@statewalker/cellb 0.1.1 → 0.3.0

package/dist/isolate/isolate.js.map

@@ -1 +1 @@
-{"version":3,"file":"isolate.js","sourceRoot":"","sources":["../../src/isolate/isolate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAoB,iBAAiB,EAAqB,MAAM,oBAAoB,CAAC;AAE5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAoB,WAAW,EAAiB,MAAM,eAAe,CAAC;AAE7E,MAAM,UAAU,YAAY,CAC1B,IAAc,EACd,UAGqC,EACrC,IAAI,GAOA,EAAE;IAEN,IAAI,MAAM,GAA4B,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,sFAAsF;IACtF,oEAAoE;IACpE,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2C,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAChD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG;QACjB,YAAY,EAAE,IAAI;QAClB,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,IAAS;YACxC,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,CAAC,CAAC;gBAAE,OAAO;YACf,MAAM,KAAK,GAAG,EAAE,SAAS,CAAC;YAC1B,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,UAAU;gBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACpE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC;oBACT,IAAI,EAAE,SAAS;oBACf,EAAE,EAAE,WAAW;oBACf,OAAO,EAAE,CAAC,CAAC,GAAG;oBACd,IAAI,EAAE;wBACJ,GAAG,EAAE,IAAI,CAAC,GAAG;wBACb,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,KAAK,EAAE,CAAC,CAAC,KAAK;wBACd,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK;qBAC7D;iBACF,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;KACF,CAAC;IACF,MAAM,MAAM,GAAG;QACb,KAAK,CAAC,IAAI,CAAC,OAAe;YACxB,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YAC9B,OAAO,CAAC;gBACN,CAAC,CAAE,CAAC,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAA4B;gBAC3F,CAAC,CAAC,SAAS,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,IAAI,KAAI,CAAC;KAChB,CAAC;IACF,6FAA6F;IAC7F,wFAAwF;IACxF,4FAA4F;IAC5F,+FAA+F;IAC/F,MAAM,SAAS,GAAU;QACvB,KAAK,CAAC,UAAU,CAAC,OAAO;YACtB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC,mDAAmD;YAC9F,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK;gBACjC,IAAI;gBACJ,OAAO,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;aACT,CAAC;QACnB,CAAC;KACF,CAAC;IACF,IAAI,OAAY,CAAC;IACjB,IAAI,GAAqC,CAAC;IAC1C,MAAM,aAAa,GAAG,KAAK,EAAE,SAAiB,EAAE,EAAE;QAChD,IAAI,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC,IAAI,CAAC,OAAO;gBACf,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAClF,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC;YAC1B,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;YAC7D,IAAI,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,UAAU;gBACzC,MAAM,IAAI,KAAK,CAAC,wCAAwC,SAAS,GAAG,CAAC,CAAC;YACxE,EAAE,GAAG,iBAAiB,CAAC;gBACrB,MAAM,EAAE,EAAE,GAAI,MAAuB,EAAE,OAAO,EAAE,EAAE,EAAE;gBACpD,cAAc,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE;gBAC9C,OAAO;gBACP,IAAI,EAAE,GAAG,EAAE,uDAAuD;gBAClE,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE;gBAC1C,MAAM,EAAE,IAAI,EAAE,kEAAkE;aACjF,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IACF,IAAI,GAAG,GAA4B,EAAE,CAAC;IACtC,IAAI,OAAO,GAA4B,EAAE,CAAC;IAC1C,kGAAkG;IAClG,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,uFAAuF;IACvF,MAAM,KAAK,GAAG,KAAK,EAAE,SAAiB,EAAE,OAAe,EAAE,EAAE;QACzD,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,CAG1B,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,SAAS,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;IAC5F,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,KAAe,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,GAAG,CAAC,CAAC;QACrF,OAAO,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,KAAK,EAAE,CAAc,EAAE,GAAY,EAAqB,EAAE,CAC5E,WAAW,IAAI,CAAC;QACd,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QACvD,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,EAAE,CAAM,EAAE,EAAE;QAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,GAAG,CAAC,CAAC;YACZ,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,kEAAkE;YAC/E,mFAAmF;YACnF,mFAAmF;YACnF,iDAAiD;YACjD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,IAAe,EAAE,EAAE,CAC9C,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjE,IAAI,IAAI,CAAC,YAAY,KAAK,KAAK;gBAC7B,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAU;oBACpE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC/D,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;gBAC1B,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAE,EAAE,CACzE,QAAQ,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAiB,CAAC;YACxD,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;gBAC1B,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE;oBAC7B,MAAM,IAAI,KAAK,CACb,2KAA2K,CAC5K,CAAC;gBACJ,CAAC,CAAiB,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,qCAAqC;YACnE,MAAM,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACnC,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YAC7B,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QAC7D,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACtB,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;YACtD,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YACrD,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACtB,MAAM,kBAAkB,CACtB,IAAI,EACJ,CAAC,EAAW,EAAE,GAAgD,EAAE,EAAE,CAChE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAC1B,CAAC;gBACF,OAAO,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,IAAe,EAAE,EAAE,CAC/B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;IACb,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACH,CAAC,CAAC,CAAC","sourcesContent":["/**\n * The isolate side: loads the Worker code in THIS realm and serves fetch/RPC for the host.\n * `importCode` is realm specific (data: URL of a bundle on Node, a site URL in browsers).\n */\nimport { ctxExports, entrypointStub } from \"../core/handles.js\";\nimport { runInDurableObject } from \"../core/namespace.js\";\nimport { type CellRuntime, createCellRuntime, type WorkerModule } from \"../core/runtime.js\";\nimport type { Lease, LeaseHandle, OpenCellSql } from \"../ports.js\";\nimport { realmWorkerScope } from \"../project/worker-scope.js\";\nimport { type FetchTarget, isolatePort, type PortLike } from \"./protocol.js\";\n\nexport function serveIsolate(\n  port: PortLike,\n  importCode: (\n    load: any,\n    logs: (level: string, args: unknown[]) => void,\n  ) => Promise<Record<string, unknown>>,\n  opts: {\n    patchConsole?: boolean;\n    /**\n     * Storage for Durable Object classes run INSIDE this isolate (facets of loaded code):\n     * each facet is a cell of an isolate-local runtime, with its own SQLite.\n     */\n    openSql?: (load: any) => OpenCellSql | Promise<OpenCellSql>;\n  } = {},\n) {\n  let module: Record<string, unknown> = {};\n  const runtimes = new Map<string, CellRuntime>();\n  // Facet logging through the host: the isolate-local cell key → the facet's key in the\n  // root's storage (celld: <root>/facets/<sha>) and the root's epoch.\n  const facetKeys = new Map<string, { key: string; epoch?: number }>();\n  const images = new Map<number, () => unknown>();\n  let nextImage = 0;\n  const hostLogged = (internal: string) => facetKeys.get(internal);\n  const durability = {\n    capturePages: true,\n    async committed(cellKey: string, info: any) {\n      const f = hostLogged(cellKey);\n      if (!f) return;\n      const token = ++nextImage;\n      if (typeof info.image === \"function\") images.set(token, info.image);\n      try {\n        await call({\n          type: \"durable\",\n          op: \"committed\",\n          cellKey: f.key,\n          info: {\n            seq: info.seq,\n            pages: info.pages,\n            epoch: f.epoch,\n            image: typeof info.image === \"function\" ? token : info.image,\n          },\n        });\n      } finally {\n        images.delete(token);\n      }\n    },\n  };\n  const backup = {\n    async load(cellKey: string) {\n      const f = hostLogged(cellKey);\n      return f\n        ? ((await call({ type: \"durable\", op: \"load\", cellKey: f.key })) as Uint8Array | undefined)\n        : undefined;\n    },\n    async save() {},\n  };\n  // The host holds the root's lease and attaches each facet with its epoch: handing that epoch\n  // out as the facet's own lease makes its ObjectHost rebuild the local database from the\n  // bucket when it opens, as a root does under a lease (a pool kept from an earlier ownership\n  // is older than what other nodes wrote since). Without an epoch, the local file stays primary.\n  const ownership: Lease = {\n    async tryAcquire(cellKey) {\n      const lost = new AbortController().signal; // fencing stays with the root's lease, in the host\n      return {\n        name: cellKey,\n        epoch: hostLogged(cellKey)?.epoch,\n        lost,\n        release: async () => {},\n      } as LeaseHandle;\n    },\n  };\n  let loadMsg: any;\n  let sql: Promise<OpenCellSql> | undefined;\n  const objectRuntime = async (className: string) => {\n    let rt = runtimes.get(className);\n    if (!rt) {\n      if (!opts.openSql)\n        throw new Error(\"this isolate cannot host Durable Object classes (no storage)\");\n      sql ??= Promise.resolve(opts.openSql(loadMsg));\n      const openSql = await sql;\n      if (runtimes.has(className)) return runtimes.get(className)!;\n      if (typeof module[className] !== \"function\")\n        throw new Error(`Loaded worker does not export class \"${className}\"`);\n      rt = createCellRuntime({\n        worker: { ...(module as WorkerModule), default: {} },\n        durableObjects: { [className]: { className } },\n        openSql,\n        vars: env, // the loaded Worker's env: plain values and host stubs\n        storage: { durability, backup, ownership },\n        facets: true, // rows move to this run's scope on open, as celld does for facets\n      });\n      runtimes.set(className, rt);\n    }\n    return rt;\n  };\n  let env: Record<string, unknown> = {};\n  let exports: Record<string, unknown> = {};\n  // The loaded Worker is this realm's own: its `cloudflare:workers` reads `env` and `exports` here.\n  const scope = realmWorkerScope();\n  // A facet of loaded code: the object lives here, named by the parent's facet cell key.\n  const facet = async (className: string, cellKey: string) => {\n    const rt = await objectRuntime(className);\n    const ns = rt.env[className] as {\n      getByName(n: string): any;\n      idFromName(n: string): { toString(): string };\n    };\n    return { rt, stub: ns.getByName(cellKey), key: `${className}/${ns.idFromName(cellKey)}` };\n  };\n  const exported = (name: string, props?: unknown) => {\n    const target = module[name];\n    if (target === undefined) throw new Error(`Loaded worker does not export \"${name}\"`);\n    return entrypointStub(target, env, props, exports);\n  };\n  const fetchTarget = async (t: FetchTarget, req: Request): Promise<Response> =>\n    \"className\" in t\n      ? (await facet(t.className, t.cellKey)).stub.fetch(req)\n      : exported(t.name, t.props).fetch(req);\n  const handle = async (m: any) => {\n    if (m.type === \"load\") {\n      loadMsg = m;\n      env = m.env; // host bindings arrive as stubs: every call goes back to the host\n      // Logs go to the host (Tail Workers, and the host prints them): through the global\n      // console, or — where the realm has other code that logs — a console scoped to the\n      // loaded modules (importCode receives the sink).\n      const sink = (level: string, args: unknown[]) =>\n        call({ type: \"log\", level, args: safe(args) }).catch(() => {});\n      if (opts.patchConsole !== false)\n        for (const level of [\"log\", \"info\", \"warn\", \"error\", \"debug\"] as const)\n          console[level] = (...args: unknown[]) => sink(level, args);\n      if (m.outbound === \"fetcher\")\n        globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) =>\n          outbound(new Request(input, init))) as typeof fetch;\n      if (m.outbound === \"blocked\")\n        globalThis.fetch = (async () => {\n          throw new Error(\n            \"This worker is not permitted to access the internet via global functions like fetch(). It must use capabilities (such as bindings in 'env') to talk to the outside world.\",\n          );\n        }) as typeof fetch;\n      scope.bind({ env, exports }); // read while the module is evaluated\n      module = await importCode(m, sink);\n      exports = ctxExports(module, env);\n      scope.bind({ env, exports });\n      return Object.fromEntries(Object.entries(module).map(([k, v]) => [k, typeof v]));\n    }\n    if (m.type === \"image\") return await images.get(m.token)?.();\n    if (m.type === \"object\") {\n      const { rt, stub, key } = await facet(m.className, m.cellKey);\n      if (m.op === \"attach\") {\n        facetKeys.set(key, { key: m.cellKey, epoch: m.epoch });\n        return;\n      }\n      if (m.op === \"call\") return stub[m.method](...m.args);\n      if (m.op === \"restart\") return rt.restartObject(key);\n      if (m.op === \"delete\") {\n        await runInDurableObject(\n          stub,\n          (_o: unknown, ctx: { storage: { deleteAll(): Promise<void> } }) =>\n            ctx.storage.deleteAll(),\n        );\n        return rt.restartObject(key);\n      }\n      throw new Error(`unknown object op ${m.op}`);\n    }\n    if (m.type === \"call\") return exported(m.name, m.props)[m.method](...m.args);\n    throw new Error(`unknown isolate message ${m.type}`);\n  };\n  const { call, outbound } = isolatePort(port, handle, fetchTarget);\n}\n\nconst safe = (args: unknown[]) =>\n  args.map((a) => {\n    try {\n      return structuredClone(a);\n    } catch {\n      return String(a);\n    }\n  });\n"]}
