsed.file.origins.map((e) => e.origin);
+        this.entries = [...parsed.file.origins];
+        this.good = true;
+        for (const entry of parsed.file.origins) {
+            if (entry.state === "withdrawn") {
+                if (this.current.has(entry.i))
+                    this.log({ event: "lease_withdrawn", i: entry.i, reason: entry.reason, destroyed: this.dropLease(entry.i) });
+                continue;
+            }
+            const key = `${entry.i}\u0000${entry.leaseId}`;
+            const known = this.seen.get(key);
+            const stopAt = known ?? this.clock.nowNs() + BigInt(entry.ttlMs) * NS_PER_MS;
+            if (known === undefined) {
+                this.seen.set(key, stopAt);
+                this.log({ event: "lease_loaded", i: entry.i, leaseId: entry.leaseId, ttlMs: entry.ttlMs });
+            }
+            const was = this.current.get(entry.i);
+            if (was !== undefined && was.entry.leaseId === entry.leaseId) {
+                was.entry = entry;
+                continue;
+            }
+            if (was?.timer !== undefined)
+                this.clock.clearTimer(was.timer);
+            const lease = { entry, stopAt };
+            this.current.set(entry.i, lease);
+            this.arm(entry.i, lease);
+        }
+        this.expireDue();
+        return { ok: true };
+    }
+    view(i) {
+        const e = this.entries[i];
+        if (e === undefined)
+            return undefined;
+        return e.state === "ready" ? { origin: e.origin, unusableMessage: e.unusableMessage, rejectedMessage: e.rejectedMessage } : { origin: e.origin, unusableMessage: e.unusableMessage };
+    }
+    authorize(i, exchange) {
+        this.expireDue();
+        const lease = this.good ? this.current.get(i) : undefined;
+        if (lease === undefined || this.clock.nowNs() >= lease.stopAt)
+            return undefined;
+        let set = this.held.get(i);
+        if (set === undefined)
+            this.held.set(i, (set = new Set()));
+        set.add(exchange);
+        const authorization = `Basic ${Buffer.from(`${lease.entry.username}:${lease.entry.secret}`, "utf8").toString("base64")}`;
+        return { authorization, release: () => void this.held.get(i)?.delete(exchange) };
+    }
+    ready() {
+        if (!this.good)
+            return false;
+        const now = this.clock.nowNs();
+        for (const e of this.entries) {
+            if (e.state !== "ready")
+                continue;
+            const lease = this.current.get(e.i);
+            if (lease === undefined || now >= lease.stopAt)
+                return false;
+        }
+        return true;
+    }
+    tableProblem(origins) {
+        if (this.table === undefined)
+            return undefined;
+        if (origins.length !== this.table.length || origins.some((e, i) => e.origin !== this.table[i])) {
+            return "the lease file's origin table differs from the one this pod was built with";
+        }
+        return undefined;
+    }
+    arm(i, lease) {
+        const leftMs = Number((lease.stopAt - this.clock.nowNs() + NS_PER_MS - 1n) / NS_PER_MS);
+        lease.timer = this.clock.setTimer(Math.max(0, leftMs), () => {
+            if (this.current.get(i) !== lease)
+                return;
+            if (this.clock.nowNs() < lease.stopAt)
+                return this.arm(i, lease);
+            this.expire(i, lease);
+        });
+    }
+    expireDue() {
+        const now = this.clock.nowNs();
+        for (const [i, lease] of [...this.current])
+            if (now >= lease.stopAt)
+                this.expire(i, lease);
+    }
+    expire(i, lease) {
+        if (lease.timer !== undefined)
+            this.clock.clearTimer(lease.timer);
+        this.current.delete(i);
+        this.log({ event: "lease_expired", i, leaseId: lease.entry.leaseId, destroyed: this.cut(i) });
+    }
+    dropLease(i) {
+        const lease = this.current.get(i);
+        if (lease?.timer !== undefined)
+            this.clock.clearTimer(lease.timer);
+        this.current.delete(i);
+        return this.cut(i);
+    }
+    cut(i) {
+        const set = this.held.get(i);
+        if (set === undefined)
+            return 0;
+        this.held.delete(i);
+        for (const x of set)
+            x.destroy();
+        return set.size;
+    }
+}
+//# sourceMappingURL=lease-book.js.map

