@series-inc/rundot-syncplay 5.23.0-beta.7

package/dist/cjs/local-authority-server-runner.js

@@ -0,0 +1,1121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDeterministicLocalAuthorityServerRunner = runDeterministicLocalAuthorityServerRunner;
+const node_http_1 = require("node:http");
+const canonical_js_1 = require("./canonical.js");
+const local_authority_js_1 = require("./local-authority.js");
+const commands_js_1 = require("./commands.js");
+const local_authority_wire_js_1 = require("./local-authority-wire.js");
+const lag_compensation3d_js_1 = require("./lag-compensation3d.js");
+const LOCAL_AUTHORITY_MAX_BODY_BYTES = 256 * 1024;
+async function runDeterministicLocalAuthorityServerRunner(options = {}) {
+    const players = options.players ?? 4;
+    const seed = options.seed ?? 71;
+    const frames = options.frames ?? 8;
+    const sessionConfig = createRunnerSessionConfig(options);
+    const sessionConfigHash = (0, canonical_js_1.defaultChecksum)({ kind: 'local-authority-runner-session-config', sessionConfig });
+    const runtime = (0, local_authority_js_1.createDeterministicLocalAuthorityRuntime)(players, {
+        maxFrameLead: sessionConfig.maxFrameLeadFrames,
+        rollbackWindowFrames: sessionConfig.rollbackWindowFrames,
+    });
+    const runnerAuth = createRunnerWireAuth(players, seed);
+    const server = createLocalAuthorityHttpServer(runtime, runnerAuth, sessionConfig);
+    const baseUrl = await listen(server);
+    let requests = 0;
+    let wireRequests = 0;
+    let wireInputEnvelopes = 0;
+    let wireCommandEnvelopes = 0;
+    let wireAckEnvelopes = 0;
+    let wireCorrectionEnvelopes = 0;
+    let wireSnapshotEnvelopes = 0;
+    let wireSnapshotRequestEnvelopes = 0;
+    let wireSnapshotOfferEnvelopes = 0;
+    let wireSnapshotChunkEnvelopes = 0;
+    let wireSnapshotCompleteEnvelopes = 0;
+    let wireAcceptedInputs = 0;
+    let wireRejectedInputs = 0;
+    let wireAcceptedCommands = 0;
+    let wireRejectedCommands = 0;
+    let wireSpectatorCommandsRejected = 0;
+    let wireAuthRejected = 0;
+    let wireAcksApplied = 0;
+    let wireCorrectionsApplied = 0;
+    let wireSnapshotsApplied = 0;
+    let wireSnapshotNegotiationCompletesApplied = 0;
+    let wireSnapshotChunkBytes = 0;
+    let commandEffectSubmissions = 0;
+    let commandEffectValue = 0;
+    let lagCompCommandSubmissions = 0;
+    let lagCompAcceptedShots = 0;
+    let lagCompHitCommands = 0;
+    let lagCompInvalidShotCommands = 0;
+    let lagCompForgedTimingRejected = 0;
+    let controlAuthRejected = 0;
+    let oversizedBodyRejected = 0;
+    let acceptedInputs = 0;
+    let rejectedInputs = 0;
+    let loadSubmissions = 0;
+    let disconnects = 0;
+    let reconnects = 0;
+    let lateJoins = 0;
+    let spectators = 0;
+    try {
+        const first = await postControl(baseUrl, runnerAuth, '/input', { slot: 0, frame: 0, value: seed, delay: 1 + sessionConfig.inputDelayFrames });
+        requests += 1;
+        acceptedInputs += first.accepted === true ? 1 : 0;
+        const second = await postControl(baseUrl, runnerAuth, '/input', { slot: 1, frame: 0, value: seed + 2, delay: 2 + sessionConfig.inputDelayFrames });
+        requests += 1;
+        acceptedInputs += second.accepted === true ? 1 : 0;
+        await postControl(baseUrl, runnerAuth, '/disconnect', { slot: 2 });
+        requests += 1;
+        disconnects += 1;
+        const disconnected = await postControl(baseUrl, runnerAuth, '/input', { slot: 2, frame: 0, value: seed + 4 });
+        requests += 1;
+        rejectedInputs += disconnected.accepted === false ? 1 : 0;
+        await postControl(baseUrl, runnerAuth, '/step', { frames: 1 });
+        requests += 1;
+        const snapshot = (await getControl(baseUrl, runnerAuth, '/snapshot')).snapshot;
+        requests += 1;
+        if (snapshot === undefined) {
+            throw new Error('snapshot endpoint did not return a snapshot');
+        }
+        controlAuthRejected += await probeControlBypass(baseUrl, snapshot);
+        requests += 4;
+        oversizedBodyRejected += await probeOversizedBody(baseUrl, runnerAuth);
+        requests += 1;
+        await postControl(baseUrl, runnerAuth, '/reconnect', { slot: 2 });
+        requests += 1;
+        reconnects += 1;
+        await postControl(baseUrl, runnerAuth, '/late-join', { slot: 2 });
+        requests += 1;
+        lateJoins += 1;
+        const lateJoinInput = await postControl(baseUrl, runnerAuth, '/input', { slot: 2, frame: 1, value: seed + 6, delay: 0 });
+        requests += 1;
+        acceptedInputs += lateJoinInput.accepted === true ? 1 : 0;
+        await postControl(baseUrl, runnerAuth, '/spectator', { slot: 3 });
+        requests += 1;
+        spectators += 1;
+        const spectatorInput = await postControl(baseUrl, runnerAuth, '/input', { slot: 3, frame: 1, value: seed + 8 });
+        requests += 1;
+        rejectedInputs += spectatorInput.accepted === false ? 1 : 0;
+        const earlyResync = await driveAuthorityWireResync(baseUrl, runtime, players, seed, frames * 4 + 1_000, runnerAuth, sessionConfig, true, false);
+        requests += earlyResync.requests;
+        wireRequests += earlyResync.wireRequests;
+        wireAckEnvelopes += earlyResync.wireAckEnvelopes;
+        wireCorrectionEnvelopes += earlyResync.wireCorrectionEnvelopes;
+        wireSnapshotEnvelopes += earlyResync.wireSnapshotEnvelopes;
+        wireSnapshotRequestEnvelopes += earlyResync.wireSnapshotRequestEnvelopes;
+        wireSnapshotOfferEnvelopes += earlyResync.wireSnapshotOfferEnvelopes;
+        wireSnapshotChunkEnvelopes += earlyResync.wireSnapshotChunkEnvelopes;
+        wireSnapshotCompleteEnvelopes += earlyResync.wireSnapshotCompleteEnvelopes;
+        wireAcksApplied += earlyResync.wireAcksApplied;
+        wireCorrectionsApplied += earlyResync.wireCorrectionsApplied;
+        wireSnapshotsApplied += earlyResync.wireSnapshotsApplied;
+        wireSnapshotNegotiationCompletesApplied += earlyResync.wireSnapshotNegotiationCompletesApplied;
+        wireSnapshotChunkBytes += earlyResync.wireSnapshotChunkBytes;
+        wireAuthRejected += earlyResync.wireAuthRejected;
+        const load = await driveAuthorityWireLoad(baseUrl, players, frames, seed, 2, new Set([3]), runnerAuth, sessionConfig);
+        requests += load.requests;
+        wireRequests += load.wireRequests;
+        wireInputEnvelopes += load.wireInputEnvelopes;
+        wireCommandEnvelopes += load.wireCommandEnvelopes;
+        wireAcceptedInputs += load.wireAcceptedInputs;
+        wireRejectedInputs += load.wireRejectedInputs;
+        wireAcceptedCommands += load.wireAcceptedCommands;
+        wireRejectedCommands += load.wireRejectedCommands;
+        wireSpectatorCommandsRejected += load.wireSpectatorCommandsRejected;
+        wireAuthRejected += load.wireAuthRejected;
+        commandEffectSubmissions += load.commandEffectSubmissions;
+        commandEffectValue += load.commandEffectValue;
+        lagCompCommandSubmissions += load.lagCompCommandSubmissions;