+{"version":3,"file":"isolate.js","sourceRoot":"","sources":["../../src/isolate/isolate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEhE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAoB,iBAAiB,EAAqB,MAAM,oBAAoB,CAAC;AAE5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAoB,WAAW,EAAiB,MAAM,eAAe,CAAC;AAE7E,MAAM,UAAU,YAAY,CAC1B,IAAc,EACd,UAGqC,EACrC,IAAI,GAOA,EAAE;IAEN,IAAI,MAAM,GAA4B,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,sFAAsF;IACtF,oEAAoE;IACpE,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2C,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAChD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG;QACjB,YAAY,EAAE,IAAI;QAClB,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,IAAS;YACxC,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,CAAC,CAAC;gBAAE,OAAO;YACf,MAAM,KAAK,GAAG,EAAE,SAAS,CAAC;YAC1B,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,UAAU;gBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACpE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC;oBACT,IAAI,EAAE,SAAS;oBACf,EAAE,EAAE,WAAW;oBACf,OAAO,EAAE,CAAC,CAAC,GAAG;oBACd,IAAI,EAAE;wBACJ,GAAG,EAAE,IAAI,CAAC,GAAG;wBACb,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,KAAK,EAAE,CAAC,CAAC,KAAK;wBACd,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK;qBAC7D;iBACF,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;KACF,CAAC;IACF,MAAM,MAAM,GAAG;QACb,KAAK,CAAC,IAAI,CAAC,OAAe;YACxB,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YAC9B,OAAO,CAAC;gBACN,CAAC,CAAE,CAAC,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAA4B;gBAC3F,CAAC,CAAC,SAAS,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,IAAI,KAAI,CAAC;KAChB,CAAC;IACF,6FAA6F;IAC7F,wFAAwF;IACxF,4FAA4F;IAC5F,+FAA+F;IAC/F,MAAM,SAAS,GAAU;QACvB,KAAK,CAAC,UAAU,CAAC,OAAO;YACtB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC,mDAAmD;YAC9F,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK;gBACjC,IAAI;gBACJ,OAAO,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;aACT,CAAC;QACnB,CAAC;KACF,CAAC;IACF,IAAI,OAAY,CAAC;IACjB,IAAI,GAAqC,CAAC;IAC1C,MAAM,aAAa,GAAG,KAAK,EAAE,SAAiB,EAAE,EAAE;QAChD,IAAI,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC,IAAI,CAAC,OAAO;gBACf,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAClF,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC;YAC1B,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;YAC7D,IAAI,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,UAAU;gBACzC,MAAM,IAAI,KAAK,CAAC,wCAAwC,SAAS,GAAG,CAAC,CAAC;YACxE,EAAE,GAAG,iBAAiB,CAAC;gBACrB,MAAM,EAAE,EAAE,GAAI,MAAuB,EAAE,OAAO,EAAE,EAAE,EAAE;gBACpD,cAAc,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE;gBAC9C,OAAO;gBACP,IAAI,EAAE,GAAG,EAAE,uDAAuD;gBAClE,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE;gBAC1C,MAAM,EAAE,IAAI,EAAE,kEAAkE;gBAChF,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;oBACf,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC9B,OAAO,IAAI,KAAK,SAAS;wBACvB,CAAC,CAAC,SAAS;wBACX,CAAC,CAAE,EAAG,CAAC,GAAG,CAAC,SAAS,CAAgD,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC1F,CAAC;aACF,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IACF,IAAI,GAAG,GAA4B,EAAE,CAAC;IACtC,IAAI,OAAO,GAA4B,EAAE,CAAC;IAC1C,kGAAkG;IAClG,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,6FAA6F;IAC7F,8FAA8F;IAC9F,8EAA8E;IAC9E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,uFAAuF;IACvF,MAAM,KAAK,GAAG,KAAK,EAAE,SAAiB,EAAE,OAAe,EAAE,EAAE;QACzD,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,CAG1B,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,SAAS,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;IAC5F,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,KAAe,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,GAAG,CAAC,CAAC;QACrF,OAAO,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,KAAK,EAAE,CAAc,EAAE,GAAY,EAAqB,EAAE,CAC5E,WAAW,IAAI,CAAC;QACd,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QACvD,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,EAAE,CAAM,EAAE,EAAE;QAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,GAAG,CAAC,CAAC;YACZ,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,kEAAkE;YAC/E,mFAAmF;YACnF,mFAAmF;YACnF,iDAAiD;YACjD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,IAAe,EAAE,EAAE,CAC9C,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjE,IAAI,IAAI,CAAC,YAAY,KAAK,KAAK;gBAC7B,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAU;oBACpE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC/D,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;gBAC1B,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAE,EAAE,CACzE,QAAQ,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAiB,CAAC;YACxD,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;gBAC1B,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE;oBAC7B,MAAM,IAAI,KAAK,CACb,2KAA2K,CAC5K,CAAC;gBACJ,CAAC,CAAiB,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,qCAAqC;YACnE,MAAM,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACnC,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YAC7B,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QAC7D,gFAAgF;QAChF,oFAAoF;QACpF,oFAAoF;QACpF,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxB,WAAW,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;YAChD,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACtB,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBACvD,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;oBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC7D,OAAO;YACT,CAAC;YACD,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;YACtD,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YACrD,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACtB,MAAM,kBAAkB,CACtB,IAAI,EACJ,CAAC,EAAW,EAAE,GAAgD,EAAE,EAAE,CAChE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAC1B,CAAC;gBACF,OAAO,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,IAAe,EAAE,EAAE,CAC/B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;IACb,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACH,CAAC,CAAC,CAAC","sourcesContent":["/**\n * The isolate side: loads the Worker code in THIS realm and serves fetch/RPC for the host.\n * `importCode` is realm specific (data: URL of a bundle on Node, a site URL in browsers).\n */\nimport { ctxExports, entrypointStub } from \"../core/handles.js\";\nimport type { DurableObjectId } from \"../core/id.js\";\nimport { runInDurableObject } from \"../core/namespace.js\";\nimport { type CellRuntime, createCellRuntime, type WorkerModule } from \"../core/runtime.js\";\nimport type { Lease, LeaseHandle, OpenCellSql } from \"../ports.js\";\nimport { realmWorkerScope } from \"../project/worker-scope.js\";\nimport { CfWebSocket } from \"../ws/server.js\";\nimport { type FetchTarget, isolatePort, type PortLike } from \"./protocol.js\";\n\nexport function serveIsolate(\n  port: PortLike,\n  importCode: (\n    load: any,\n    logs: (level: string, args: unknown[]) => void,\n  ) => Promise<Record<string, unknown>>,\n  opts: {\n    patchConsole?: boolean;\n    /**\n     * Storage for Durable Object classes run INSIDE this isolate (facets of loaded code):\n     * each facet is a cell of an isolate-local runtime, with its own SQLite.\n     */\n    openSql?: (load: any) => OpenCellSql | Promise<OpenCellSql>;\n  } = {},\n) {\n  let module: Record<string, unknown> = {};\n  const runtimes = new Map<string, CellRuntime>();\n  // Facet logging through the host: the isolate-local cell key → the facet's key in the\n  // root's storage (celld: <root>/facets/<sha>) and the root's epoch.\n  const facetKeys = new Map<string, { key: string; epoch?: number }>();\n  const images = new Map<number, () => unknown>();\n  let nextImage = 0;\n  const hostLogged = (internal: string) => facetKeys.get(internal);\n  const durability = {\n    capturePages: true,\n    async committed(cellKey: string, info: any) {\n      const f = hostLogged(cellKey);\n      if (!f) return;\n      const token = ++nextImage;\n      if (typeof info.image === \"function\") images.set(token, info.image);\n      try {\n        await call({\n          type: \"durable\",\n          op: \"committed\",\n          cellKey: f.key,\n          info: {\n            seq: info.seq,\n            pages: info.pages,\n            epoch: f.epoch,\n            image: typeof info.image === \"function\" ? token : info.image,\n          },\n        });\n      } finally {\n        images.delete(token);\n      }\n    },\n  };\n  const backup = {\n    async load(cellKey: string) {\n      const f = hostLogged(cellKey);\n      return f\n        ? ((await call({ type: \"durable\", op: \"load\", cellKey: f.key })) as Uint8Array | undefined)\n        : undefined;\n    },\n    async save() {},\n  };\n  // The host holds the root's lease and attaches each facet with its epoch: handing that epoch\n  // out as the facet's own lease makes its ObjectHost rebuild the local database from the\n  // bucket when it opens, as a root does under a lease (a pool kept from an earlier ownership\n  // is older than what other nodes wrote since). Without an epoch, the local file stays primary.\n  const ownership: Lease = {\n    async tryAcquire(cellKey) {\n      const lost = new AbortController().signal; // fencing stays with the root's lease, in the host\n      return {\n        name: cellKey,\n        epoch: hostLogged(cellKey)?.epoch,\n        lost,\n        release: async () => {},\n      } as LeaseHandle;\n    },\n  };\n  let loadMsg: any;\n  let sql: Promise<OpenCellSql> | undefined;\n  const objectRuntime = async (className: string) => {\n    let rt = runtimes.get(className);\n    if (!rt) {\n      if (!opts.openSql)\n        throw new Error(\"this isolate cannot host Durable Object classes (no storage)\");\n      sql ??= Promise.resolve(opts.openSql(loadMsg));\n      const openSql = await sql;\n      if (runtimes.has(className)) return runtimes.get(className)!;\n      if (typeof module[className] !== \"function\")\n        throw new Error(`Loaded worker does not export class \"${className}\"`);\n      rt = createCellRuntime({\n        worker: { ...(module as WorkerModule), default: {} },\n        durableObjects: { [className]: { className } },\n        openSql,\n        vars: env, // the loaded Worker's env: plain values and host stubs\n        storage: { durability, backup, ownership },\n        facets: true, // rows move to this run's scope on open, as celld does for facets\n        ctxIdOf: (key) => {\n          const name = idNames.get(key);\n          return name === undefined\n            ? undefined\n            : (rt!.env[className] as { idFromName(n: string): DurableObjectId }).idFromName(name);\n        },\n      });\n      runtimes.set(className, rt);\n    }\n    return rt;\n  };\n  let env: Record<string, unknown> = {};\n  let exports: Record<string, unknown> = {};\n  // The loaded Worker is this realm's own: its `cloudflare:workers` reads `env` and `exports` here.\n  const scope = realmWorkerScope();\n  // The name of the `id` a facet was given by `ctx.facets.get`, by its isolate-local cell key:\n  // the facet's `ctx.id` (partyserver's `this.name`). Two facets may be given the same id; each\n  // keeps its own object and storage, addressed by the parent's facet cell key.\n  const idNames = new Map<string, string>();\n  // A facet of loaded code: the object lives here, named by the parent's facet cell key.\n  const facet = async (className: string, cellKey: string) => {\n    const rt = await objectRuntime(className);\n    const ns = rt.env[className] as {\n      getByName(n: string): any;\n      idFromName(n: string): { toString(): string };\n    };\n    return { rt, stub: ns.getByName(cellKey), key: `${className}/${ns.idFromName(cellKey)}` };\n  };\n  const exported = (name: string, props?: unknown) => {\n    const target = module[name];\n    if (target === undefined) throw new Error(`Loaded worker does not export \"${name}\"`);\n    return entrypointStub(target, env, props, exports);\n  };\n  const fetchTarget = async (t: FetchTarget, req: Request): Promise<Response> =>\n    \"className\" in t\n      ? (await facet(t.className, t.cellKey)).stub.fetch(req)\n      : exported(t.name, t.props).fetch(req);\n  const handle = async (m: any) => {\n    if (m.type === \"load\") {\n      loadMsg = m;\n      env = m.env; // host bindings arrive as stubs: every call goes back to the host\n      // Logs go to the host (Tail Workers, and the host prints them): through the global\n      // console, or — where the realm has other code that logs — a console scoped to the\n      // loaded modules (importCode receives the sink).\n      const sink = (level: string, args: unknown[]) =>\n        call({ type: \"log\", level, args: safe(args) }).catch(() => {});\n      if (opts.patchConsole !== false)\n        for (const level of [\"log\", \"info\", \"warn\", \"error\", \"debug\"] as const)\n          console[level] = (...args: unknown[]) => sink(level, args);\n      if (m.outbound === \"fetcher\")\n        globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) =>\n          outbound(new Request(input, init))) as typeof fetch;\n      if (m.outbound === \"blocked\")\n        globalThis.fetch = (async () => {\n          throw new Error(\n            \"This worker is not permitted to access the internet via global functions like fetch(). It must use capabilities (such as bindings in 'env') to talk to the outside world.\",\n          );\n        }) as typeof fetch;\n      scope.bind({ env, exports }); // read while the module is evaluated\n      module = await importCode(m, sink);\n      exports = ctxExports(module, env);\n      scope.bind({ env, exports });\n      return Object.fromEntries(Object.entries(module).map(([k, v]) => [k, typeof v]));\n    }\n    if (m.type === \"image\") return await images.get(m.token)?.();\n    // The host is stopping this isolate: the sockets accepted here hear 1001 first.\n    // A socket whose early frames went through a relay port hears it one hop later: the\n    // answer waits a macrotask, so the host does not terminate the isolate before that.\n    if (m.type === \"goAway\") {\n      CfWebSocket.goAway(\"the loaded Worker stopped\");\n      return await new Promise((r) => setTimeout(r, 0));\n    }\n    if (m.type === \"object\") {\n      const { rt, stub, key } = await facet(m.className, m.cellKey);\n      if (m.op === \"attach\") {\n        facetKeys.set(key, { key: m.cellKey, epoch: m.epoch });\n        if (typeof m.idName === \"string\") idNames.set(key, m.idName);\n        return;\n      }\n      if (m.op === \"call\") return stub[m.method](...m.args);\n      if (m.op === \"restart\") return rt.restartObject(key);\n      if (m.op === \"delete\") {\n        await runInDurableObject(\n          stub,\n          (_o: unknown, ctx: { storage: { deleteAll(): Promise<void> } }) =>\n            ctx.storage.deleteAll(),\n        );\n        return rt.restartObject(key);\n      }\n      throw new Error(`unknown object op ${m.op}`);\n    }\n    if (m.type === \"call\") return exported(m.name, m.props)[m.method](...m.args);\n    throw new Error(`unknown isolate message ${m.type}`);\n  };\n  const { call, outbound } = isolatePort(port, handle, fetchTarget);\n}\n\nconst safe = (args: unknown[]) =>\n  args.map((a) => {\n    try {\n      return structuredClone(a);\n    } catch {\n      return String(a);\n    }\n  });\n"]}