package/dist/broker/lease-file.d.ts

@@ -0,0 +1,60 @@
+/**
+ * `broker.json` v1 — the lease file the server writes (the pod's lease Secret, `writeSandboxLease`) and the broker reads (its mounted
+ * volume). ONE parser for both sides: the server runs it on every file before sending it, the broker on every file it loads — a file one
+ * side would refuse is a file the other never sees.
+ *
+ * Shape (closed — any other key, any other value form is a refusal; server and broker are one build):
+ * `{ "v": 1, "origins": [ <entry i = 0>, <entry i = 1>, … ] }`, 1–16 entries, `i` = the entry's position, origins pairwise distinct and each
+ * exactly a URL origin (`scheme://host[:port]`: lower case, no default port, no path / query / userinfo — `new URL(o).origin === o`).
+ *  · `ready`: `leaseId` (fresh on every server write), `ttlMs` (integer, 0 < ttlMs ≤ {@link LEASE_TTL_MAX_MS}), `username` (no `:`),
+ *    `secret`, `credentialId`, `version`, `unusableMessage`, `rejectedMessage`. A `ready` entry is https — a credential never rides http.
+ *  · `withdrawn`: `reason` (a word), `unusableMessage`.
+ * Messages are single-line and at most {@link LEASE_MESSAGE_MAX_CHARS} characters (they go into git's `ERR` line and an HTTP body).
+ *
+ * A refusal names the key and the entry, never a value.
+ */
+export declare const LEASE_FILE_VERSION = 1;
+/** The longest lease the broker accepts (5 minutes, its own monotonic clock). */
+export declare const LEASE_TTL_MAX_MS = 300000;
+/** Origins one pod can be routed to. */
+export declare const LEASE_ORIGINS_MAX = 16;
+export declare const LEASE_MESSAGE_MAX_CHARS = 512;
+export interface ReadyLeaseEntry {
+    readonly i: number;
+    readonly origin: string;
+    readonly state: "ready";
+    readonly leaseId: string;
+    readonly ttlMs: number;
+    readonly username: string;
+    readonly secret: string;
+    readonly credentialId: string;
+    readonly version: number;
+    readonly unusableMessage: string;
+    readonly rejectedMessage: string;
+}
+export interface WithdrawnLeaseEntry {
+    readonly i: number;
+    readonly origin: string;
+    readonly state: "withdrawn";
+    readonly reason: string;
+    readonly unusableMessage: string;
+}
+export type LeaseEntry = ReadyLeaseEntry | WithdrawnLeaseEntry;
+export interface LeaseFile {
+    readonly v: typeof LEASE_FILE_VERSION;
+    readonly origins: readonly LeaseEntry[];
+}
+export type LeaseParse = {
+    readonly ok: true;
+    readonly file: LeaseFile;
+} | {
+    readonly ok: false;
+    readonly problem: string;
+};
+/** Parse and judge one lease file text. Never throws. */
+export declare function parseLeaseFile(text: string): LeaseParse;
+/** The file text the server sends (the same object a successful {@link parseLeaseFile} returns). */
+export declare function serializeLeaseFile(file: LeaseFile): string;
+/** Is `o` exactly a URL origin (the one form the file carries)? */
+export declare function isUrlOrigin(o: string): boolean;
+//# sourceMappingURL=lease-file.d.ts.map