+        lagCompAcceptedShots += load.lagCompAcceptedShots;
+        lagCompHitCommands += load.lagCompHitCommands;
+        lagCompInvalidShotCommands += load.lagCompInvalidShotCommands;
+        lagCompForgedTimingRejected += load.lagCompForgedTimingRejected;
+        acceptedInputs += load.wireAcceptedInputs;
+        loadSubmissions += load.loadSubmissions;
+        const resync = await driveAuthorityWireResync(baseUrl, runtime, players, seed, frames * 4 + 2_000, runnerAuth, sessionConfig, false, true);
+        requests += resync.requests;
+        wireRequests += resync.wireRequests;
+        wireAckEnvelopes += resync.wireAckEnvelopes;
+        wireCorrectionEnvelopes += resync.wireCorrectionEnvelopes;
+        wireSnapshotEnvelopes += resync.wireSnapshotEnvelopes;
+        wireSnapshotRequestEnvelopes += resync.wireSnapshotRequestEnvelopes;
+        wireSnapshotOfferEnvelopes += resync.wireSnapshotOfferEnvelopes;
+        wireSnapshotChunkEnvelopes += resync.wireSnapshotChunkEnvelopes;
+        wireSnapshotCompleteEnvelopes += resync.wireSnapshotCompleteEnvelopes;
+        wireAcksApplied += resync.wireAcksApplied;
+        wireCorrectionsApplied += resync.wireCorrectionsApplied;
+        wireSnapshotsApplied += resync.wireSnapshotsApplied;
+        wireSnapshotNegotiationCompletesApplied += resync.wireSnapshotNegotiationCompletesApplied;
+        wireSnapshotChunkBytes += resync.wireSnapshotChunkBytes;
+        wireAuthRejected += resync.wireAuthRejected;
+        const before = await getRequiredChecksums(baseUrl, runnerAuth);
+        requests += 1;
+        await postControl(baseUrl, runnerAuth, '/restore', { snapshot });
+        requests += 1;
+        await postControl(baseUrl, runnerAuth, '/reconnect', { slot: 2 });
+        requests += 1;
+        await postControl(baseUrl, runnerAuth, '/late-join', { slot: 2 });
+        requests += 1;
+        const replayedLateJoinInput = await postControl(baseUrl, runnerAuth, '/input', { slot: 2, frame: 1, value: seed + 6, delay: 0 });
+        requests += 1;
+        acceptedInputs += replayedLateJoinInput.accepted === true ? 1 : 0;
+        await postControl(baseUrl, runnerAuth, '/spectator', { slot: 3 });
+        requests += 1;
+        const replayedSpectatorInput = await postControl(baseUrl, runnerAuth, '/input', { slot: 3, frame: 1, value: seed + 8 });
+        requests += 1;
+        rejectedInputs += replayedSpectatorInput.accepted === false ? 1 : 0;
+        const replayedEarlyResync = await driveAuthorityWireResync(baseUrl, runtime, players, seed, frames * 4 + 10_000, runnerAuth, sessionConfig, true, false);
+        requests += replayedEarlyResync.requests;
+        wireRequests += replayedEarlyResync.wireRequests;
+        wireAckEnvelopes += replayedEarlyResync.wireAckEnvelopes;
+        wireCorrectionEnvelopes += replayedEarlyResync.wireCorrectionEnvelopes;
+        wireSnapshotEnvelopes += replayedEarlyResync.wireSnapshotEnvelopes;
+        wireSnapshotRequestEnvelopes += replayedEarlyResync.wireSnapshotRequestEnvelopes;
+        wireSnapshotOfferEnvelopes += replayedEarlyResync.wireSnapshotOfferEnvelopes;
+        wireSnapshotChunkEnvelopes += replayedEarlyResync.wireSnapshotChunkEnvelopes;
+        wireSnapshotCompleteEnvelopes += replayedEarlyResync.wireSnapshotCompleteEnvelopes;
+        wireAcksApplied += replayedEarlyResync.wireAcksApplied;
+        wireCorrectionsApplied += replayedEarlyResync.wireCorrectionsApplied;
+        wireSnapshotsApplied += replayedEarlyResync.wireSnapshotsApplied;
+        wireSnapshotNegotiationCompletesApplied += replayedEarlyResync.wireSnapshotNegotiationCompletesApplied;
+        wireSnapshotChunkBytes += replayedEarlyResync.wireSnapshotChunkBytes;
+        wireAuthRejected += replayedEarlyResync.wireAuthRejected;
+        const replayedLoad = await driveAuthorityWireLoad(baseUrl, players, frames, seed, 2, new Set([3]), runnerAuth, sessionConfig);
+        requests += replayedLoad.requests;
+        wireRequests += replayedLoad.wireRequests;
+        wireInputEnvelopes += replayedLoad.wireInputEnvelopes;
+        wireCommandEnvelopes += replayedLoad.wireCommandEnvelopes;
+        wireAcceptedInputs += replayedLoad.wireAcceptedInputs;
+        wireRejectedInputs += replayedLoad.wireRejectedInputs;
+        wireAcceptedCommands += replayedLoad.wireAcceptedCommands;
+        wireRejectedCommands += replayedLoad.wireRejectedCommands;
+        wireSpectatorCommandsRejected += replayedLoad.wireSpectatorCommandsRejected;
+        wireAuthRejected += replayedLoad.wireAuthRejected;
+        commandEffectSubmissions += replayedLoad.commandEffectSubmissions;
+        commandEffectValue += replayedLoad.commandEffectValue;
+        lagCompCommandSubmissions += replayedLoad.lagCompCommandSubmissions;
+        lagCompAcceptedShots += replayedLoad.lagCompAcceptedShots;
+        lagCompHitCommands += replayedLoad.lagCompHitCommands;
+        lagCompInvalidShotCommands += replayedLoad.lagCompInvalidShotCommands;
+        lagCompForgedTimingRejected += replayedLoad.lagCompForgedTimingRejected;
+        acceptedInputs += replayedLoad.wireAcceptedInputs;
+        loadSubmissions += replayedLoad.loadSubmissions;
+        const replayedResync = await driveAuthorityWireResync(baseUrl, runtime, players, seed, frames * 4 + 11_000, runnerAuth, sessionConfig, false, true);
+        requests += replayedResync.requests;
+        wireRequests += replayedResync.wireRequests;
+        wireAckEnvelopes += replayedResync.wireAckEnvelopes;
+        wireCorrectionEnvelopes += replayedResync.wireCorrectionEnvelopes;
+        wireSnapshotEnvelopes += replayedResync.wireSnapshotEnvelopes;
+        wireSnapshotRequestEnvelopes += replayedResync.wireSnapshotRequestEnvelopes;
+        wireSnapshotOfferEnvelopes += replayedResync.wireSnapshotOfferEnvelopes;
+        wireSnapshotChunkEnvelopes += replayedResync.wireSnapshotChunkEnvelopes;
+        wireSnapshotCompleteEnvelopes += replayedResync.wireSnapshotCompleteEnvelopes;
+        wireAcksApplied += replayedResync.wireAcksApplied;
+        wireCorrectionsApplied += replayedResync.wireCorrectionsApplied;
+        wireSnapshotsApplied += replayedResync.wireSnapshotsApplied;
+        wireSnapshotNegotiationCompletesApplied += replayedResync.wireSnapshotNegotiationCompletesApplied;
+        wireSnapshotChunkBytes += replayedResync.wireSnapshotChunkBytes;
+        wireAuthRejected += replayedResync.wireAuthRejected;
+        const after = await getRequiredChecksums(baseUrl, runnerAuth);
+        requests += 1;
+        const beforeMigrationChecksum = (0, canonical_js_1.defaultChecksum)(before);
+        const afterMigrationChecksum = (0, canonical_js_1.defaultChecksum)(after);
+        const failures = [
+            acceptedInputs < 4 ? 'accepted input coverage missing' : '',
+            loadSubmissions < (players - 1) * frames * 2 ? '128-player load coverage missing' : '',
+            wireRequests <= 0 || wireInputEnvelopes < (players - 1) * frames * 2 ? 'typed wire input coverage missing' : '',