package/dist/isolate/node-entry.js

@@ -1,10 +1,21 @@
 // A worker thread hosting ONE loaded Worker (an isolate); see src/isolate/protocol.ts.
 import { parentPort } from "node:worker_threads";
 import { nodeSqliteOpener } from "../adapters/node-sqlite.js";
+import { CellsRequest, CellsResponse, WebSocket, WebSocketPair, WebSocketRequestResponsePair, } from "../project/workers-globals-module.js";
 import { serveIsolate } from "./isolate.js";
 // An exception no request awaits (a timer, ctx.abort() from one) is reported, and the isolate
 // lives on, as in a browser Dedicated Worker and workerd; Node would end the thread.
 process.on("uncaughtException", (e) => console.error("Uncaught", e));
+// This thread is the loaded Worker's realm: its globals are the Workers ones, as in a browser
+// isolate (src/isolate/isolate-worker.ts). A `Response` that takes `{ status: 101, webSocket }`
+// and a `WebSocketPair` are what a Worker that accepts WebSockets needs.
+Object.assign(globalThis, {
+    Request: CellsRequest,
+    Response: CellsResponse,
+    WebSocket,
+    WebSocketPair,
+    WebSocketRequestResponsePair,
+});
 serveIsolate(parentPort, async ({ source }) => import(`data:text/javascript;base64,${Buffer.from(source ?? "").toString("base64")}`), 
 // Facets of the loaded code keep their SQLite here: files under `dataDir` when the host
 // gives one, else in memory (lost with the isolate).

package/dist/isolate/node-entry.js.map

@@ -1 +1 @@
-{"version":3,"file":"node-entry.js","sourceRoot":"","sources":["../../src/isolate/node-entry.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,8FAA8F;AAC9F,qFAAqF;AACrF,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;AAErE,YAAY,CACV,UAAiC,EACjC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CACnB,MAAM,CAAC,+BAA+B,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AACvF,wFAAwF;AACxF,qDAAqD;AACrD,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CACvD,CAAC","sourcesContent":["// A worker thread hosting ONE loaded Worker (an isolate); see src/isolate/protocol.ts.\nimport { parentPort } from \"node:worker_threads\";\nimport { nodeSqliteOpener } from \"../adapters/node-sqlite.js\";\nimport { serveIsolate } from \"./isolate.js\";\nimport type { PortLike } from \"./protocol.js\";\n\n// An exception no request awaits (a timer, ctx.abort() from one) is reported, and the isolate\n// lives on, as in a browser Dedicated Worker and workerd; Node would end the thread.\nprocess.on(\"uncaughtException\", (e) => console.error(\"Uncaught\", e));\n\nserveIsolate(\n  parentPort as unknown as PortLike,\n  async ({ source }) =>\n    import(`data:text/javascript;base64,${Buffer.from(source ?? \"\").toString(\"base64\")}`),\n  // Facets of the loaded code keep their SQLite here: files under `dataDir` when the host\n  // gives one, else in memory (lost with the isolate).\n  { openSql: (load) => nodeSqliteOpener(load?.dataDir) },\n);\n"]}
+{"version":3,"file":"node-entry.js","sourceRoot":"","sources":["../../src/isolate/node-entry.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EACL,YAAY,EACZ,aAAa,EACb,SAAS,EACT,aAAa,EACb,4BAA4B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,8FAA8F;AAC9F,qFAAqF;AACrF,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;AAErE,8FAA8F;AAC9F,gGAAgG;AAChG,yEAAyE;AACzE,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE;IACxB,OAAO,EAAE,YAAY;IACrB,QAAQ,EAAE,aAAa;IACvB,SAAS;IACT,aAAa;IACb,4BAA4B;CAC7B,CAAC,CAAC;AAEH,YAAY,CACV,UAAiC,EACjC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CACnB,MAAM,CAAC,+BAA+B,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AACvF,wFAAwF;AACxF,qDAAqD;AACrD,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CACvD,CAAC","sourcesContent":["// A worker thread hosting ONE loaded Worker (an isolate); see src/isolate/protocol.ts.\nimport { parentPort } from \"node:worker_threads\";\nimport { nodeSqliteOpener } from \"../adapters/node-sqlite.js\";\nimport {\n  CellsRequest,\n  CellsResponse,\n  WebSocket,\n  WebSocketPair,\n  WebSocketRequestResponsePair,\n} from \"../project/workers-globals-module.js\";\nimport { serveIsolate } from \"./isolate.js\";\nimport type { PortLike } from \"./protocol.js\";\n\n// An exception no request awaits (a timer, ctx.abort() from one) is reported, and the isolate\n// lives on, as in a browser Dedicated Worker and workerd; Node would end the thread.\nprocess.on(\"uncaughtException\", (e) => console.error(\"Uncaught\", e));\n\n// This thread is the loaded Worker's realm: its globals are the Workers ones, as in a browser\n// isolate (src/isolate/isolate-worker.ts). A `Response` that takes `{ status: 101, webSocket }`\n// and a `WebSocketPair` are what a Worker that accepts WebSockets needs.\nObject.assign(globalThis, {\n  Request: CellsRequest,\n  Response: CellsResponse,\n  WebSocket,\n  WebSocketPair,\n  WebSocketRequestResponsePair,\n});\n\nserveIsolate(\n  parentPort as unknown as PortLike,\n  async ({ source }) =>\n    import(`data:text/javascript;base64,${Buffer.from(source ?? \"\").toString(\"base64\")}`),\n  // Facets of the loaded code keep their SQLite here: files under `dataDir` when the host\n  // gives one, else in memory (lost with the isolate).\n  { openSql: (load) => nodeSqliteOpener(load?.dataDir) },\n);\n"]}

package/dist/isolate/protocol.d.ts

@@ -20,6 +20,11 @@
  * Fetches: one port per request (meta: its target and URL), HTTP/1.1 with streamed bodies,
  * as cells-http over a port (src/transport/port.ts): host → isolate to an export or facet,
  * isolate → host for the loaded code's global `fetch()` when a `globalOutbound` Fetcher routes it.
+ * A WebSocket upgrade (host → isolate) has a port of its own instead, since HTTP/1.1 drops the
+ * `Upgrade` header: its meta carries the request's method and headers; the isolate answers with
+ * the response's head and closes the port. A 101's head carries the socket's own MessagePort,
+ * transferred: the socket's frames then go straight between the client and the isolate, outside
+ * the multiplexer, so open sockets hold none of its ports (it allows `maxPorts` at once).
  */
 export interface PortLike {
     postMessage(msg: unknown, transfer?: Transferable[]): void;

package/dist/isolate/protocol.js

@@ -1,7 +1,9 @@
 import { fetchOverDuplex, serveFetchOverDuplex } from "@statewalker/webrun-http-streams";
-import { callPort, duplexOverPort, listenPort, multiplexPort, NO_TIMEOUT, serveDuplexOverPort, structuredCodec, } from "@statewalker/webrun-rpc";
+import { callPort, duplexOverPort, getPortCloseSignal, listenPort, multiplexPort, NO_TIMEOUT, serveDuplexOverPort, structuredCodec, } from "@statewalker/webrun-rpc";
 import { cross, pipeTo, rpcPromise, STUB } from "../core/handles.js";
 import { withUrl } from "../core/request-body.js";
+import { CellsResponse, CfWebSocket, takeClientPort } from "../ws/server.js";
+import { carryWebSocketHeaders } from "../ws/upgrade.js";
 /**
  * The host's end of an isolate's port: one webrun-rpc multiplexer over it, a calls port on
  * which each side calls the other (`callPort`/`listenPort`, no timeout: a call lasts as long
@@ -12,6 +14,7 @@ export async function hostPort(port, handle, outbound) {
     const mux = multiplexPort(messageTarget(port), {
         codec: structuredCodec,
         side: "initiator",
+        maxPorts: maxPorts(),
         onPort(p, meta) {
             const m = meta;
             if (m?.kind !== "outbound" || !outbound)
@@ -21,7 +24,9 @@ export async function hostPort(port, handle, outbound) {
         },
     });
     const call = callsOver(await mux.openPort({ kind: "calls" }), handle);
-    const fetch = (target, req) => fetchOver(mux, { kind: "fetch", target }, req);
+    const fetch = (target, req) => isUpgrade(req)
+        ? upgradeOver(mux, { kind: "upgrade", target }, req)
+        : fetchOver(mux, { kind: "fetch", target }, req);
     return { call, fetch };
 }
 /**
@@ -34,12 +39,17 @@ export function isolatePort(port, handle, fetch) {
     const mux = multiplexPort(messageTarget(port), {
         codec: structuredCodec,
         side: "responder",
+        maxPorts: maxPorts(),
         onPort(p, meta) {
             const m = meta;
             if (m?.kind === "fetch") {
                 serveFetch(p, m.url, (r) => fetch(m.target, r));
                 return true;
             }
+            if (m?.kind === "upgrade") {
+                serveUpgrade(p, m, (r) => fetch(m.target, r));
+                return true;
+            }
             if (m?.kind !== "calls" || calls)
                 return false;
             calls = callsOver(p, handle);
@@ -61,6 +71,108 @@ function fetchOver(mux, meta, req) {
 function serveFetch(p, url, fetch) {
     serveDuplexOverPort(p, serveFetchOverDuplex((req) => withUrl(req, url).then(fetch).catch(throwOwn)));
 }
+const isUpgrade = (req) => req.headers.get("upgrade")?.toLowerCase() === "websocket";
+/**
+ * Ports of an isolate's multiplexer open at once: the calls port, and one per fetch or upgrade
+ * in flight (each closes when its exchange ends). `globalThis.__cellbMaxPorts` overrides it, as
+ * for src/transport/port.ts.
+ */
+const maxPorts = () => globalThis.__cellbMaxPorts ?? 4096;
+/** Statuses whose response has no body (`new Response(body, …)` refuses one). */
+const nullBody = (status) => [101, 204, 205, 304].includes(status);
+/**
+ * A WebSocket upgrade over a port of its own, closed once the isolate's answer is in. A 101
+ * becomes a Workers response whose `webSocket` is a client end over the socket's own port.
+ */
+async function upgradeOver(mux, meta, req) {
+    const p = await mux.openPort({
+        ...meta,
+        url: req.url,
+        method: req.method,
+        headers: [...req.headers],
+    });
+    return new Promise((resolve, reject) => {
+        // A port closed without an answer (the isolate refused it, or could not post one)
+        // fails the upgrade rather than leaving it pending.
+        const closed = getPortCloseSignal(p);
+        const onClosed = () => {
+            p.removeEventListener("message", onHead);
+            reject(closed?.reason ?? new Error("cellb: the isolate closed the upgrade without an answer"));
+        };
+        closed?.addEventListener("abort", onClosed, { once: true });
+        const onHead = (e) => {
+            p.removeEventListener("message", onHead);
+            closed?.removeEventListener("abort", onClosed);
+            void p.close?.();
+            try {
+                const head = e.data;
+                if ("error" in head)
+                    throw head.error;
+                if (head.status === 101 && head.socket)
+                    return resolve(new CellsResponse(null, {
+                        status: 101,
+                        headers: head.headers,
+                        webSocket: new CfWebSocket(head.socket),
+                    }));
+                resolve(new Response(nullBody(head.status) ? null : head.body, {
+                    status: head.status,
+                    statusText: head.statusText,
+                    headers: head.headers,
+                }));
+            }
+            catch (err) {
+                reject(err);
+            }
+        };
+        p.addEventListener("message", onHead);
+        void p.start?.();
+    });
+}
+/** Serves an upgrade on port `p`: a 101 hands over its client end's port; then `p` closes. */
+function serveUpgrade(p, meta, fetch) {
+    // A browser drops `Upgrade` and `Sec-WebSocket-*` from `new Request()`: carried over here.
+    const headers = new Headers(meta.headers);
+    const req = carryWebSocketHeaders(headers, new Request(meta.url, { method: meta.method, headers }));
+    const answer = (head, transfer = []) => {
+        try {
+            // The multiplexer drops a message it cannot copy, so check before posting; a 101
+            // head is not checked, since its socket port is transferred rather than copied.
+            if (transfer.length === 0)
+                cloneable(head);
+            p.postMessage(head, transfer);
+        }
+        catch {
+            // An error that cannot be copied (a function in its `cause`, say): its name and message.
+            const e = head.error;
+            p.postMessage({
+                error: Object.assign(new Error(String(e?.message ?? e)), {
+                    name: String(e?.name ?? "Error"),
+                }),
+            });
+        }
+    };
+    void (async () => {
+        try {
+            const res = await fetch(req);
+            const ws = res.webSocket;
+            if (res.status === 101 && ws) {
+                const socket = takeClientPort(ws);
+                answer({ status: 101, headers: [...res.headers], body: null, socket }, [socket]);
+            }
+            else
+                answer({
+                    status: res.status,
+                    statusText: res.statusText,
+                    headers: [...res.headers],
+                    body: nullBody(res.status) ? null : await res.arrayBuffer(),
+                });
+        }
+        catch (error) {
+            answer({ error });
+        }
+        void p.close?.();
+    })();
+}
 /** Marks a value passed by reference in a message: `{ [REF]: id }`. */
 const REF = "\u0000cellb.ref";
 /**