package/dist/broker/lease-file.js

@@ -0,0 +1,127 @@
+export const LEASE_FILE_VERSION = 1;
+export const LEASE_TTL_MAX_MS = 300_000;
+export const LEASE_ORIGINS_MAX = 16;
+export const LEASE_MESSAGE_MAX_CHARS = 512;
+const READY_KEYS = ["i", "origin", "state", "leaseId", "ttlMs", "username", "secret", "credentialId", "version", "unusableMessage", "rejectedMessage"];
+const WITHDRAWN_KEYS = ["i", "origin", "state", "reason", "unusableMessage"];
+const LEASE_ID = /^[A-Za-z0-9_-]{1,128}$/;
+const REASON_WORD = /^[a-z][a-z0-9_]{0,63}$/;
+const CONTROL = /[\u0000-\u001f\u007f]/;
+class Refusal extends Error {
+}
+const refuse = (problem) => {
+    throw new Refusal(problem);
+};
+export function parseLeaseFile(text) {
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch (e) {
+        return { ok: false, problem: `the lease file is not JSON (${e instanceof Error ? e.name : "parse error"})` };
+    }
+    try {
+        return { ok: true, file: judgeFile(raw) };
+    }
+    catch (e) {
+        if (e instanceof Refusal)
+            return { ok: false, problem: e.message };
+        throw e;
+    }
+}
+export function serializeLeaseFile(file) {
+    return JSON.stringify(file);
+}
+export function isUrlOrigin(o) {
+    if (!URL.canParse(o))
+        return false;
+    const u = new URL(o);
+    return (u.protocol === "https:" || u.protocol === "http:") && u.origin === o;
+}
+function judgeFile(raw) {
+    const top = asRecord(raw, "the lease file");
+    exactKeys(top, ["v", "origins"], "the lease file");
+    if (top.v !== LEASE_FILE_VERSION)
+        refuse(`the lease file's \`v\` is not ${LEASE_FILE_VERSION}`);
+    const list = top.origins;
+    if (!Array.isArray(list) || list.length === 0 || list.length > LEASE_ORIGINS_MAX)
+        refuse(`\`origins\` must hold 1–${LEASE_ORIGINS_MAX} entries`);
+    const seen = new Set();
+    const origins = list.map((item, at) => {
+        const entry = judgeEntry(item, at);
+        if (seen.has(entry.origin))
+            refuse(`entry ${at}: its origin repeats an earlier entry's`);
+        seen.add(entry.origin);
+        return entry;
+    });
+    return { v: LEASE_FILE_VERSION, origins };
+}
+function judgeEntry(item, at) {
+    const where = `entry ${at}`;
+    const e = asRecord(item, where);
+    if (e.i !== at)
+        refuse(`${where}: \`i\` is not its position (${at})`);
+    if (typeof e.origin !== "string" || !isUrlOrigin(e.origin))
+        refuse(`${where}: \`origin\` is not exactly a URL origin (scheme://host[:port], lower case, no default port, no path)`);
+    const origin = e.origin;
+    const unusableMessage = message(e.unusableMessage, `${where}: \`unusableMessage\``);
+    switch (e.state) {
+        case "ready": {
+            exactKeys(e, READY_KEYS, where);
+            if (!origin.startsWith("https://"))
+                refuse(`${where}: a \`ready\` entry's origin must be https (a credential never rides plain http)`);
+            if (typeof e.leaseId !== "string" || !LEASE_ID.test(e.leaseId))
+                refuse(`${where}: \`leaseId\` is not 1–128 of [A-Za-z0-9_-]`);
+            if (typeof e.ttlMs !== "number" || !Number.isInteger(e.ttlMs) || e.ttlMs <= 0 || e.ttlMs > LEASE_TTL_MAX_MS)
+                refuse(`${where}: \`ttlMs\` is not an integer in (0, ${LEASE_TTL_MAX_MS}]`);
+            if (typeof e.username !== "string" || e.username === "" || e.username.includes(":") || CONTROL.test(e.username))
+                refuse(`${where}: \`username\` is not a non-empty string without \`:\` or control characters`);
+            if (typeof e.secret !== "string" || e.secret === "" || CONTROL.test(e.secret))
+                refuse(`${where}: \`secret\` is not a non-empty string without control characters`);
+            if (typeof e.credentialId !== "string")
+                refuse(`${where}: \`credentialId\` is not a string`);
+            if (typeof e.version !== "number" || !Number.isInteger(e.version) || e.version < 0)
+                refuse(`${where}: \`version\` is not a non-negative integer`);
+            return {
+                i: at,
+                origin,
+                state: "ready",
+                leaseId: e.leaseId,
+                ttlMs: e.ttlMs,
+                username: e.username,
+                secret: e.secret,
+                credentialId: e.credentialId,
+                version: e.version,
+                unusableMessage,
+                rejectedMessage: message(e.rejectedMessage, `${where}: \`rejectedMessage\``),
+            };
+        }
+        case "withdrawn":
+            exactKeys(e, WITHDRAWN_KEYS, where);
+            if (typeof e.reason !== "string" || !REASON_WORD.test(e.reason))
+                refuse(`${where}: \`reason\` is not a word`);
+            return { i: at, origin, state: "withdrawn", reason: e.reason, unusableMessage };
+        default:
+            return refuse(`${where}: \`state\` is neither "ready" nor "withdrawn"`);
+    }
+}
+function asRecord(v, where) {
+    if (typeof v !== "object" || v === null || Array.isArray(v))
+        refuse(`${where} is not an object`);
+    return v;
+}
+function exactKeys(o, keys, where) {
+    const allowed = new Set(keys);
+    for (const k of Object.keys(o))
+        if (!allowed.has(k))
+            refuse(`${where}: unknown key ${JSON.stringify(k.slice(0, 40))}`);
+    for (const k of keys)
+        if (!Object.hasOwn(o, k))
+            refuse(`${where}: missing key \`${k}\``);
+}
+function message(v, where) {
+    if (typeof v !== "string" || v === "" || v.length > LEASE_MESSAGE_MAX_CHARS || CONTROL.test(v))
+        refuse(`${where} is not a single-line string of 1–${LEASE_MESSAGE_MAX_CHARS} characters`);
+    return v;
+}
+//# sourceMappingURL=lease-file.js.map

package/dist/broker/main.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=main.d.ts.map