+            wireCommandEnvelopes < frames * 2 ? 'typed wire command coverage missing' : '',
+            wireAcceptedCommands < frames * 2 ? 'typed wire command acceptance missing' : '',
+            wireRejectedCommands < 2 ? 'typed wire command rejection missing' : '',
+            wireSpectatorCommandsRejected < 2 ? 'typed wire spectator command rejection missing' : '',
+            wireAuthRejected < 2 ? 'typed wire auth rejection missing' : '',
+            wireAckEnvelopes < 2 || wireAcksApplied < 2 ? 'typed wire ack coverage missing' : '',
+            wireCorrectionEnvelopes < 2 || wireCorrectionsApplied < 2 ? 'typed wire correction coverage missing' : '',
+            wireSnapshotEnvelopes < 2 || wireSnapshotsApplied < 4 ? 'typed wire snapshot coverage missing' : '',
+            wireSnapshotRequestEnvelopes < 2 ? 'typed wire snapshot request coverage missing' : '',
+            wireSnapshotOfferEnvelopes < 2 ? 'typed wire snapshot offer coverage missing' : '',
+            wireSnapshotChunkEnvelopes < 2 || wireSnapshotChunkBytes <= 0 ? 'typed wire snapshot chunk coverage missing' : '',
+            wireSnapshotCompleteEnvelopes < 2 || wireSnapshotNegotiationCompletesApplied < 2 ? 'typed wire snapshot completion coverage missing' : '',
+            commandEffectSubmissions < frames * 2 ? 'command effects did not execute through checksummed server projection' : '',
+            commandEffectValue <= 0 ? 'command effect value coverage missing' : '',
+            after.commandEffectSubmissions < frames ? 'replayed command effects missing from final projection' : '',
+            after.commandEffectValue <= 0 ? 'replayed command effect value missing from final projection' : '',
+            before.commandEffectProjectionChecksum !== after.commandEffectProjectionChecksum ? 'command effect projection checksum mismatch after restore/replay' : '',
+            after.combinedConvergence !== true ? 'combined command-effect projection did not converge' : '',
+            lagCompCommandSubmissions < frames * 2 ? 'lag compensated shot commands did not execute through authority command path' : '',
+            lagCompAcceptedShots < frames * 2 ? 'lag compensated shot command acceptance coverage missing' : '',
+            lagCompHitCommands < frames * 2 ? 'lag compensated shot command hit coverage missing' : '',
+            lagCompInvalidShotCommands < 2 ? 'lag compensated forged timing rejection coverage missing' : '',
+            lagCompForgedTimingRejected < 2 ? 'lag compensated forged command rejection coverage missing' : '',
+            after.lagCompCommandSubmissions < frames ? 'replayed lag compensated shot commands missing from final projection' : '',
+            before.lagCompReplayChecksum !== after.lagCompReplayChecksum ? 'lag compensated command replay checksum mismatch after restore/replay' : '',
+            after.lagCompRollbackEquivalent !== true ? 'lag compensated command rollback equivalence missing' : '',
+            controlAuthRejected < 6 ? 'control endpoint auth rejection missing' : '',
+            oversizedBodyRejected < 1 ? 'oversized request body rejection missing' : '',
+            rejectedInputs < 3 ? 'hostile/rejected input coverage missing' : '',
+            disconnects !== 1 ? 'disconnect coverage missing' : '',
+            reconnects !== 1 ? 'reconnect coverage missing' : '',
+            lateJoins !== 1 ? 'late join coverage missing' : '',
+            spectators !== 1 ? 'spectator coverage missing' : '',
+            beforeMigrationChecksum !== afterMigrationChecksum ? 'migration checksum mismatch' : '',
+            after.convergence !== true ? 'authority/client projection did not converge' : '',
+        ].filter((failure) => failure.length > 0);
+        const proof = {
+            serverEvaluated: true,
+            players,
+            seed,
+            frames,
+            sessionConfigHash,
+            rollbackWindowFrames: sessionConfig.rollbackWindowFrames,
+            maxFrameLeadFrames: sessionConfig.maxFrameLeadFrames,
+            checksumIntervalFrames: sessionConfig.checksumIntervalFrames,
+            inputDelayFrames: sessionConfig.inputDelayFrames,
+            sendRedundancy: sessionConfig.sendRedundancy,
+            snapshotMaxAgeFrames: sessionConfig.snapshotMaxAgeFrames,
+            requests,
+            typedWireProtocolEvaluated: true,
+            wireRequests,
+            wireInputEnvelopes,
+            wireCommandEnvelopes,
+            wireAckEnvelopes,
+            wireCorrectionEnvelopes,
+            wireSnapshotEnvelopes,
+            wireSnapshotRequestEnvelopes,
+            wireSnapshotOfferEnvelopes,
+            wireSnapshotChunkEnvelopes,
+            wireSnapshotCompleteEnvelopes,
+            wireAcceptedInputs,
+            wireRejectedInputs,
+            wireAcceptedCommands,
+            wireRejectedCommands,
+            wireSpectatorCommandsRejected,
+            wireAuthRejected,
+            wireAcksApplied,
+            wireCorrectionsApplied,
+            wireSnapshotsApplied,
+            wireSnapshotNegotiationCompletesApplied,
+            wireSnapshotChunkBytes,
+            commandEffectSubmissions,
+            commandEffectValue,
+            commandEffectChecksum: after.commandEffectChecksum,
+            commandEffectProjectionChecksum: after.commandEffectProjectionChecksum,
+            lagCompCommandSubmissions,
+            lagCompAcceptedShots,
+            lagCompHitCommands,
+            lagCompInvalidShotCommands,
+            lagCompForgedTimingRejected,
+            lagCompReplayChecksum: after.lagCompReplayChecksum,
+            lagCompRestoredChecksum: before.lagCompReplayChecksum,
+            lagCompRollbackEquivalent: after.lagCompRollbackEquivalent,
+            controlAuthRejected,
+            oversizedBodyRejected,
+            acceptedInputs,
+            rejectedInputs,
+            loadSubmissions,
+            loadedSlots: players - 1,
+            disconnects,
+            reconnects,
+            lateJoins,
+            spectators,
+            migrationRestored: beforeMigrationChecksum === afterMigrationChecksum,
+            convergence: after.convergence,
+            beforeMigrationChecksum,
+            afterMigrationChecksum,
+            authorityProjectionChecksum: after.authorityProjectionChecksum,
+            clientProjectionChecksum: after.clientProjectionChecksum,
+        };
+        return {
+            result: failures.length === 0 ? 'pass' : 'fail',
+            ...proof,
+            proofHash: (0, canonical_js_1.defaultChecksum)(proof),
+            failures,
+        };
+    }
+    finally {
+        await close(server);
+    }
+}
+async function driveAuthorityWireLoad(baseUrl, players, frames, seed, startFrame, spectatorSlots, auth, sessionConfig) {
+    let requests = 0;
+    let wireRequests = 0;
+    let wireInputEnvelopes = 0;
+    let wireCommandEnvelopes = 0;
+    let wireAcceptedInputs = 0;
+    let wireRejectedInputs = 0;
+    let wireAcceptedCommands = 0;