package/dist/isolate/protocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../src/isolate/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EACL,QAAQ,EACR,cAAc,EACd,UAAU,EAEV,aAAa,EACb,UAAU,EAEV,mBAAmB,EACnB,eAAe,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AA2ClD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAc,EACd,MAAc,EACd,QAA8C;IAE9C,MAAM,GAAG,GAAG,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE;QAC7C,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,WAAW;QACjB,MAAM,CAAC,CAAC,EAAE,IAAI;YACZ,MAAM,CAAC,GAAG,IAAkD,CAAC;YAC7D,IAAI,CAAC,EAAE,IAAI,KAAK,UAAU,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACtD,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,KAAK,GAAU,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IACrF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,IAAc,EACd,MAAc,EACd,KAAY;IAEZ,IAAI,KAAuB,CAAC;IAC5B,MAAM,GAAG,GAAG,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE;QAC7C,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,WAAW;QACjB,MAAM,CAAC,CAAC,EAAE,IAAI;YACZ,MAAM,CAAC,GAAG,IAAuE,CAAC;YAClF,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;gBACxB,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YAC/C,KAAK,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAM,CAAC,GAAG,CAAC;QAC1B,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,SAAS,CAAC,GAAY,EAAE,IAAY,EAAE,GAAY;IACzD,OAAO,eAAe,CACpB,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,KAAK,SAAS,CAAC;QACd,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC,CAAC,EAAE,EACN,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,CAAgB,EAAE,GAAW,EAAE,KAA0C;IAC3F,mBAAmB,CACjB,CAAC,EACD,oBAAoB,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,GAAG,GAAG,iBAAiB,CAAC;AAE9B;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,IAAmB,EAAE,MAAc;IACpD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAe,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,EAAE,CAC5B,SAAS,CACP,KAAK,CACH,CAAC,EACD,CAAC,CAAC,EAAE,EAAE;QACJ,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CACT,CACF,CAAC;IACJ,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,OAAO;QAC/B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;aACpB,CAAC;YACJ,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAS,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,CAAC,IAAc,EAAE,IAAe,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,MAAM,IAAI,GAAQ,IAAI,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,EAAE;YACpC,KAAK,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC;YAC5C,GAAG,CAAC,EAAE,EAAE,IAAI;gBACV,IAAI,IAAI,KAAK,IAAI;oBAAE,OAAO,IAAI,CAAC;gBAC/B,IAAI,IAAI,KAAK,MAAM,CAAC,OAAO;oBACzB,OAAO,GAAG,EAAE;wBACV,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;wBAC3B,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;oBAChC,CAAC,CAAC;gBACJ,IAAI,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,OAAO,SAAS,CAAC;gBAClE,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;YACtD,CAAC;SACF,CAAC,CAAC;QACH,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,uEAAuE;IACvE,MAAM,MAAM,GAAG,CAAC,CAAM,EAAO,EAAE;QAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;gBAAE,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACxE,IAAI,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5D,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,CAAM,EAAW,EAAE;QAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACzE,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC/E,OAAO,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC;IACF,yFAAyF;IACzF,WAAW;IACX,MAAM,KAAK,GAAG,KAAK,EAAE,CAAM,EAAE,EAAE;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;;gBACrC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,IAAI,CAAU,CAAC;QACf,IAAI,CAAC;YACH,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACb,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,UAAU,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAS,CAAC,GAAG,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,EAAE,UAAU,CAAC;QAC5B,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE,CACzB,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,6EAA6E;QAC7E,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxB,OAAO,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gGAAgG;AAChG,SAAS,QAAQ,CAAC,CAAU;IAC1B,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAC5B,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAG,CAAW,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,MAAM,CAAC,CAAC;AACV,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAI,KAAQ;IAC5B,eAAe,CAAC,KAAK,CAAC,CAAC;IACvB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kGAAkG;AAClG,SAAS,aAAa,CAAC,IAAc;IACnC,IAAI,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAqB,CAAC;IACxD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC9D,OAAO;QACL,WAAW,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC;QAC/D,gBAAgB,CAAC,KAAK,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAkB,CAAC,CAAC;YACtE,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC5B,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC1B,CAAC;QACD,mBAAmB,CAAC,KAAK,EAAE,EAAE;YAC3B,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC;YAC1C,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { fetchOverDuplex, serveFetchOverDuplex } from \"@statewalker/webrun-http-streams\";\nimport {\n  callPort,\n  duplexOverPort,\n  listenPort,\n  type MessageTarget,\n  multiplexPort,\n  NO_TIMEOUT,\n  type PortMux,\n  serveDuplexOverPort,\n  structuredCodec,\n} from \"@statewalker/webrun-rpc\";\nimport { cross, pipeTo, rpcPromise, STUB } from \"../core/handles.js\";\nimport { withUrl } from \"../core/request-body.js\";\n\n/**\n * Isolation for loaded Workers (celld runs each in its own V8 isolate): the loaded code runs\n * in a separate realm — a worker thread on Node, a Dedicated Worker in browsers — and talks\n * to the host over one MessagePort, multiplexed with `@statewalker/webrun-rpc`. The host keeps\n * everything else: bindings in the loaded Worker's env are reached through stubs, and its logs\n * come back for Tail Workers. Errors cross with their own properties (`name`, `code`, …).\n * Functions, `RpcTarget`s and stubs anywhere in a call or result cross by reference (as\n * workerd passes them): the far side gets a stub whose calls come back.\n *\n * Calls (one port, both directions; each names an `answer`, which the serving side keeps until\n * the caller has the result, so calls on it can be sent before then — promise pipelining):\n *   host → isolate   load {source|url, env, outbound}                     → loaded {exports}\n *                    call {name, method, args, props}                     → result\n *   isolate → host   log {level, args}\n *   either way       ref {id|on, path, args}  (a call on a stub of the other side's value, or\n *                                              on answer `on`: `path` is the property path\n *                                              called, [] the value itself)\n *                    release {id|answer}      (that stub was disposed or collected; the caller\n *                                              has that answer)\n * Fetches: one port per request (meta: its target and URL), HTTP/1.1 with streamed bodies,\n * as cells-http over a port (src/transport/port.ts): host → isolate to an export or facet,\n * isolate → host for the loaded code's global `fetch()` when a `globalOutbound` Fetcher routes it.\n */\nexport interface PortLike {\n  postMessage(msg: unknown, transfer?: Transferable[]): void;\n  addEventListener?(type: \"message\", fn: (e: { data: unknown }) => void): void;\n  removeEventListener?(type: \"message\", fn: (e: { data: unknown }) => void): void;\n  on?(type: \"message\", fn: (data: unknown) => void): void;\n  off?(type: \"message\", fn: (data: unknown) => void): void;\n  start?(): void;\n}\n\n/** Where a fetch goes in the isolate: an export of the loaded Worker, or one of its facets. */\nexport type FetchTarget =\n  | { name: string; props?: unknown }\n  | { className: string; cellKey: string };\ntype Fetch = (target: FetchTarget, req: Request) => Promise<Response>;\n\nexport type Call = <T = unknown>(msg: object) => Promise<T>;\ntype Handle = (msg: any) => Promise<unknown>;\n\n/**\n * The host's end of an isolate's port: one webrun-rpc multiplexer over it, a calls port on\n * which each side calls the other (`callPort`/`listenPort`, no timeout: a call lasts as long\n * as the work it starts), and a port per fetch. `outbound` serves the loaded code's global\n * `fetch()` (its `globalOutbound` Fetcher).\n */\nexport async function hostPort(\n  port: PortLike,\n  handle: Handle,\n  outbound?: (req: Request) => Promise<Response>,\n): Promise<{ call: Call; fetch: Fetch }> {\n  const mux = multiplexPort(messageTarget(port), {\n    codec: structuredCodec,\n    side: \"initiator\",\n    onPort(p, meta) {\n      const m = meta as { kind?: string; url: string } | undefined;\n      if (m?.kind !== \"outbound\" || !outbound) return false;\n      serveFetch(p, m.url, outbound);\n      return true;\n    },\n  });\n  const call = callsOver(await mux.openPort({ kind: \"calls\" }), handle);\n  const fetch: Fetch = (target, req) => fetchOver(mux, { kind: \"fetch\", target }, req);\n  return { call, fetch };\n}\n\n/**\n * The isolate's end: accepts the ports the host opens. Everything the isolate calls the host\n * for happens while serving a host call, so the calls port is open by then. `outbound` sends\n * a fetch to the host's `globalOutbound`.\n */\nexport function isolatePort(\n  port: PortLike,\n  handle: Handle,\n  fetch: Fetch,\n): { call: Call; outbound: (req: Request) => Promise<Response> } {\n  let calls: Call | undefined;\n  const mux = multiplexPort(messageTarget(port), {\n    codec: structuredCodec,\n    side: \"responder\",\n    onPort(p, meta) {\n      const m = meta as { kind?: string; target: FetchTarget; url: string } | undefined;\n      if (m?.kind === \"fetch\") {\n        serveFetch(p, m.url, (r) => fetch(m.target, r));\n        return true;\n      }\n      if (m?.kind !== \"calls\" || calls) return false;\n      calls = callsOver(p, handle);\n      return true;\n    },\n  });\n  return {\n    call: (msg) => calls!(msg),\n    outbound: (req) => fetchOver(mux, { kind: \"outbound\" }, req),\n  };\n}\n\n/** A fetch over a new port of `mux`; the URL rides in the meta (the HTTP/1.1 wire drops its scheme). */\nfunction fetchOver(mux: PortMux, meta: object, req: Request): Promise<Response> {\n  return fetchOverDuplex(\n    (input) =>\n      (async function* () {\n        yield* duplexOverPort(await mux.openPort({ ...meta, url: req.url }))(input);\n      })(),\n    req,\n  );\n}\n\n/** Serves the fetch on port `p` (its URL from the meta) with `fetch`. */\nfunction serveFetch(p: MessageTarget, url: string, fetch: (req: Request) => Promise<Response>) {\n  serveDuplexOverPort(\n    p,\n    serveFetchOverDuplex((req) => withUrl(req, url).then(fetch).catch(throwOwn)),\n  );\n}\n\n/** Marks a value passed by reference in a message: `{ [REF]: id }`. */\nconst REF = \"\\u0000cellb.ref\";\n\n/**\n * The calls of one port, with values passed by reference: each side keeps the values it\n * passed (by id, and how many ids hold each); the other side calls them through stubs. A\n * stub's `Symbol.dispose` (or its garbage collection) releases its id; the last release of a\n * value runs the value's own `Symbol.dispose`, as workerd does for an `RpcTarget`. A call\n * returns an RpcPromise: calls on it go to the other side at once, naming its answer.\n */\nfunction callsOver(port: MessageTarget, handle: Handle): Call {\n  const values = new Map<number, any>();\n  const answers = new Map<number, unknown>();\n  let lastAnswer = 0;\n  const holders = new Map<unknown, number>();\n  let lastId = 0;\n  const encode = (v: unknown) =>\n    cloneable(\n      cross(\n        v,\n        (x) => {\n          values.set(++lastId, x);\n          holders.set(x, (holders.get(x) ?? 0) + 1);\n          return { [REF]: lastId };\n        },\n        (x) => x, // the port copies the rest\n      ),\n    );\n  const release = (id: number) => {\n    const v = values.get(id);\n    if (!values.delete(id)) return;\n    const n = (holders.get(v) ?? 1) - 1;\n    if (n) holders.set(v, n);\n    else {\n      holders.delete(v);\n      v[Symbol.dispose]?.();\n    }\n  };\n  const send = (msg: object) => callPort(port, msg, { timeout: NO_TIMEOUT }).catch(() => {});\n  const collected = new FinalizationRegistry<number>((id) => send({ type: \"release\", id }));\n  const stubOf = (id: number) => {\n    const invoke = (path: string[], args: unknown[]) => call({ type: \"ref\", id, path, args });\n    const stub: any = new Proxy(() => {}, {\n      apply: (_t, _this, args) => invoke([], args),\n      get(_t, prop) {\n        if (prop === STUB) return true;\n        if (prop === Symbol.dispose)\n          return () => {\n            collected.unregister(stub);\n            send({ type: \"release\", id });\n          };\n        if (prop === \"then\" || typeof prop === \"symbol\") return undefined;\n        return (...args: unknown[]) => invoke([prop], args);\n      },\n    });\n    collected.register(stub, id, stub);\n    return stub;\n  };\n  // Messages arrive as fresh copies: stubs replace the markers in place.\n  const decode = (v: any): any => {\n    if (Array.isArray(v)) for (let i = 0; i < v.length; i++) v[i] = decode(v[i]);\n    else if (v && Object.getPrototypeOf(v) === Object.prototype) {\n      if (typeof v[REF] === \"number\") return stubOf(v[REF]);\n      for (const k of Object.keys(v)) v[k] = decode(v[k]);\n    }\n    return v;\n  };\n  const run = (m: any): unknown => {\n    if (m.type !== \"ref\") return handle(m);\n    if (m.on !