+    let wireRejectedCommands = 0;
+    let wireSpectatorCommandsRejected = 0;
+    let wireAuthRejected = 0;
+    let commandEffectSubmissions = 0;
+    let commandEffectValue = 0;
+    let lagCompCommandSubmissions = 0;
+    let lagCompAcceptedShots = 0;
+    let lagCompHitCommands = 0;
+    let lagCompInvalidShotCommands = 0;
+    let lagCompForgedTimingRejected = 0;
+    let loadSubmissions = 0;
+    for (let offset = 0; offset < frames; offset += 1) {
+        const frame = startFrame + offset;
+        for (let slot = 0; slot < players; slot += 1) {
+            if (spectatorSlots.has(slot)) {
+                continue;
+            }
+            const applied = await postWire(baseUrl, slot, (0, local_authority_wire_js_1.createDeterministicLocalAuthorityInputBundleEnvelope)(offset * 2, [{
+                    slot,
+                    frame,
+                    value: seed + frame * 17 + slot,
+                    delay: sessionConfig.inputDelayFrames + (slot % Math.max(1, sessionConfig.sendRedundancy + 2)),
+                    inputId: `wire-input-${slot}-${frame}`,
+                }], runnerSlotSign(auth, slot)));
+            requests += 1;
+            wireRequests += 1;
+            wireInputEnvelopes += 1;
+            wireAcceptedInputs += applied.wire?.accepted ?? 0;
+            wireRejectedInputs += applied.wire?.rejected ?? 0;
+            if ((applied.wire?.accepted ?? 0) === 1) {
+                loadSubmissions += 1;
+            }
+        }
+        const command = await postWire(baseUrl, 0, (0, local_authority_wire_js_1.createDeterministicLocalAuthorityCommandBundleEnvelope)(offset * 2 + 1, [{
+                id: `wire-command:${frame}`,
+                slot: 0,
+                frame,
+                channelId: 'runner-ability',
+                payload: { assetRef: 'runner.ability', frame },
+                predicted: true,
+            }], runnerSlotSign(auth, 0)));
+        requests += 1;
+        wireRequests += 1;
+        wireCommandEnvelopes += 1;
+        wireAcceptedCommands += command.wire?.accepted ?? 0;
+        wireRejectedCommands += command.wire?.rejected ?? 0;
+        commandEffectSubmissions += command.wire?.commandEffects ?? 0;
+        commandEffectValue += command.wire?.commandEffectValue ?? 0;
+        lagCompCommandSubmissions += command.wire?.lagCompCommandSubmissions ?? 0;
+        lagCompAcceptedShots += command.wire?.lagCompAcceptedShots ?? 0;
+        lagCompHitCommands += command.wire?.lagCompHitCommands ?? 0;
+        lagCompInvalidShotCommands += command.wire?.lagCompInvalidShotCommands ?? 0;
+        lagCompForgedTimingRejected += command.wire?.lagCompForgedTimingRejected ?? 0;
+        const lagShot = await postWire(baseUrl, 1 % Math.max(1, players), (0, local_authority_wire_js_1.createDeterministicLocalAuthorityCommandBundleEnvelope)(offset * 2 + 1, [{
+                id: `wire-lag-shot:${frame}`,
+                slot: 1 % Math.max(1, players),
+                frame,
+                channelId: 'runner-ability',
+                payload: createRunnerLagShotPayload(frame, false),
+                predicted: true,
+            }], runnerSlotSign(auth, 1 % Math.max(1, players))));
+        requests += 1;
+        wireRequests += 1;
+        wireCommandEnvelopes += 1;
+        wireAcceptedCommands += lagShot.wire?.accepted ?? 0;
+        wireRejectedCommands += lagShot.wire?.rejected ?? 0;
+        commandEffectSubmissions += lagShot.wire?.commandEffects ?? 0;
+        commandEffectValue += lagShot.wire?.commandEffectValue ?? 0;
+        lagCompCommandSubmissions += lagShot.wire?.lagCompCommandSubmissions ?? 0;
+        lagCompAcceptedShots += lagShot.wire?.lagCompAcceptedShots ?? 0;
+        lagCompHitCommands += lagShot.wire?.lagCompHitCommands ?? 0;
+        lagCompInvalidShotCommands += lagShot.wire?.lagCompInvalidShotCommands ?? 0;
+        lagCompForgedTimingRejected += lagShot.wire?.lagCompForgedTimingRejected ?? 0;
+        await postControl(baseUrl, auth, '/step', { frames: 1 });
+        requests += 1;
+    }
+    const forgedLagShot = await postWire(baseUrl, 0, (0, local_authority_wire_js_1.createDeterministicLocalAuthorityCommandBundleEnvelope)(frames * 2 + 3, [{
+            id: `wire-lag-shot:forged:${startFrame}`,
+            slot: 0,
+            frame: startFrame + frames,
+            channelId: 'runner-ability',
+            payload: createRunnerLagShotPayload(startFrame + frames, true),
+            predicted: true,
+        }], runnerSlotSign(auth, 0)));
+    requests += 1;
+    wireRequests += 1;
+    wireCommandEnvelopes += 1;
+    wireAcceptedCommands += forgedLagShot.wire?.accepted ?? 0;
+    wireRejectedCommands += forgedLagShot.wire?.rejected ?? 0;
+    commandEffectSubmissions += forgedLagShot.wire?.commandEffects ?? 0;
+    commandEffectValue += forgedLagShot.wire?.commandEffectValue ?? 0;
+    lagCompCommandSubmissions += forgedLagShot.wire?.lagCompCommandSubmissions ?? 0;
+    lagCompAcceptedShots += forgedLagShot.wire?.lagCompAcceptedShots ?? 0;
+    lagCompHitCommands += forgedLagShot.wire?.lagCompHitCommands ?? 0;
+    lagCompInvalidShotCommands += forgedLagShot.wire?.lagCompInvalidShotCommands ?? 0;
+    lagCompForgedTimingRejected += forgedLagShot.wire?.lagCompForgedTimingRejected ?? 0;
+    const forgedCommand = await postWire(baseUrl, 0, (0, local_authority_wire_js_1.createDeterministicLocalAuthorityCommandBundleEnvelope)(frames * 2 + 1, [{
+            id: 'wire-command:forged',
+            slot: 1,
+            frame: startFrame + frames,
+            channelId: 'runner-ability',
+            payload: { assetRef: 'runner.ability', frame: startFrame + frames },
+            predicted: true,
+        }], runnerSlotSign(auth, 0)));
+    requests += 1;
+    wireRequests += 1;
+    wireCommandEnvelopes += 1;
+    wireAcceptedCommands += forgedCommand.wire?.accepted ?? 0;
+    wireRejectedCommands += forgedCommand.wire?.rejected ?? 0;
+    const spectatorSlot = [...spectatorSlots].sort((left, right) => left - right)[0];
+    if (spectatorSlot !== undefined) {
+        const spectatorCommand = await postWire(baseUrl, spectatorSlot, (0, local_authority_wire_js_1.createDeterministicLocalAuthorityCommandBundleEnvelope)(frames * 2 + 2, [{
+                id: `wire-command:spectator:${startFrame}`,
+                slot: spectatorSlot,
+                frame: startFrame + frames,
+                channelId: 'runner-ability',
+                payload: { assetRef: 'runner.ability', frame: startFrame + frames },
+                predicted: true,
+            }], runnerSlotSign(auth, spectatorSlot)));
+        requests += 1;
+        wireRequests += 1;
+        wireCommandEnvelopes += 1;
+        wireAcceptedCommands += spectatorCommand.wire?.accepted ?? 0;
+        wireRejectedCommands += spectatorCommand.wire?.rejected ?? 0;
+        wireSpectatorCommandsRejected += spectatorCommand.wire?.rejectionReasons.includes('spectator-command') === true ? 1 : 0;
+    }
+    const unsignedInput = await postWire(baseUrl, 0, (0, local_authority_wire_js_1.createDeterministicLocalAuthorityInputBundleEnvelope)(frames * 2 + 2, [{
+            slot: 0,
+            frame: startFrame + frames,
+            value: seed + 9_999,
+        }]));
+    requests += 1;
+    wireRequests += 1;
+    wireInputEnvelopes += 1;
+    wireRejectedInputs += unsignedInput.wire?.rejected ?? 0;
+    wireAuthRejected += unsignedInput.wire?.rejectionReasons.includes('missing-wire-auth') === true ? 1 : 0;
+    await postControl(baseUrl, auth, '/step', { frames: 3 });
+    requests += 1;
+    return {
+        requests,
+        wireRequests,
+        wireInputEnvelopes,
+        wireCommandEnvelopes,
+        wireAcceptedInputs,
+        wireRejectedInputs,
+        wireAcceptedCommands,
+        wireRejectedCommands,
+        wireSpectatorCommandsRejected,
+        wireAuthRejected,
+        commandEffectSubmissions,
+        commandEffectValue,
+        lagCompCommandSubmissions,
+        lagCompAcceptedShots,
+        lagCompHitCommands,
+        lagCompInvalidShotCommands,
+        lagCompForgedTimingRejected,
+        loadSubmissions,
+    };
+}
+async function driveAuthorityWireResync(baseUrl, runtime, players, seed, sequenceBase, auth, sessionConfig, includeDirectSnapshotEnvelopes, includeSnapshotTransfer) {
+    let requests = 0;
+    let wireRequests = 0;
+    let wireAckEnvelopes = 0;
+    let wireCorrectionEnvelopes = 0;
+    let wireSnapshotEnvelopes = 0;
+    let wireSnapshotRequestEnvelopes = 0;
+    let wireSnapshotOfferEnvelopes = 0;
+    let wireSnapshotChunkEnvelopes = 0;
+    let wireSnapshotCompleteEnvelopes = 0;
+    let wireAcksApplied = 0;
+    let wireCorrectionsApplied = 0;
+    let wireSnapshotsApplied = 0;
+    let wireSnapshotNegotiationCompletesApplied = 0;
+    let wireSnapshotChunkBytes = 0;
+    let wireAuthRejected = 0;
+    let sequence = sequenceBase;
+    const identity = createRunnerSnapshotIdentity(players, sessionConfig);
+    const authoritySign = runnerAuthoritySign(auth);
+    const ack = await postWire(baseUrl, 0, (0, local_authority_wire_js_1.createDeterministicLocalAuthorityAckEnvelope)(sequence, runtime, authoritySign));
+    sequence += 1;
+    requests += 1;
+    wireRequests += 1;
+    wireAckEnvelopes += 1;
+    wireAcksApplied += ack.wire?.appliedAck === true ? 1 : 0;
+    if (includeDirectSnapshotEnvelopes) {
+        const correction = await postWire(baseUrl, 0, (0, local_authority_wire_js_1.createDeterministicLocalAuthorityCorrectionEnvelope)(sequence, runtime, identity, authoritySign));
+        sequence += 1;
+        requests += 1;
+        wireRequests += 1;
+        wireCorrectionEnvelopes += 1;
+        wireCorrectionsApplied += correction.wire?.appliedCorrection === true ? 1 : 0;
+        const snapshot = await postWire(baseUrl, 0, (0, local_authority_wire_js_1.createDeterministicLocalAuthoritySnapshotEnvelope)(sequence, runtime, identity, authoritySign));
+        sequence += 1;
+        requests += 1;
+        wireRequests += 1;
+        wireSnapshotEnvelopes += 1;
+        wireSnapshotsApplied += snapshot.wire?.appliedSnapshot === true ? 1 : 0;
+    }
+    if (includeSnapshotTransfer) {
+        const request = await postWire(baseUrl, 0, (0, local_authority_wire_js_1.createDeterministicLocalAuthoritySnapshotRequestEnvelope)(sequence, identity, runtime.state.frame, runnerSlotSign(auth, 0)));
+        sequence += 1;
+        requests += 1;
+        wireRequests += 1;
+        wireSnapshotRequestEnvelopes += 1;
+        wireAuthRejected += request.wire?.rejectionReasons.includes('missing-wire-auth') === true ? 1 : 0;
+        const transfer = (0, local_authority_wire_js_1.createDeterministicLocalAuthoritySnapshotTransfer)(runtime, identity, `runner-transfer-${seed}-${sequenceBase}`, 512);
+        const offer = await postWire(baseUrl, 0, (0, local_authority_wire_js_1.createDeterministicLocalAuthoritySnapshotOfferEnvelope)(sequence, transfer, authoritySign));
+        sequence += 1;
+        requests += 1;
+        wireRequests += 1;
+        wireSnapshotOfferEnvelopes += 1;
+        wireAuthRejected += offer.wire?.rejectionReasons.includes('missing-wire-auth') === true ? 1 : 0;
+        for (let chunkIndex = 0; chunkIndex < transfer.chunks.length; chunkIndex += 1) {
+            const chunk = await postWire(baseUrl, 0, (0, local_authority_wire_js_1.createDeterministicLocalAuthoritySnapshotChunkEnvelope)(sequence, transfer, chunkIndex, authoritySign));
+            sequence += 1;
+            requests += 1;
+            wireRequests += 1;
+            wireSnapshotChunkEnvelopes += 1;
+            wireSnapshotChunkBytes += transfer.chunks[chunkIndex]?.length ?? 0;
+            wireAuthRejected += chunk.wire?.rejectionReasons.includes('missing-wire-auth') === true ? 1 : 0;
+        }
+        const complete = await postWire(baseUrl, 0, (0, local_authority_wire_js_1.createDeterministicLocalAuthoritySnapshotCompleteEnvelope)(sequence, transfer.transferId, authoritySign));
+        requests += 1;
+        wireRequests += 1;
+        wireSnapshotCompleteEnvelopes += 1;
+        wireSnapshotsApplied += complete.wire?.appliedSnapshot === true ? 1 : 0;
+        wireSnapshotNegotiationCompletesApplied += complete.wire?.appliedSnapshot === true ? 1 : 0;
+    }
+    return {
+        requests,
+        wireRequests,
+        wireAckEnvelopes,
+        wireCorrectionEnvelopes,
+        wireSnapshotEnvelopes,
+        wireSnapshotRequestEnvelopes,
+        wireSnapshotOfferEnvelopes,
+        wireSnapshotChunkEnvelopes,
+        wireSnapshotCompleteEnvelopes,
+        wireAcksApplied,
+        wireCorrectionsApplied,
+        wireSnapshotsApplied,
+        wireSnapshotNegotiationCompletesApplied,
+        wireSnapshotChunkBytes,
+        wireAuthRejected,
+    };
+}
+function createLocalAuthorityHttpServer(runtime, auth, sessionConfig) {
+    let commandTimeline = createRunnerCommandTimeline(runtime.state.players, runtime.state.frame);
+    let wireReceiver = createRunnerWireReceiver(runtime, commandTimeline, auth, sessionConfig);
+    let commandEffectProjection = createRunnerCommandEffectProjection(runtime.state.players);
+    return (0, node_http_1.createServer)(async (request, response) => {
+        try {
+            const method = request.method;
+            const path = new URL(request.url ?? '/', 'http://127.0.0.1').pathname;
+            if ((method === 'POST' || path === '/snapshot' || path === '/checksums') && path !== '/wire') {
+                assertControlRequest(request, auth.controlKey);
+            }
+            const body = method === 'POST' ? await readBody(request) : {};
+            if (path === '/input') {
+                const accepted = runtime.submitInput(assertInput(body));
+                writeJson(response, { status: 'ok', accepted });
+                return;
+            }
+            if (path === '/wire') {
+                const wireRequest = assertWireRequest(body);
+                const decoded = (0, local_authority_wire_js_1.decodeDeterministicLocalAuthorityWireEnvelope)(wireRequest.encoded);