== undefined) return pipeTo(answers.get(m.on), m.path, m.args);\n    const v = values.get(m.id);\n    if (v === undefined) throw new Error(\"A stub was used after it was disposed.\");\n    return pipeTo(v, m.path, m.args);\n  };\n  // The answer is kept as the message arrives: a pipelined call on it may arrive before it\n  // settles.\n  const serve = async (m: any) => {\n    if (m.type === \"release\") {\n      if (m.answer === undefined) release(m.id);\n      else answers.delete(m.answer);\n      return;\n    }\n    let r: unknown;\n    try {\n      r = run(m);\n    } catch (e) {\n      r = Promise.reject(e);\n    }\n    answers.set(m.answer, r);\n    return r;\n  };\n  listenPort(port, (msg) => serve(decode(msg)).then(encode).catch(throwOwn));\n  const call: Call = (msg) => {\n    const answer = ++lastAnswer;\n    const result = (async () =>\n      decode(await callPort(port, encode({ ...msg, answer }), { timeout: NO_TIMEOUT })))();\n    // Calls on the answer sent before now are ahead of this release on the port.\n    const done = () => send({ type: \"release\", answer });\n    result.then(done, done);\n    return rpcPromise(result, (path, args) => call({ type: \"ref\", on: answer, path, args }));\n  };\n  return call;\n}\n\n/** Errors cross with their own properties (so `code` does); `name` is inherited, so copy it. */\nfunction throwOwn(e: unknown): never {\n  if (e && typeof e === \"object\")\n    Object.defineProperty(e, \"name\", { value: (e as Error).name, enumerable: true });\n  throw e;\n}\n\n/**\n * Throws `DataCloneError` for a value the port cannot carry: the multiplexer drops a message\n * it fails to post, and the call would wait forever.\n */\nfunction cloneable<T>(value: T): T {\n  structuredClone(value);\n  return value;\n}\n\n/** A worker_threads Worker is an EventEmitter; MessagePorts and Dedicated Workers are targets. */\nfunction messageTarget(port: PortLike): MessageTarget {\n  if (port.addEventListener) return port as MessageTarget;\n  const on = port.on!.bind(port);\n  const listeners = new Map<unknown, (data: unknown) => void>();\n  return {\n    postMessage: (msg, transfer) => port.postMessage(msg, transfer),\n    addEventListener(_type, fn) {\n      const listener = (data: unknown) => void fn({ data } as MessageEvent);\n      listeners.set(fn, listener);\n      on(\"message\", listener);\n    },\n    removeEventListener(_type, fn) {\n      port.off?.(\"message\", listeners.get(fn)!);\n      listeners.delete(fn);\n    },\n  };\n}\n"]}
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../src/isolate/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EACL,QAAQ,EACR,cAAc,EACd,kBAAkB,EAClB,UAAU,EAEV,aAAa,EACb,UAAU,EAEV,mBAAmB,EACnB,eAAe,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAgDzD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAc,EACd,MAAc,EACd,QAA8C;IAE9C,MAAM,GAAG,GAAG,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE;QAC7C,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,QAAQ,EAAE;QACpB,MAAM,CAAC,CAAC,EAAE,IAAI;YACZ,MAAM,CAAC,GAAG,IAAkD,CAAC;YAC7D,IAAI,CAAC,EAAE,IAAI,KAAK,UAAU,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACtD,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,KAAK,GAAU,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CACnC,SAAS,CAAC,GAAG,CAAC;QACZ,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC;QACpD,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,IAAc,EACd,MAAc,EACd,KAAY;IAEZ,IAAI,KAAuB,CAAC;IAC5B,MAAM,GAAG,GAAG,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE;QAC7C,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,QAAQ,EAAE;QACpB,MAAM,CAAC,CAAC,EAAE,IAAI;YACZ,MAAM,CAAC,GAAG,IAAuE,CAAC;YAClF,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;gBACxB,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC1B,YAAY,CAAC,CAAC,EAAE,CAA2B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;gBACxE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YAC/C,KAAK,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAM,CAAC,GAAG,CAAC;QAC1B,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,SAAS,CAAC,GAAY,EAAE,IAAY,EAAE,GAAY;IACzD,OAAO,eAAe,CACpB,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,KAAK,SAAS,CAAC;QACd,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC,CAAC,EAAE,EACN,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,CAAgB,EAAE,GAAW,EAAE,KAA0C;IAC3F,mBAAmB,CACjB,CAAC,EACD,oBAAoB,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,WAAW,CAAC;AAO9F;;;;GAIG;AACH,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAE,UAA2C,CAAC,eAAe,IAAI,IAAI,CAAC;AAc5F,iFAAiF;AACjF,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAE3E;;;GAGG;AACH,KAAK,UAAU,WAAW,CAAC,GAAY,EAAE,IAAY,EAAE,GAAY;IACjE,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC;QAC3B,GAAG,IAAI;QACP,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;KACJ,CAAC,CAAC;IACzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,kFAAkF;QAClF,oDAAoD;QACpD,MAAM,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,CAAC,CAAC,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,CACJ,MAAM,EAAE,MAAM,IAAI,IAAI,KAAK,CAAC,yDAAyD,CAAC,CACvF,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,CAAC,CAAe,EAAE,EAAE;YACjC,CAAC,CAAC,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC/C,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,CAAC,IAAmB,CAAC;gBACnC,IAAI,OAAO,IAAI,IAAI;oBAAE,MAAM,IAAI,CAAC,KAAK,CAAC;gBACtC,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM;oBACpC,OAAO,OAAO,CACZ,IAAI,aAAa,CAAC,IAAI,EAAE;wBACtB,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,SAAS,EAAE,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;qBACxC,CAAC,CACH,CAAC;gBACJ,OAAO,CACL,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE;oBACrD,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC;QACF,CAAC,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACtC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8FAA8F;AAC9F,SAAS,YAAY,CACnB,CAAgB,EAChB,IAAiB,EACjB,KAA0C;IAE1C,2FAA2F;IAC3F,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,qBAAqB,CAC/B,OAAO,EACP,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CACxD,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,IAAiB,EAAE,QAAQ,GAAmB,EAAE,EAAE,EAAE;QAClE,IAAI,CAAC;YACH,iFAAiF;YACjF,gFAAgF;YAChF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3C,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,yFAAyF;YACzF,MAAM,CAAC,GAAI,IAA0D,CAAC,KAAK,CAAC;YAC5E,CAAC,CAAC,WAAW,CAAC;gBACZ,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE;oBACvD,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,IAAI,OAAO,CAAC;iBACjC,CAAC;aACmB,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,EAAE,GAAI,GAA0C,CAAC,SAAS,CAAC;YACjE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,EAAE,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;gBAClC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YACnF,CAAC;;gBACC,MAAM,CAAC;oBACL,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;oBACzB,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE;iBAC5D,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACpB,CAAC;QACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IACnB,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,uEAAuE;AACvE,MAAM,GAAG,GAAG,iBAAiB,CAAC;AAE9B;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,IAAmB,EAAE,MAAc;IACpD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAe,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,EAAE,CAC5B,SAAS,CACP,KAAK,CACH,CAAC,EACD,CAAC,CAAC,EAAE,EAAE;QACJ,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CACT,CACF,CAAC;IACJ,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,OAAO;QAC/B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;aACpB,CAAC;YACJ,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAS,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,CAAC,IAAc,EAAE,IAAe,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,MAAM,IAAI,GAAQ,IAAI,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,EAAE;YACpC,KAAK,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC;YAC5C,GAAG,CAAC,EAAE,EAAE,IAAI;gBACV,IAAI,IAAI,KAAK,IAAI;oBAAE,OAAO,IAAI,CAAC;gBAC/B,IAAI,IAAI,KAAK,MAAM,CAAC,OAAO;oBACzB,OAAO,GAAG,EAAE;wBACV,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;wBAC3B,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;oBAChC,CAAC,CAAC;gBACJ,IAAI,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,OAAO,SAAS,CAAC;gBAClE,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;YACtD,CAAC;SACF,CAAC,CAAC;QACH,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,uEAAuE;IACvE,MAAM,MAAM,GAAG,CAAC,CAAM,EAAO,EAAE;QAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;gBAAE,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACxE,IAAI,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5D,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,CAAM,EAAW,EAAE;QAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACzE,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC/E,OAAO,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC;IACF,yFAAyF;IACzF,WAAW;IACX,MAAM,KAAK,GAAG,KAAK,EAAE,CAAM,EAAE,EAAE;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;;gBACrC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,IAAI,CAAU,CAAC;QACf,IAAI,CAAC;YACH,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACb,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,UAAU,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAS,CAAC,GAAG,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,EAAE,UAAU,CAAC;QAC5B,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE,CACzB,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,6EAA6E;QAC7E,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxB,OAAO,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gGAAgG;AAChG,SAAS,QAAQ,CAAC,CAAU;IAC1B,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAC5B,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAG,CAAW,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,MAAM,CAAC,CAAC;AACV,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAI,KAAQ;IAC5B,eAAe,CAAC,KAAK,CAAC,CAAC;IACvB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kGAAkG;AAClG,SAAS,aAAa,CAAC,IAAc;IACnC,IAAI,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAqB,CAAC;IACxD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC9D,OAAO;QACL,WAAW,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC;QAC/D,gBAAgB,CAAC,KAAK,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAkB,CAAC,CAAC;YACtE,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC5B,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC1B,CAAC;QACD,mBAAmB,CAAC,KAAK,EAAE,EAAE;YAC3B,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC;YAC1C,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { fetchOverDuplex, serveFetchOverDuplex } from \"@statewalker/webrun-http-streams\";\nimport {\n  callPort,\n  duplexOverPort,\n  getPortCloseSignal,\n  listenPort,\n  type MessageTarget,\n  multiplexPort,\n  NO_TIMEOUT,\n  type PortMux,\n  serveDuplexOverPort,\n  structuredCodec,\n} from \"@statewalker/webrun-rpc\";\nimport { cross, pipeTo, rpcPromise, STUB } from \"../core/handles.js\";\nimport { withUrl } from \"../core/request-body.js\";\nimport { CellsResponse, CfWebSocket, takeClientPort } from \"../ws/server.js\";\nimport { carryWebSocketHeaders } from \"../ws/upgrade.js\";\n\n/**\n * Isolation for loaded Workers (celld runs each in its own V8 isolate): the loaded code runs\n * in a separate realm — a worker thread on Node, a Dedicated Worker in browsers — and talks\n * to the host over one MessagePort, multiplexed with `@statewalker/webrun-rpc`. The host keeps\n * everything else: bindings in the loaded Worker's env are reached through stubs, and its logs\n * come back for Tail Workers. Errors cross with their own properties (`name`, `code`, …).\n * Functions, `RpcTarget`s and stubs anywhere in a call or result cross by reference (as\n * workerd passes them): the far side gets a stub whose calls come back.\n *\n * Calls (one port, both directions; each names an `answer`, which the serving side keeps until\n * the caller has the result, so calls on it can be sent before then — promise pipelining):\n *   host → isolate   load {source|url, env, outbound}                     → loaded {exports}\n *                    call {name, method, args, props}                     → result\n *   isolate → host   log {level, args}\n *   either way       ref {id|on, path, args}  (a call on a stub of the other side's value, or\n *                                              on answer `on`: `path` is the property path\n *                                              called, [] the value itself)\n *                    release {id|answer}      (that stub was disposed or collected; the caller\n *                                              has that answer)\n * Fetches: one port per request (meta: its target and URL), HTTP/1.1 with streamed bodies,\n * as cells-http over a port (src/transport/port.ts): host → isolate to an export or facet,\n * isolate → host for the loaded code's global `fetch()` when a `globalOutbound` Fetcher routes it.\n * A WebSocket upgrade (host → isolate) has a port of its own instead, since HTTP/1.1 drops the\n * `Upgrade` header: its meta carries the request's method and headers; the isolate answers with\n * the response's head and closes the port. A 101's head carries the socket's own MessagePort,\n * transferred: the socket's frames then go straight between the client and the isolate, outside\n * the multiplexer, so open sockets hold none of its ports (it allows `maxPorts` at once).\n */\nexport interface PortLike {\n  postMessage(msg: unknown, transfer?: Transferable[]): void;\n  addEventListener?(type: \"message\", fn: (e: { data: unknown }) => void): void;\n  removeEventListener?