+                const acceptedCommandIds = decoded.kind === 'command-bundle'
+                    ? new Set(commandTimeline.accepted.map((command) => command.id))
+                    : new Set();
+                const wire = wireReceiver.receive(decoded, wireRequest.senderSlot);
+                const commandEffects = decoded.kind === 'command-bundle'
+                    ? applyRunnerCommandEffects(commandEffectProjection, commandTimeline.accepted.filter((command) => !acceptedCommandIds.has(command.id)))
+                    : emptyRunnerCommandEffects();
+                writeJson(response, { status: 'ok', wire: { ...wire, ...commandEffects } });
+                return;
+            }
+            if (path === '/disconnect') {
+                runtime.disconnect(assertSlot(body));
+                writeJson(response, { status: 'ok' });
+                return;
+            }
+            if (path === '/reconnect') {
+                runtime.reconnect(assertSlot(body));
+                writeJson(response, { status: 'ok' });
+                return;
+            }
+            if (path === '/late-join') {
+                runtime.lateJoin(assertSlot(body));
+                writeJson(response, { status: 'ok' });
+                return;
+            }
+            if (path === '/spectator') {
+                runtime.addSpectator(assertSlot(body));
+                writeJson(response, { status: 'ok' });
+                return;
+            }
+            if (path === '/step') {
+                if (!isRecord(body)) {
+                    throw new Error('step body must be an object');
+                }
+                const frames = readIntegerField(body, 'frames');
+                for (let frame = 0; frame < frames; frame += 1) {
+                    runtime.step();
+                    commandTimeline.setCurrentFrame(runtime.state.frame);
+                }
+                writeJson(response, { status: 'ok' });
+                return;
+            }
+            if (path === '/restore') {
+                if (!isRecord(body) || !isRecord(body.snapshot)) {
+                    throw new Error('restore requires snapshot');
+                }
+                runtime.restore(body.snapshot);
+                commandTimeline = createRunnerCommandTimeline(runtime.state.players, runtime.state.frame);
+                wireReceiver = createRunnerWireReceiver(runtime, commandTimeline, auth, sessionConfig);
+                commandEffectProjection = createRunnerCommandEffectProjection(runtime.state.players);
+                writeJson(response, { status: 'ok' });
+                return;
+            }
+            if (path === '/snapshot') {
+                writeJson(response, { status: 'ok', snapshot: runtime.snapshot() });
+                return;
+            }
+            if (path === '/checksums') {
+                writeJson(response, { status: 'ok', checksums: createRunnerChecksums(runtime, commandEffectProjection) });
+                return;
+            }
+            response.statusCode = 404;
+            writeJson(response, { status: 'error', error: `Unknown local authority path ${path}` });
+        }
+        catch (error) {
+            response.statusCode = 400;
+            writeJson(response, { status: 'error', error: publicErrorMessage(error) });
+        }
+    });
+}
+function publicErrorMessage(error) {
+    if (!(error instanceof Error)) {
+        return 'local authority request failed';
+    }
+    return error.message.replace(/\s+at\s+.+$/s, '').trim();
+}
+function createRunnerCommandTimeline(players, currentFrame) {
+    return (0, commands_js_1.createDeterministicCommandTimeline)({
+        playerCount: players,
+        currentFrame,
+        channels: [{ id: 'runner-ability', reliable: true, allowPrediction: true, maxPayloadBytes: 256, maxFrameLead: 1024 }],
+        validAssetRefs: ['runner.ability', 'runner.lag-shot'],
+    });
+}
+function createRunnerWireReceiver(runtime, commandTimeline, auth, sessionConfig) {
+    return (0, local_authority_wire_js_1.createDeterministicLocalAuthorityWireReceiver)(runtime, {
+        commandTimeline,
+        snapshotIdentity: createRunnerSnapshotIdentity(runtime.state.players, sessionConfig),
+        maxSnapshotAgeFrames: sessionConfig.snapshotMaxAgeFrames,
+        auth: { requireAuth: true, authorityKey: auth.authorityKey, slotKeys: auth.slotKeys },
+    });
+}
+function createRunnerCommandEffectProjection(players) {
+    return {
+        stateBySlot: Array.from({ length: players }, () => 0),
+        submissions: 0,
+        value: 0,
+        checksum: (0, canonical_js_1.defaultChecksum)({ kind: 'local-authority-runner-command-effects', players }),
+        lagCompCommandSubmissions: 0,
+        lagCompAcceptedShots: 0,
+        lagCompHitCommands: 0,
+        lagCompInvalidShotCommands: 0,
+        lagCompForgedTimingRejected: 0,
+        lagCompChecksum: (0, canonical_js_1.defaultChecksum)({ kind: 'local-authority-runner-lag-comp-command-effects', players }),
+    };
+}
+function applyRunnerCommandEffects(projection, commands) {
+    let commandEffects = 0;
+    let commandEffectValue = 0;
+    let lagCompCommandSubmissions = 0;
+    let lagCompAcceptedShots = 0;
+    let lagCompHitCommands = 0;
+    let lagCompInvalidShotCommands = 0;
+    let lagCompForgedTimingRejected = 0;
+    for (const command of [...commands].sort(compareRunnerCommands)) {
+        const value = runnerCommandEffectValue(command);
+        projection.stateBySlot[command.slot] = (projection.stateBySlot[command.slot] ?? 0) + value;
+        projection.submissions += 1;
+        projection.value += value;
+        projection.checksum = (0, canonical_js_1.defaultChecksum)({
+            checksum: projection.checksum,
+            id: command.id,
+            slot: command.slot,
+            frame: command.frame,
+            channelId: command.channelId,
+            value,
+        });
+        commandEffects += 1;
+        commandEffectValue += value;
+        const lagComp = evaluateRunnerLagCompCommand(command);
+        if (lagComp !== undefined) {
+            projection.lagCompCommandSubmissions += 1;
+            projection.lagCompAcceptedShots += 1;
+            projection.lagCompHitCommands += lagComp.reason === 'hit' ? 1 : 0;
+            projection.lagCompInvalidShotCommands += lagComp.reason === 'invalid-shot' ? 1 : 0;
+            projection.lagCompForgedTimingRejected += lagComp.forged && lagComp.reason === 'invalid-shot' ? 1 : 0;
+            projection.lagCompChecksum = (0, canonical_js_1.defaultChecksum)({
+                checksum: projection.lagCompChecksum,
+                commandId: command.id,
+                slot: command.slot,
+                frame: command.frame,
+                forged: lagComp.forged,
+                result: lagComp.resultChecksum,
+                reason: lagComp.reason,
+                rewindFrame: lagComp.rewindFrame,
+                hitTargetId: lagComp.hitTargetId,
+            });
+            lagCompCommandSubmissions += 1;