(type: \"message\", fn: (e: { data: unknown }) => void): void;\n  on?(type: \"message\", fn: (data: unknown) => void): void;\n  off?(type: \"message\", fn: (data: unknown) => void): void;\n  start?(): void;\n}\n\n/** Where a fetch goes in the isolate: an export of the loaded Worker, or one of its facets. */\nexport type FetchTarget =\n  | { name: string; props?: unknown }\n  | { className: string; cellKey: string };\ntype Fetch = (target: FetchTarget, req: Request) => Promise<Response>;\n\nexport type Call = <T = unknown>(msg: object) => Promise<T>;\ntype Handle = (msg: any) => Promise<unknown>;\n\n/**\n * The host's end of an isolate's port: one webrun-rpc multiplexer over it, a calls port on\n * which each side calls the other (`callPort`/`listenPort`, no timeout: a call lasts as long\n * as the work it starts), and a port per fetch. `outbound` serves the loaded code's global\n * `fetch()` (its `globalOutbound` Fetcher).\n */\nexport async function hostPort(\n  port: PortLike,\n  handle: Handle,\n  outbound?: (req: Request) => Promise<Response>,\n): Promise<{ call: Call; fetch: Fetch }> {\n  const mux = multiplexPort(messageTarget(port), {\n    codec: structuredCodec,\n    side: \"initiator\",\n    maxPorts: maxPorts(),\n    onPort(p, meta) {\n      const m = meta as { kind?: string; url: string } | undefined;\n      if (m?.kind !== \"outbound\" || !outbound) return false;\n      serveFetch(p, m.url, outbound);\n      return true;\n    },\n  });\n  const call = callsOver(await mux.openPort({ kind: \"calls\" }), handle);\n  const fetch: Fetch = (target, req) =>\n    isUpgrade(req)\n      ? upgradeOver(mux, { kind: \"upgrade\", target }, req)\n      : fetchOver(mux, { kind: \"fetch\", target }, req);\n  return { call, fetch };\n}\n\n/**\n * The isolate's end: accepts the ports the host opens. Everything the isolate calls the host\n * for happens while serving a host call, so the calls port is open by then. `outbound` sends\n * a fetch to the host's `globalOutbound`.\n */\nexport function isolatePort(\n  port: PortLike,\n  handle: Handle,\n  fetch: Fetch,\n): { call: Call; outbound: (req: Request) => Promise<Response> } {\n  let calls: Call | undefined;\n  const mux = multiplexPort(messageTarget(port), {\n    codec: structuredCodec,\n    side: \"responder\",\n    maxPorts: maxPorts(),\n    onPort(p, meta) {\n      const m = meta as { kind?: string; target: FetchTarget; url: string } | undefined;\n      if (m?.kind === \"fetch\") {\n        serveFetch(p, m.url, (r) => fetch(m.target, r));\n        return true;\n      }\n      if (m?.kind === \"upgrade\") {\n        serveUpgrade(p, m as unknown as UpgradeMeta, (r) => fetch(m.target, r));\n        return true;\n      }\n      if (m?.kind !== \"calls\" || calls) return false;\n      calls = callsOver(p, handle);\n      return true;\n    },\n  });\n  return {\n    call: (msg) => calls!(msg),\n    outbound: (req) => fetchOver(mux, { kind: \"outbound\" }, req),\n  };\n}\n\n/** A fetch over a new port of `mux`; the URL rides in the meta (the HTTP/1.1 wire drops its scheme). */\nfunction fetchOver(mux: PortMux, meta: object, req: Request): Promise<Response> {\n  return fetchOverDuplex(\n    (input) =>\n      (async function* () {\n        yield* duplexOverPort(await mux.openPort({ ...meta, url: req.url }))(input);\n      })(),\n    req,\n  );\n}\n\n/** Serves the fetch on port `p` (its URL from the meta) with `fetch`. */\nfunction serveFetch(p: MessageTarget, url: string, fetch: (req: Request) => Promise<Response>) {\n  serveDuplexOverPort(\n    p,\n    serveFetchOverDuplex((req) => withUrl(req, url).then(fetch).catch(throwOwn)),\n  );\n}\n\nconst isUpgrade = (req: Request) => req.headers.get(\"upgrade\")?.toLowerCase() === \"websocket\";\n\ninterface UpgradeMeta {\n  url: string;\n  method: string;\n  headers: [string, string][];\n}\n/**\n * Ports of an isolate's multiplexer open at once: the calls port, and one per fetch or upgrade\n * in flight (each closes when its exchange ends). `globalThis.__cellbMaxPorts` overrides it, as\n * for src/transport/port.ts.\n */\nconst maxPorts = () => (globalThis as { __cellbMaxPorts?: number }).__cellbMaxPorts ?? 4096;\n\n/** The isolate's answer to an upgrade: the head of its response, or the error it threw. */\ntype UpgradeHead =\n  | {\n      status: number;\n      statusText?: string;\n      headers: [string, string][];\n      body: ArrayBuffer | null;\n      /** A 101's socket: the port of its client end, transferred. */\n      socket?: MessagePort;\n    }\n  | { error: unknown };\n\n/** Statuses whose response has no body (`new Response(body, …)` refuses one). */\nconst nullBody = (status: number) => [101, 204, 205, 304].includes(status);\n\n/**\n * A WebSocket upgrade over a port of its own, closed once the isolate's answer is in. A 101\n * becomes a Workers response whose `webSocket` is a client end over the socket's own port.\n */\nasync function upgradeOver(mux: PortMux, meta: object, req: Request): Promise<Response> {\n  const p = await mux.openPort({\n    ...meta,\n    url: req.url,\n    method: req.method,\n    headers: [...req.headers],\n  } satisfies UpgradeMeta);\n  return new Promise((resolve, reject) => {\n    // A port closed without an answer (the isolate refused it, or could not post one)\n    // fails the upgrade rather than leaving it pending.\n    const closed = getPortCloseSignal(p);\n    const onClosed = () => {\n      p.removeEventListener(\"message\", onHead);\n      reject(\n        closed?.reason ?? new Error(\"cellb: the isolate closed the upgrade without an answer\"),\n      );\n    };\n    closed?.addEventListener(\"abort\", onClosed, { once: true });\n    const onHead = (e: MessageEvent) => {\n      p.removeEventListener(\"message\", onHead);\n      closed?.removeEventListener(\"abort\", onClosed);\n      void p.close?.();\n      try {\n        const head = e.data as UpgradeHead;\n        if (\"error\" in head) throw head.error;\n        if (head.status === 101 && head.socket)\n          return resolve(\n            new CellsResponse(null, {\n              status: 101,\n              headers: head.headers,\n              webSocket: new CfWebSocket(head.socket),\n            }),\n          );\n        resolve(\n          new Response(nullBody(head.status) ? null : head.body, {\n            status: head.status,\n            statusText: head.statusText,\n            headers: head.headers,\n          }),\n        );\n      } catch (err) {\n        reject(err);\n      }\n    };\n    p.addEventListener(\"message\", onHead);\n    void p.start?.();\n  });\n}\n\n/** Serves an upgrade on port `p`: a 101 hands over its client end's port; then `p` closes. */\nfunction serveUpgrade(\n  p: MessageTarget,\n  meta: UpgradeMeta,\n  fetch: (req: Request) => Promise<Response>,\n) {\n  // A browser drops `Upgrade` and `Sec-WebSocket-*` from `new Request()`: carried over here.\n  const headers = new Headers(meta.headers);\n  const req = carryWebSocketHeaders(\n    headers,\n    new Request(meta.url, { method: meta.method, headers }),\n  );\n  const answer = (head: UpgradeHead, transfer: Transferable[] = []) => {\n    try {\n      // The multiplexer drops a message it cannot copy, so check before posting; a 101\n      // head is not checked, since its socket port is transferred rather than copied.\n      if (transfer.length === 0) cloneable(head);\n      p.postMessage(head, transfer);\n    } catch {\n      // An error that cannot be copied (a function in its `cause`, say): its name and message.\n      const e = (head as { error?: { name?: unknown; message?: unknown } }).error;\n      p.postMessage({\n        error: Object.assign(new Error(String(e?.message ?? e)), {\n          name: String(e?.name ?? \"Error\"),\n        }),\n      } satisfies UpgradeHead);\n    }\n  };\n  void (async () => {\n    try {\n      const res = await fetch(req);\n      const ws = (res as { webSocket?: CfWebSocket | null }).webSocket;\n      if (res.status === 101 && ws) {\n        const socket = takeClientPort(ws);\n        answer({ status: 101, headers: [...res.headers], body: null, socket }, [socket]);\n      } else\n        answer({\n          status: res.status,\n          statusText: res.statusText,\n          headers: [...res.headers],\n          body: nullBody(res.status) ? null : await res.arrayBuffer(),\n        });\n    } catch (error) {\n      answer({ error });\n    }\n    void p.close?.();\n  })();\n}\n\n/** Marks a value passed by reference in a message: `{ [REF]: id }`. */\nconst REF = \"\\u0000cellb.ref\";\n\n/**\n * The calls of one port, with values passed by reference: each side keeps the values it\n * passed (by id, and how many ids hold each); the other side calls them through stubs. A\n * stub's `Symbol.dispose` (or its garbage collection) releases its id; the last release of a\n * value runs the value's own `Symbol.dispose`, as workerd does for an `RpcTarget`. A call\n * returns an RpcPromise: calls on it go to the other side at once, naming its answer.\n */\nfunction callsOver(port: MessageTarget, handle: Handle): Call {\n  const values = new Map<number, any>();\n  const answers = new Map<number, unknown>();\n  let lastAnswer = 0;\n  const holders = new Map<unknown, number>();\n  let lastId = 0;\n  const encode = (v: unknown) =>\n    cloneable(\n      cross(\n        v,\n        (x) => {\n          values.set(++lastId, x);\n          holders.set(x, (holders.get(x) ?? 0) + 1);\n          return { [REF]: lastId };\n        },\n        (x) => x, // the port copies the rest\n      ),\n    );\n  const release = (id: number) => {\n    const v = values.get(id);\n    if (!values.delete(id)) return;\n    const n = (holders.get(v) ?? 1) - 1;\n    if (n) holders.set(v, n);\n    else {\n      holders.delete(v);\n      v[Symbol.dispose]?.();\n    }\n  };\n  const send = (msg: object) => callPort(port, msg, { timeout: NO_TIMEOUT }).catch(() => {});\n  const collected = new FinalizationRegistry<number>((id) => send({ type: \"release\", id }));\n  const stubOf = (id: number) => {\n    const invoke = (path: string[], args: unknown[]) => call({ type: \"ref\", id, path, args });\n    const stub: any = new Proxy(() => {}, {\n      apply: (_t, _this, args) => invoke([], args),\n      get(_t, prop) {\n        if (prop === STUB) return true;\n        if (prop === Symbol.dispose)\n          return () => {\n            collected.unregister(stub);\n            send({ type: \"release\", id });\n          };\n        if (prop === \"then\" || typeof prop === \"symbol\") return undefined;\n        return (...args: unknown[]) => invoke([prop], args);\n      },\n    });\n    collected.register(stub, id, stub);\n    return stub;\n  };\n  // Messages arrive as fresh copies: stubs replace the markers in place.\n  const decode = (v: any): any => {\n    if (Array.isArray(v)) for (let i = 0; i < v.length; i++) v[i] = decode(v[i]);\n    else if (v && Object.getPrototypeOf(v) === Object.prototype) {\n      if (typeof v[REF] === \"number\") return stubOf(v[REF]);\n      for (const k of Object.keys(v)) v[k] = decode(v[k]);\n    }\n    return v;\n  };\n  const run = (m: any): unknown => {\n    if (m.type !== \"ref\") return handle(m);\n    if (m.on !== undefined) return pipeTo(answers.get(m.on), m.path, m.args);\n    const v = values.get(m.id);\n    if (v === undefined) throw new Error(\"A stub was used after it was disposed.\");\n    return pipeTo(v, m.path, m.args);\n  };\n  // The answer is kept as the message arrives: a pipelined call on it may arrive before it\n  // settles.\n  const serve = async (m: any) => {\n    if (m.type === \"release\") {\n      if (m.answer === undefined) release(m.id);\n      else answers.delete(m.answer);\n      return;\n    }\n    let r: unknown;\n    try {\n      r = run(m);\n    } catch (e) {\n      r = Promise.reject(e);\n    }\n    answers.set(m.answer, r);\n    return r;\n  };\n  listenPort(port, (msg) => serve(decode(msg)).then(encode).catch(throwOwn));\n  const call: Call = (msg) => {\n    const answer = ++lastAnswer;\n    const result = (async () =>\n      decode(await callPort(port, encode({ ...msg, answer }), { timeout: NO_TIMEOUT })))();\n    // Calls on the answer sent before now are ahead of this release on the port.\n    const done = () => send({ type: \"release\", answer });\n    result.then(done, done);\n    return rpcPromise(result, (path, args) => call({ type: \"ref\", on: answer, path, args }));\n  };\n  return call;\n}\n\n/** Errors cross with their own properties (so `code` does); `name` is inherited, so copy it. */\nfunction throwOwn(e: unknown): never {\n  if (e && typeof e === \"object\")\n    Object.defineProperty(e, \"name\", { value: (e as Error).name, enumerable: true });\n  throw e;\n}\n\n/**\n * Throws `DataCloneError` for a value the port cannot carry: the multiplexer drops a message\n * it fails to post, and the call would wait forever.\n */\nfunction cloneable<T>(value: T): T {\n  structuredClone(value);\n  return value;\n}\n\n/** A worker_threads Worker is an EventEmitter; MessagePorts and Dedicated Workers are targets. */\nfunction messageTarget(port: PortLike): MessageTarget {\n  if (port.addEventListener) return port as MessageTarget;\n  const on = port.on!.bind(port);\n  const listeners = new Map<unknown, (data: unknown) => void>();\n  return {\n    postMessage: (msg, transfer) => port.postMessage(msg, transfer),\n    addEventListener(_type, fn) {\n      const listener = (data: unknown) => void fn({ data } as MessageEvent);\n      listeners.set(fn, listener);\n      on(\"message\", listener);\n    },\n    removeEventListener(_type, fn) {\n      port.off?.(\"message\", listeners.get(fn)!);\n      listeners.delete(fn);\n    },\n  };\n}\n"]}