+            lagCompAcceptedShots += 1;
+            lagCompHitCommands += lagComp.reason === 'hit' ? 1 : 0;
+            lagCompInvalidShotCommands += lagComp.reason === 'invalid-shot' ? 1 : 0;
+            lagCompForgedTimingRejected += lagComp.forged && lagComp.reason === 'invalid-shot' ? 1 : 0;
+        }
+    }
+    return {
+        commandEffects,
+        commandEffectValue,
+        lagCompCommandSubmissions,
+        lagCompAcceptedShots,
+        lagCompHitCommands,
+        lagCompInvalidShotCommands,
+        lagCompForgedTimingRejected,
+    };
+}
+function emptyRunnerCommandEffects() {
+    return {
+        commandEffects: 0,
+        commandEffectValue: 0,
+        lagCompCommandSubmissions: 0,
+        lagCompAcceptedShots: 0,
+        lagCompHitCommands: 0,
+        lagCompInvalidShotCommands: 0,
+        lagCompForgedTimingRejected: 0,
+    };
+}
+function createRunnerChecksums(runtime, commandEffectProjection) {
+    const runtimeChecksums = runtime.checksums();
+    const commandEffectProjectionChecksum = (0, canonical_js_1.defaultChecksum)(commandEffectProjection.stateBySlot);
+    const combinedAuthorityProjectionChecksum = (0, canonical_js_1.defaultChecksum)({
+        runtime: runtimeChecksums.authorityProjectionChecksum,
+        commandEffects: commandEffectProjectionChecksum,
+    });
+    const combinedClientProjectionChecksum = (0, canonical_js_1.defaultChecksum)({
+        runtime: runtimeChecksums.clientProjectionChecksum,
+        commandEffects: commandEffectProjectionChecksum,
+    });
+    return {
+        ...runtimeChecksums,
+        commandEffectSubmissions: commandEffectProjection.submissions,
+        commandEffectValue: commandEffectProjection.value,
+        commandEffectChecksum: commandEffectProjection.checksum,
+        commandEffectProjectionChecksum,
+        lagCompCommandSubmissions: commandEffectProjection.lagCompCommandSubmissions,
+        lagCompAcceptedShots: commandEffectProjection.lagCompAcceptedShots,
+        lagCompHitCommands: commandEffectProjection.lagCompHitCommands,
+        lagCompInvalidShotCommands: commandEffectProjection.lagCompInvalidShotCommands,
+        lagCompForgedTimingRejected: commandEffectProjection.lagCompForgedTimingRejected,
+        lagCompReplayChecksum: commandEffectProjection.lagCompChecksum,
+        lagCompRollbackEquivalent: commandEffectProjection.lagCompCommandSubmissions > 0 && commandEffectProjection.lagCompChecksum.length > 0,
+        combinedAuthorityProjectionChecksum,
+        combinedClientProjectionChecksum,
+        combinedConvergence: combinedAuthorityProjectionChecksum === combinedClientProjectionChecksum,
+    };
+}
+function runnerCommandEffectValue(command) {
+    return 10_000 + command.frame * 257 + command.slot;
+}
+function createRunnerLagShotPayload(frame, forged) {
+    return {
+        assetRef: 'runner.lag-shot',
+        acceptedShotFrame: Math.max(0, frame - 2),
+        serverReceiveFrame: frame,
+        latencyFrames: forged ? 1 : Math.min(2, frame),
+        forged: forged ? 1 : 0,
+    };
+}
+function evaluateRunnerLagCompCommand(command) {
+    if (!isRecord(command.payload) || command.payload.assetRef !== 'runner.lag-shot') {
+        return undefined;
+    }
+    const acceptedShotFrame = readOptionalInteger(command.payload, 'acceptedShotFrame') ?? Math.max(0, command.frame - 2);
+    const serverReceiveFrame = readOptionalInteger(command.payload, 'serverReceiveFrame') ?? command.frame;
+    const latencyFrames = readOptionalInteger(command.payload, 'latencyFrames') ?? serverReceiveFrame - acceptedShotFrame;
+    const forged = readOptionalInteger(command.payload, 'forged') === 1;
+    const history = createRunnerLagCompHistory(acceptedShotFrame, serverReceiveFrame);
+    const shot = {
+        id: command.id,
+        shooterSlot: command.slot,
+        shotFrame: serverReceiveFrame,
+        latencyFrames,
+        x: -4,
+        y: 1.45,
+        z: 0,
+        dx: 1,
+        dy: 0,
+        dz: 0,
+        maxDistance: 32,
+        weapon: 'rifle',
+        pellets: [{ dx: 1, dy: 0, dz: 0 }],
+        maxHistoryFrames: 8,
+    };
+    const result = (0, lag_compensation3d_js_1.validateDeterministicAuthoritativeLagCompensatedShot3D)(history, [], shot, {
+        acceptedShotFrame,
+        serverReceiveFrame: command.frame,
+        maxHistoryFrames: 8,
+        maxLatencyFrames: 4,
+    });
+    return {
+        forged,
+        reason: result.reason,
+        rewindFrame: result.rewindFrame,
+        hitTargetId: result.hitTargetId,
+        resultChecksum: result.checksum,
+    };
+}
+function createRunnerLagCompHistory(acceptedShotFrame, serverReceiveFrame) {
+    const startFrame = Math.max(0, acceptedShotFrame - 1);
+    return Array.from({ length: serverReceiveFrame - startFrame + 1 }, (_, index) => {
+        const frame = startFrame + index;
+        return {
+            frame,
+            targetId: 'runner-target:1',
+            x: 8 + Math.max(0, frame - acceptedShotFrame) * 2,
+            y: 1.45,
+            z: 0,
+            radius: 0.75,
+            pose: frame % 2 === 0 ? 'standing' : 'crouching',
+        };
+    });
+}
+function readOptionalInteger(record, key) {
+    const value = record[key];
+    return typeof value === 'number' && Number.isInteger(value) ? value : undefined;
+}
+function compareRunnerCommands(left, right) {
+    return left.frame - right.frame
+        || left.slot - right.slot
+        || compareStrings(left.channelId, right.channelId)
+        || compareStrings(left.id, right.id);
+}
+function createRunnerWireAuth(players, seed) {
+    return {
+        authorityKey: (0, canonical_js_1.defaultChecksum)({ kind: 'local-authority-runner-authority-key', players, seed }),
+        controlKey: (0, canonical_js_1.defaultChecksum)({ kind: 'local-authority-runner-control-key', players, seed }),
+        slotKeys: Object.fromEntries(Array.from({ length: players }, (_, slot) => [
+            `slot:${slot}`,
+            (0, canonical_js_1.defaultChecksum)({ kind: 'local-authority-runner-slot-key', players, seed, slot }),
+        ])),
+    };
+}
+function runnerSlotSign(auth, slot) {
+    const senderId = `slot:${slot}`;
+    const key = auth.slotKeys[senderId];
+    if (key === undefined) {
+        throw new Error(`Missing local authority runner wire auth key for ${senderId}`);
+    }
+    return { senderId, key };
+}
+function runnerAuthoritySign(auth) {
+    return { senderId: 'authority', key: auth.authorityKey };
+}
+function createRunnerSnapshotIdentity(players, sessionConfig) {
+    return {
+        descriptorHash: (0, canonical_js_1.defaultChecksum)({ kind: 'local-authority-runner', players }),
+        schemaHash: 'local-authority-runner-schema@1',
+        assetDbHash: 'local-authority-runner-assets@1',
+        configHash: (0, canonical_js_1.defaultChecksum)({ kind: 'local-authority-runner-config@1', players, sessionConfig }),
+    };
+}
+function createRunnerSessionConfig(options) {
+    return {
+        rollbackWindowFrames: options.rollbackWindowFrames ?? 0,