package/dist/node-compat/crypto.js

@@ -2,9 +2,9 @@
  * `node:crypto` subset for browsers (nodejs_compat): hashes, HMAC, random, timingSafeEqual, and
  * public `KeyObject`s (`createPublicKey`) without signature checks.
  */
-import { hmac } from "@noble/hashes/hmac";
-import { md5, sha1 } from "@noble/hashes/legacy";
-import { sha256, sha384, sha512 } from "@noble/hashes/sha2";
+import { hmac } from "@noble/hashes/hmac.js";
+import { md5, sha1 } from "@noble/hashes/legacy.js";
+import { sha256, sha384, sha512 } from "@noble/hashes/sha2.js";
 import { Buffer } from "buffer";
 const HASHES = { md5, sha1, sha256, sha384, sha512 };
 const algo = (name) => {

package/dist/node-compat/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/node-compat/crypto.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAW,CAAC;AAE9D,MAAM,IAAI,GAAG,CAAC,IAAY,EAAyB,EAAE;IACnD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AACF,MAAM,KAAK,GAAG,CAAC,IAAyB,EAAE,GAAoB,EAAE,EAAE,CAChE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAErF,MAAM,IAAI;IAEqB,EAAE;IAD/B,MAAM,GAAiB,EAAE,CAAC;IAC1B,YAA6B,EAAiC;kBAAjC,EAAE;IAAkC,CAAC;IAClE,MAAM,CAAC,IAAyB,EAAE,GAAoB;QACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAoB;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtD,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACvC,CAAC;CACF;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9B,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,GAAwB;IAC/D,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAU,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AACD,MAAM,UAAU,UAAU;IACxB,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,CAAa,EAAE,CAAa;IAC1D,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QAC/B,MAAM,IAAI,UAAU,CAAC,8CAA8C,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,MAAM,IAAI,GAAyB;IACjC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC;IAC/D,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;IAClD,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC;IAC/B,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,GAAe,EAAE,MAAgB,EAAE,EAAE;IACrD,KAAK,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;gBAAE,SAAS,KAAK,CAAC;QACrF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,OAAO,SAAS;IACX,IAAI,GAAG,QAAQ,CAAC;IAChB,iBAAiB,CAAqB;IACtC,IAAI,CAAa;IACjB,OAAO,CAAmB;IACnC,YAAY,GAAe,EAAE,MAAwB;QACnD,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,iBAAiB;YACpB,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,CAAC,IAAI,GAA8C,EAAE;QACzD,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC;YACzE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAChF,OAAO,cAAc,KAAK,UAAU,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,KAAK,SAAS,CAAC;QACzF,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,CAAC,KAAgB;QACrB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAY,CAAC;QAClC,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,EAAY,CAAC;QACnC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;CACF;AAQD,MAAM,UAAU,eAAe,CAAC,KAAe;IAC7C,IAAI,KAAK,YAAY,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/F,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7F,MAAM,CAAC,GAAG,qDAAqD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1E,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QACrE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC;QAC3F,OAAO,IAAI,SAAS,CAClB,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,EAC/D,CAAC,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,SAAS,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,QAAQ,GAAG,GAAU,EAAE;IAC3B,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;AACJ,CAAC,CAAC;AACF,MAAM,UAAU,MAAM,CAAC,GAAG,KAAgB;IACxC,OAAO,QAAQ,EAAE,CAAC;AACpB,CAAC;AACD,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,OAAO;QACL,MAAM;YACJ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,QAAQ;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC;AAC3C,MAAM,CAAC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;AAC/C,eAAe;IACb,UAAU;IACV,UAAU;IACV,UAAU;IACV,WAAW;IACX,eAAe;IACf,SAAS;IACT,eAAe;IACf,MAAM;IACN,YAAY;IACZ,SAAS;IACT,MAAM;CACP,CAAC","sourcesContent":["/**\n * `node:crypto` subset for browsers (nodejs_compat): hashes, HMAC, random, timingSafeEqual, and\n * public `KeyObject`s (`createPublicKey`) without signature checks.\n */\nimport { hmac } from \"@noble/hashes/hmac\";\nimport { md5, sha1 } from \"@noble/hashes/legacy\";\nimport { sha256, sha384, sha512 } from \"@noble/hashes/sha2\";\nimport { Buffer } from \"buffer\";\n\nconst HASHES = { md5, sha1, sha256, sha384, sha512 } as const;\ntype Algo = keyof typeof HASHES;\nconst algo = (name: string): (typeof HASHES)[Algo] => {\n  const h = HASHES[name.toLowerCase().replace(\"-\", \"\") as Algo];\n  if (!h) throw new Error(`Digest method not supported: ${name}`);\n  return h;\n};\nconst bytes = (data: string | Uint8Array, enc?: BufferEncoding) =>\n  typeof data === \"string\" ? new Uint8Array(Buffer.from(data, enc ?? \"utf8\")) : data;\n\nclass Hash {\n  #parts: Uint8Array[] = [];\n  constructor(private readonly fn: (m: Uint8Array) => Uint8Array) {}\n  update(data: string | Uint8Array, enc?: BufferEncoding): this {\n    this.#parts.push(bytes(data, enc));\n    return this;\n  }\n  digest(enc?: BufferEncoding): Buffer | string {\n    const all = Buffer.concat(this.#parts);\n    const out = Buffer.from(this.fn(new Uint8Array(all)));\n    return enc ? out.toString(enc) : out;\n  }\n}\n\nexport function createHash(name: string) {\n  return new Hash(algo(name));\n}\nexport function createHmac(name: string, key: string | Uint8Array) {\n  const h = algo(name);\n  return new Hash((m) => hmac(h as never, bytes(key), m));\n}\nexport function randomUUID(): string {\n  return crypto.randomUUID();\n}\nexport function randomBytes(n: number): Buffer {\n  return Buffer.from(crypto.getRandomValues(new Uint8Array(n)));\n}\nexport function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n  if (a.byteLength !== b.byteLength)\n    throw new RangeError(\"Input buffers must have the same byte length\");\n  let d = 0;\n  for (let i = 0; i < a.byteLength; i++) d |= a[i] ^ b[i];\n  return d === 0;\n}\n\nconst OIDS: [number[], string][] = [\n  [[0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01], \"rsa\"],\n  [[0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01], \"ec\"],\n  [[0x2b, 0x65, 0x70], \"ed25519\"],\n  [[0x2b, 0x65, 0x71], \"ed448\"],\n];\nconst contains = (hay: Uint8Array, needle: number[]) => {\n  outer: for (let i = 0; i + needle.length <= hay.length; i++) {\n    for (let j = 0; j < needle.length; j++) if (hay[i + j] !== needle[j]) continue outer;\n    return true;\n  }\n  return false;\n};\n\n/**\n * A public key as `createPublicKey` returns it: its type and its bytes, exportable as DER or\n * PEM. Libraries build these when they load (sigstore's trust roots, in EmDash's plugin\n * registry); signatures are checked through `verify`, which is not available here.\n */\nexport class KeyObject {\n  readonly type = \"public\";\n  readonly asymmetricKeyType: string | undefined;\n  readonly #der: Uint8Array;\n  readonly #format: \"spki\" | \"pkcs1\";\n  constructor(der: Uint8Array, format: \"spki\" | \"pkcs1\") {\n    this.#der = der;\n    this.#format = format;\n    this.asymmetricKeyType =\n      format === \"pkcs1\" ? \"rsa\" : OIDS.find(([oid]) => contains(der.subarray(0, 32), oid))?.[1];\n  }\n  export(opts: { format?: \"der\" | \"pem\"; type?: string } = {}): Buffer | string {\n    if (opts.format === \"pem\") {\n      const label = this.#format === \"pkcs1\" ? \"RSA PUBLIC KEY\" : \"PUBLIC KEY\";\n      const b64 = Buffer.from(this.#der).toString(\"base64\").replace(/.{64}/g, \"$&\\n\");\n      return `-----BEGIN ${label}-----\\n${b64.replace(/\\n$/, \"\")}\\n-----END ${label}-----\\n`;\n    }\n    return Buffer.from(this.#der);\n  }\n  equals(other: KeyObject): boolean {\n    const a = this.export() as Buffer;\n    const b = other.export() as Buffer;\n    return a.length === b.length && timingSafeEqual(a, b);\n  }\n}\n\ntype KeyInput =\n  | string\n  | Uint8Array\n  | KeyObject\n  | { key: string | Uint8Array; format?: \"pem\" | \"der\"; type?: \"spki\" | \"pkcs1\" };\n\nexport function createPublicKey(input: KeyInput): KeyObject {\n  if (input instanceof KeyObject) return input;\n  const spec = typeof input === \"string\" || input instanceof Uint8Array ? { key: input } : input;\n  if (typeof spec.key === \"string\" || spec.format === \"pem\") {\n    const pem = typeof spec.key === \"string\" ? spec.key : Buffer.from(spec.key).toString(\"utf8\");\n    const m = /-----BEGIN ([A-Z ]+)-----([\\s\\S]*?)-----END \\1-----/.exec(pem);\n    if (!m) throw new TypeError(\"createPublicKey: not a PEM public key\");\n    if (!/PUBLIC KEY/.test(m[1]))\n      throw new Error(`createPublicKey: ${m[1]} is not supported in browsers (nodejs_compat)`);\n    return new KeyObject(\n      new Uint8Array(Buffer.from(m[2].replace(/\\s+/g, \"\"), \"base64\")),\n      m[1] === \"RSA PUBLIC KEY\" ? \"pkcs1\" : \"spki\",\n    );\n  }\n  return new KeyObject(new Uint8Array(spec.key), spec.type === \"pkcs1\" ? \"pkcs1\" : \"spki\");\n}\n\nconst noVerify = (): never => {\n  throw new Error(\n    \"node:crypto signature verification is not available in browsers (nodejs_compat)\",\n  );\n};\nexport function verify(..._args: unknown[]): boolean {\n  return noVerify();\n}\nexport function createVerify(_algorithm: string) {\n  return {\n    update() {\n      return this;\n    },\n    verify: noVerify,\n  };\n}\n\nexport const webcrypto = globalThis.crypto;\nexport const subtle = globalThis.crypto.subtle;\nexport default {\n  createHash,\n  createHmac,\n  randomUUID,\n  randomBytes,\n  timingSafeEqual,\n  KeyObject,\n  createPublicKey,\n  verify,\n  createVerify,\n  webcrypto,\n  subtle,\n};\n"]}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/node-compat/crypto.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAW,CAAC;AAE9D,MAAM,IAAI,GAAG,CAAC,IAAY,EAAyB,EAAE;IACnD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AACF,MAAM,KAAK,GAAG,CAAC,IAAyB,EAAE,GAAoB,EAAE,EAAE,CAChE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAErF,MAAM,IAAI;IAEqB,EAAE;IAD/B,MAAM,GAAiB,EAAE,CAAC;IAC1B,YAA6B,EAAiC;kBAAjC,EAAE;IAAkC,CAAC;IAClE,MAAM,CAAC,IAAyB,EAAE,GAAoB;QACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAoB;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtD,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACvC,CAAC;CACF;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9B,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,GAAwB;IAC/D,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAU,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AACD,MAAM,UAAU,UAAU;IACxB,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,CAAa,EAAE,CAAa;IAC1D,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QAC/B,MAAM,IAAI,UAAU,CAAC,8CAA8C,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,MAAM,IAAI,GAAyB;IACjC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC;IAC/D,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;IAClD,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC;IAC/B,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,GAAe,EAAE,MAAgB,EAAE,EAAE;IACrD,KAAK,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;gBAAE,SAAS,KAAK,CAAC;QACrF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,OAAO,SAAS;IACX,IAAI,GAAG,QAAQ,CAAC;IAChB,iBAAiB,CAAqB;IACtC,IAAI,CAAa;IACjB,OAAO,CAAmB;IACnC,YAAY,GAAe,EAAE,MAAwB;QACnD,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,iBAAiB;YACpB,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,CAAC,IAAI,GAA8C,EAAE;QACzD,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC;YACzE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAChF,OAAO,cAAc,KAAK,UAAU,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,KAAK,SAAS,CAAC;QACzF,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,CAAC,KAAgB;QACrB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAY,CAAC;QAClC,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,EAAY,CAAC;QACnC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;CACF;AAQD,MAAM,UAAU,eAAe,CAAC,KAAe;IAC7C,IAAI,KAAK,YAAY,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/F,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7F,MAAM,CAAC,GAAG,qDAAqD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1E,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QACrE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC;QAC3F,OAAO,IAAI,SAAS,CAClB,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,EAC/D,CAAC,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,SAAS,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,QAAQ,GAAG,GAAU,EAAE;IAC3B,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;AACJ,CAAC,CAAC;AACF,MAAM,UAAU,MAAM,CAAC,GAAG,KAAgB;IACxC,OAAO,QAAQ,EAAE,CAAC;AACpB,CAAC;AACD,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,OAAO;QACL,MAAM;YACJ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,QAAQ;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC;AAC3C,MAAM,CAAC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;AAC/C,eAAe;IACb,UAAU;IACV,UAAU;IACV,UAAU;IACV,WAAW;IACX,eAAe;IACf,SAAS;IACT,eAAe;IACf,MAAM;IACN,YAAY;IACZ,SAAS;IACT,MAAM;CACP,CAAC","sourcesContent":["/**\n * `node:crypto` subset for browsers (nodejs_compat): hashes, HMAC, random, timingSafeEqual, and\n * public `KeyObject`s (`createPublicKey`) without signature checks.\n */\nimport { hmac } from \"@noble/hashes/hmac.js\";\nimport { md5, sha1 } from \"@noble/hashes/legacy.js\";\nimport { sha256, sha384, sha512 } from \"@noble/hashes/sha2.js\";\nimport { Buffer } from \"buffer\";\n\nconst HASHES = { md5, sha1, sha256, sha384, sha512 } as const;\ntype Algo = keyof typeof HASHES;\nconst algo = (name: string): (typeof HASHES)[Algo] => {\n  const h = HASHES[name.toLowerCase().replace(\"-\", \"\") as Algo];\n  if (!h) throw new Error(`Digest method not supported: ${name}`);\n  return h;\n};\nconst bytes = (data: string | Uint8Array, enc?: BufferEncoding) =>\n  typeof data === \"string\" ? new Uint8Array(Buffer.from(data, enc ?? \"utf8\")) : data;\n\nclass Hash {\n  #parts: Uint8Array[] = [];\n  constructor(private readonly fn: (m: Uint8Array) => Uint8Array) {}\n  update(data: string | Uint8Array, enc?: BufferEncoding): this {\n    this.#parts.push(bytes(data, enc));\n    return this;\n  }\n  digest(enc?: BufferEncoding): Buffer | string {\n    const all = Buffer.concat(this.#parts);\n    const out = Buffer.from(this.fn(new Uint8Array(all)));\n    return enc ? out.toString(enc) : out;\n  }\n}\n\nexport function createHash(name: string) {\n  return new Hash(algo(name));\n}\nexport function createHmac(name: string, key: string | Uint8Array) {\n  const h = algo(name);\n  return new Hash((m) => hmac(h as never, bytes(key), m));\n}\nexport function randomUUID(): string {\n  return crypto.randomUUID();\n}\nexport function randomBytes(n: number): Buffer {\n  return Buffer.from(crypto.getRandomValues(new Uint8Array(n)));\n}\nexport function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n  if (a.byteLength !== b.byteLength)\n    throw new RangeError(\"Input buffers must have the same byte length\");\n  let d = 0;\n  for (let i = 0; i < a.byteLength; i++) d |= a[i] ^ b[i];\n  return d === 0;\n}\n\nconst OIDS: [number[], string][] = [\n  [[0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01], \"rsa\"],\n  [[0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01], \"ec\"],\n  [[0x2b, 0x65, 0x70], \"ed25519\"],\n  [[0x2b, 0x65, 0x71], \"ed448\"],\n];\nconst contains = (hay: Uint8Array, needle: number[]) => {\n  outer: for (let i = 0; i + needle.length <= hay.length; i++) {\n    for (let j = 0; j < needle.length; j++) if (hay[i + j] !== needle[j]) continue outer;\n    return true;\n  }\n  return false;\n};\n\n/**\n * A public key as `createPublicKey` returns it: its type and its bytes, exportable as DER or\n * PEM. Libraries build these when they load (sigstore's trust roots, in EmDash's plugin\n * registry); signatures are checked through `verify`, which is not available here.\n */\nexport class KeyObject {\n  readonly type = \"public\";\n  readonly asymmetricKeyType: string | undefined;\n  readonly #der: Uint8Array;\n  readonly #format: \"spki\" | \"pkcs1\";\n  constructor(der: Uint8Array, format: \"spki\" | \"pkcs1\") {\n    this.#der = der;\n    this.#format = format;\n    this.asymmetricKeyType =\n      format === \"pkcs1\" ? \"rsa\" : OIDS.find(([oid]) => contains(der.subarray(0, 32), oid))?.[1];\n  }\n  export(opts: { format?: \"der\" | \"pem\"; type?: string } = {}): Buffer | string {\n    if (opts.format === \"pem\") {\n      const label = this.#format === \"pkcs1\" ? \"RSA PUBLIC KEY\" : \"PUBLIC KEY\";\n      const b64 = Buffer.from(this.#der).toString(\"base64\").replace(/.{64}/g, \"$&\\n\");\n      return `-----BEGIN ${label}-----\\n${b64.replace(/\\n$/, \"\")}\\n-----END ${label}-----\\n`;\n    }\n    return Buffer.from(this.#der);\n  }\n  equals(other: KeyObject): boolean {\n    const a = this.export() as Buffer;\n    const b = other.export() as Buffer;\n    return a.length === b.length && timingSafeEqual(a, b);\n  }\n}\n\ntype KeyInput =\n  | string\n  | Uint8Array\n  | KeyObject\n  | { key: string | Uint8Array; format?: \"pem\" | \"der\"; type?: \"spki\" | \"pkcs1\" };\n\nexport function createPublicKey(input: KeyInput): KeyObject {\n  if (input instanceof KeyObject) return input;\n  const spec = typeof input === \"string\" || input instanceof Uint8Array ? { key: input } : input;\n  if (typeof spec.key === \"string\" || spec.format === \"pem\") {\n    const pem = typeof spec.key === \"string\" ? spec.key : Buffer.from(spec.key).toString(\"utf8\");\n    const m = /-----BEGIN ([A-Z ]+)-----([\\s\\S]*?)-----END \\1-----/.exec(pem);\n    if (!m) throw new TypeError(\"createPublicKey: not a PEM public key\");\n    if (!/PUBLIC KEY/.test(m[1]))\n      throw new Error(`createPublicKey: ${m[1]} is not supported in browsers (nodejs_compat)`);\n    return new KeyObject(\n      new Uint8Array(Buffer.from(m[2].replace(/\\s+/g, \"\"), \"base64\")),\n      m[1] === \"RSA PUBLIC KEY\" ? \"pkcs1\" : \"spki\",\n    );\n  }\n  return new KeyObject(new Uint8Array(spec.key), spec.type === \"pkcs1\" ? \"pkcs1\" : \"spki\");\n}\n\nconst noVerify = (): never => {\n  throw new Error(\n    \"node:crypto signature verification is not available in browsers (nodejs_compat)\",\n  );\n};\nexport function verify(..._args: unknown[]): boolean {\n  return noVerify();\n}\nexport function createVerify(_algorithm: string) {\n  return {\n    update() {\n      return this;\n    },\n    verify: noVerify,\n  };\n}\n\nexport const webcrypto = globalThis.crypto;\nexport const subtle = globalThis.crypto.subtle;\nexport default {\n  createHash,\n  createHmac,\n  randomUUID,\n  randomBytes,\n  timingSafeEqual,\n  KeyObject,\n  createPublicKey,\n  verify,\n  createVerify,\n  webcrypto,\n  subtle,\n};\n"]}

package/dist/peer/celld-peer.d.ts

@@ -1,5 +1,6 @@
 import type { ObjectStore } from "../bucket/object-store.js";
 import type { CellRuntime } from "../core/runtime.js";
+import { type CfWebSocket } from "../ws/server.js";
 /** The fleet's peer secret (celld creates it in the bucket). */
 export declare function loadPeerKey(store: ObjectStore): Promise<Uint8Array>;
 /** Headers that sign one peer request from `source` to `target`. */
@@ -23,6 +24,22 @@ export interface CelldPeerServer {
     addr: string;
     close(): Promise<void>;
 }
+/**
+ * The subprotocols a `Sec-WebSocket-Protocol` header offers, as a client may ask for them: the
+ * valid tokens, each once (case-insensitively), in the offered order. A header a client sent
+ * through celld is not trusted to be well formed, and the client class refuses a malformed list.
+ */
+export declare function offeredProtocols(header: string | undefined): string[];
+/**
+ * The cell's side of a tunneled WebSocket: a client socket on the port of the 101's
+ * WebSocketPair end. It asks for the subprotocols the far client offered (`offered`, the
+ * `Sec-WebSocket-Protocol` header): a client refuses a subprotocol it did not ask for, and the
+ * cell picks one of those. Should the socket not be made, the port is closed, and the cell's
+ * end with it.
+ */
+export declare function cellSocket(res: Response & {
+    webSocket: CfWebSocket;
+}, offered: string | undefined): WebSocket;
 /**
  * Serves celld's peer tunnel for `runtime` on `host:port` (0: any free port). `node` is this
  * node's name in the fleet (the same as celldBucket's `node`).

package/dist/peer/celld-peer.js

@@ -142,6 +142,48 @@ function reply(res, status, headers, body) {
     res.end(body);
 }
 const stale = (res) => reply(res, 409, { "x-cells-route-error": "stale-owner", "content-type": "text/plain" }, "stale route");
+/** RFC 7230 `token`: what a subprotocol name may be. */
+const TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+/**
+ * The subprotocols a `Sec-WebSocket-Protocol` header offers, as a client may ask for them: the
+ * valid tokens, each once (case-insensitively), in the offered order. A header a client sent
+ * through celld is not trusted to be well formed, and the client class refuses a malformed list.
+ */
+export function offeredProtocols(header) {
+    const seen = new Set();
+    const out = [];
+    for (const raw of (header ?? "").split(",")) {
+        const p = raw.trim();
+        if (!TOKEN.test(p) || seen.has(p.toLowerCase()))
+            continue;
+        seen.add(p.toLowerCase());
+        out.push(p);
+    }
+    return out;
+}
+/**
+ * The cell's side of a tunneled WebSocket: a client socket on the port of the 101's
+ * WebSocketPair end. It asks for the subprotocols the far client offered (`offered`, the
+ * `Sec-WebSocket-Protocol` header): a client refuses a subprotocol it did not ask for, and the
+ * cell picks one of those. Should the socket not be made, the port is closed, and the cell's
+ * end with it.
+ */
+export function cellSocket(res, offered) {
+    const port = takeClientPort(res.webSocket);
+    try {
+        const WS = createWebSocketClass(async () => ({
+            port,
+            protocol: res.headers.get("Sec-WebSocket-Protocol") ?? undefined,
+        }));
+        const cell = new WS("ws://cell/", offeredProtocols(offered));
+        cell.binaryType = "arraybuffer";
+        return cell;
+    }
+    catch (error) {
+        port.close();
+        throw error;
+    }
+}
 /**
  * Serves celld's peer tunnel for `runtime` on `host:port` (0: any free port). `node` is this
  * node's name in the fleet (the same as celldBucket's `node`).
@@ -265,13 +307,13 @@ export async function startCelldPeerServer(opts) {
         }
         if (res.status !== 101 || !res.webSocket)
             return fail(res.status, await res.text());
-        const port = takeClientPort(res.webSocket);
-        const WS = createWebSocketClass(async () => ({
-            port,
-            protocol: res.headers.get("Sec-WebSocket-Protocol") ?? undefined,
-        }));
-        const cell = new WS("ws://cell/");
-        cell.binaryType = "arraybuffer";
+        let cell;
+        try {
+            cell = cellSocket(res, protocols);
+        }
+        catch (e) {
+            return fail(400, String(e?.message ?? e));
+        }
         const pending = [];
         let open = false;
         wss.handleUpgrade(req, socket, head, (client) => {