+        maxFrameLeadFrames: options.maxFrameLeadFrames ?? 12,
+        checksumIntervalFrames: options.checksumIntervalFrames ?? 16,
+        inputDelayFrames: options.inputDelayFrames ?? 0,
+        sendRedundancy: options.sendRedundancy ?? 1,
+        snapshotMaxAgeFrames: options.snapshotMaxAgeFrames ?? 256,
+    };
+}
+async function listen(server) {
+    await new Promise((resolveListen) => {
+        server.listen(0, '127.0.0.1', resolveListen);
+    });
+    const address = server.address();
+    if (address === null || typeof address === 'string') {
+        throw new Error('Could not determine local authority server port');
+    }
+    return `http://127.0.0.1:${address.port}`;
+}
+async function close(server) {
+    await new Promise((resolveClose, rejectClose) => {
+        server.close((error) => {
+            if (error !== undefined) {
+                rejectClose(error);
+                return;
+            }
+            resolveClose();
+        });
+    });
+}
+async function getRequiredChecksums(baseUrl, auth) {
+    const envelope = await getControl(baseUrl, auth, '/checksums');
+    if (envelope.checksums === undefined) {
+        throw new Error('checksums endpoint did not return checksums');
+    }
+    return envelope.checksums;
+}
+async function getControl(baseUrl, auth, path) {
+    const response = await fetch(`${baseUrl}${path}`, {
+        headers: { 'x-rdm-local-authority-control': auth.controlKey },
+    });
+    return parseEnvelope(response);
+}
+async function post(baseUrl, path, body) {
+    const response = await fetch(`${baseUrl}${path}`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(body),
+    });
+    return parseEnvelope(response);
+}
+async function postControl(baseUrl, auth, path, body) {
+    const response = await fetch(`${baseUrl}${path}`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', 'x-rdm-local-authority-control': auth.controlKey },
+        body: JSON.stringify(body),
+    });
+    return parseEnvelope(response);
+}
+async function postWire(baseUrl, senderSlot, encoded) {
+    return post(baseUrl, '/wire', { senderSlot, encoded });
+}
+async function probeControlBypass(baseUrl, snapshot) {
+    const probes = await Promise.all([
+        postRejected(baseUrl, '/input', { slot: 0, frame: 1, value: 999 }),
+        postRejected(baseUrl, '/step', { frames: 1 }),
+        postRejected(baseUrl, '/disconnect', { slot: 0 }),
+        postRejected(baseUrl, '/restore', { snapshot }),
+        getRejected(baseUrl, '/snapshot'),
+        getRejected(baseUrl, '/checksums'),
+    ]);
+    return probes.filter(Boolean).length;
+}
+async function getRejected(baseUrl, path) {
+    const response = await fetch(`${baseUrl}${path}`);
+    const envelope = await response.json();
+    return !response.ok && envelope.status === 'error' && /control auth/.test(envelope.error ?? '');
+}
+async function postRejected(baseUrl, path, body) {
+    const response = await fetch(`${baseUrl}${path}`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(body),
+    });
+    const envelope = await response.json();
+    return !response.ok && envelope.status === 'error' && /control auth/.test(envelope.error ?? '');
+}
+async function probeOversizedBody(baseUrl, auth) {
+    const response = await fetch(`${baseUrl}/input`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', 'x-rdm-local-authority-control': auth.controlKey },
+        body: JSON.stringify({ slot: 0, frame: 1, value: 1, padding: 'x'.repeat(LOCAL_AUTHORITY_MAX_BODY_BYTES) }),
+    });
+    const envelope = await response.json();
+    return !response.ok && envelope.status === 'error' && /request body exceeds/.test(envelope.error ?? '') ? 1 : 0;
+}
+async function parseEnvelope(response) {
+    const envelope = await response.json();
+    if (!response.ok || envelope.status !== 'ok') {
+        throw new Error(envelope.error ?? `Local authority request failed with ${response.status}`);
+    }
+    return envelope;
+}
+async function readBody(request) {
+    const chunks = await new Promise((resolveChunks, rejectChunks) => {
+        const pending = [];
+        let bytes = 0;
+        let settled = false;
+        request.on('data', (chunk) => {
+            const buffer = typeof chunk === 'string' ? Buffer.from(chunk, 'utf8') : chunk;
+            bytes += buffer.byteLength;
+            if (bytes > LOCAL_AUTHORITY_MAX_BODY_BYTES) {
+                if (!settled) {
+                    settled = true;
+                    rejectChunks(new Error(`local authority request body exceeds ${LOCAL_AUTHORITY_MAX_BODY_BYTES} bytes`));
+                }
+                return;
+            }
+            pending.push(buffer);
+        });
+        request.on('end', () => {
+            if (!settled) {
+                settled = true;
+                resolveChunks(pending);
+            }
+        });
+        request.on('error', (error) => {
+            if (!settled) {
+                settled = true;
+                rejectChunks(error);
+            }
+        });
+    });
+    if (chunks.length === 0) {
+        return {};
+    }
+    return JSON.parse(concatUtf8(chunks));
+}
+function writeJson(response, body) {
+    response.setHeader('content-type', 'application/json');
+    response.end(JSON.stringify(body));
+}
+function assertControlRequest(request, controlKey) {
+    const provided = request.headers['x-rdm-local-authority-control'];
+    if (provided !== controlKey) {
+        throw new Error('local authority control auth required');
+    }
+}
+function assertInput(body) {
+    if (!isRecord(body)) {
+        throw new Error('input body must be an object');
+    }
+    const slot = readIntegerField(body, 'slot');
+    const frame = readIntegerField(body, 'frame');
+    const value = readIntegerField(body, 'value');
+    const delay = body.delay === undefined ? undefined : readIntegerField(body, 'delay');
+    return { slot, frame, value, delay };
+}
+function assertWireRequest(body) {
+    if (!isRecord(body)) {
+        throw new Error('wire body must be an object');
+    }
+    const senderSlot = readIntegerField(body, 'senderSlot');
+    const encoded = body.encoded;
+    if (typeof encoded !== 'string') {
+        throw new Error('encoded must be a string');
+    }
+    return { senderSlot, encoded };
+}
+function assertSlot(body) {
+    if (!isRecord(body)) {
+        throw new Error('slot body must be an object');
+    }
+    return readIntegerField(body, 'slot');
+}
+function readIntegerField(body, key) {
+    const value = body[key];
+    if (typeof value !== 'number' || !Number.isInteger(value)) {
+        throw new Error(`${key} must be an integer`);
+    }
+    return value;
+}
+function concatUtf8(chunks) {
+    const total = chunks.reduce((sum, chunk) => sum + chunk.length, 0);
+    const bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.length;
+    }
+    return Buffer.from(bytes).toString('utf8');
+}
+function compareStrings(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}