@tapflowio/relay 0.18.0 → 0.20.0

package/README.md

@@ -6,7 +6,7 @@ Handles NAT traversal between browser clients and device agents, session routing
 
 ## Requirements
 
-- Node.js ≥ 20
+- Node.js ≥ 22
 
 ## Usage
 

package/dist/RelayServer.d.ts

@@ -1,4 +1,31 @@
 export declare function isExternalAddress(addr: string): boolean;
+/** Exported for the re-join test, which pins both edges of this window rather than hardcoding 500 —
+ *  a test carrying its own copy of the number passes when the constant moves, which is the drift the
+ *  wire-contract work keeps finding. Not re-exported from the package index. */
+export declare const IDR_REQUEST_THROTTLE_MS = 500;
+/** The same window for `network:request-state`, and a **separate constant on purpose**: the two share
+ *  a number today and not a policy. IDR drops inside the window; this one coalesces onto its trailing
+ *  edge (see `networkStateRequester`). Sharing the constant would mean tuning one tunes the other. */
+export declare const NETWORK_STATE_REQUEST_THROTTLE_MS = 500;
+/**
+ * The owner key a connection speaks for, from the authenticated user and the client id it claimed.
+ *
+ * **Both halves, and a pure function so both can be tested.** The user id is what keeps a leaked client id
+ * useless to anyone else — without it this would be the relay's first ownership claim a caller can forge,
+ * where socket identity could not be. It comes from the cookie *or* the PAT: reading only the cookie would
+ * have made every agent and every non-browser client `anon:`, which is the population most likely to have
+ * its handshake URL end up in a reverse proxy's access log. The mint is what removes the fallback branch: a connection that
+ * claims nothing gets an identity of its own, which is per-socket, which is the behaviour ownership had
+ * before it moved off the socket.
+ *
+ * Exported for the test that holds the pairing. Inline in the handler it was unreachable without standing
+ * up an authenticated handshake, and a mutation dropping the user id survived the whole suite.
+ */
+export declare function ownerKeyFor(userId: number | string | undefined, claimed: string | null): {
+    key: string;
+    user: string;
+    minted: boolean;
+};
 export declare class RelayServer {
     private readonly options;
     private httpServer;
@@ -15,12 +42,47 @@ export declare class RelayServer {
     private purgeBuildsTimer;
     private flushResourcesTimer;
     private heartbeatTimer;
-    private wsAlive;
+    /**
+     * When each socket last answered a ping. WeakMap → no manual cleanup on close (GC handles it).
+     *
+     * **A timestamp, not the swept boolean it replaced.** That flag was set `false` for *every* socket at the
+     * start of each sweep and back to `true` only when the pong returned, so a perfectly healthy socket read
+     * as dead for the whole round trip — a normal state on a 30s cycle rather than an edge case. And the
+     * window is longest for exactly the socket that matters: video goes out on `browserSocket`, and the ping
+     * is written behind whatever is already queued there, so an external viewer's pong can take a second or
+     * two.
+     *
+     * That was invisible while the flag only decided termination, because a sweep that finds `false` has by
+     * definition already waited a full interval. Reading it to answer *"is this holder alive right now"* is
+     * what exposes it: occupancy would hand a live tester's session away, and `busy` would flash a device as
+     * free every 30 seconds — the dashboard polls every 5s and `disabled={isBusy}`, so the UI would open the
+     * button rather than a race being needed.
+     */
+    private lastPongAt;
+    /**
+     * Who each socket speaks for — `<userId>:<clientId>`, the key a session's ownership is compared against.
+     *
+     * **Two parts, and both are load-bearing.** The client id is supplied by the caller (`?client=`), so on
+     * its own it is the relay's first *forgeable* ownership claim: today's ownership is socket identity,
+     * which nothing can spoof. Binding it to the authenticated user — which `getAuth` already resolves at
+     * the handshake — keeps a leaked id useless to anyone else's account.
+     *
+     * **A connection that supplies no client id is given one**, rather than falling back to socket identity.
+     * There is deliberately no fallback branch: one model, and a client that does not identify itself gets an
+     * identity that happens to be per-socket, which is exactly today's behaviour.
+     */
+    private ownerKey;
     private dropHandlers;
     private audioDropHandlers;
     private droppers;
     private idrRequesters;
+    /** Unlike `idrRequesters` these hold a timer, which is why the value is not a bare closure — see
+     *  `forgetSessionState`. */
+    private networkStateRequesters;
     private wsRoles;
+    /** Per-socket throttle state for `logInboundRejection`. A `WeakMap` so a closed socket's entry goes
+     *  with the socket — there is no cleanup to forget, unlike the maps keyed by session id nearby. */
+    private readonly rejectionLog;
     private agentHolds;
     private stopping;
     private wsExternal;
@@ -54,14 +116,123 @@ export declare class RelayServer {
     stop(): Promise<void>;
     address(): string | import("net").AddressInfo | null;
     private runHeartbeat;
+    /**
+     * Has this socket answered recently enough to be treated as present?
+     *
+     * `1.5` intervals rather than one: a pong that arrives *during* a sweep must not be read as late, and a
+     * socket pinged at the end of one interval has until halfway through the next. The cost is that a
+     * genuinely dead socket is recognised in up to 45s instead of 30 — **and 45 seconds with no false
+     * negative beats 30 with one every cycle**, because a false negative here does not merely delay: it
+     * hands a live tester's session to whoever asked next.
+     */
+    private isAlive;
     updateTlsContext(material: {
         cert: string;
         key: string;
     }): void;
-    private makeIdrRequester;
+    /**
+     * Drop every per-session stream record keyed by this id.
+     *
+     * **Four maps that have to move together, called from four places that did not.** They were deleted
+     * inline in `session:end` and `session:leave` and nowhere else, so a session ending any other way —
+     * the agent going away, the idle timer, a device disappearing from a re-register — left all four
+     * behind for the life of the process.
+     *
+     * Pre-existing, and this slice is what makes it worth fixing here rather than filing: `idrRequesters`
+     * used to be populated only by the binary drop path, i.e. only under backpressure, and a re-join now
+     * creates an entry for any streaming session (#515). The leak went from rare to ordinary.
+     *
+     * **Now five maps, and the fifth is not dropped the same way.** `networkStateRequesters` holds a
+     * *coalescing* requester, so its closure owns a pending `setTimeout` — and deleting a map entry does
+     * not cancel a timer. Leaving it armed is not a leak but a double send: `session:leave` followed by a
+     * re-join inside the window fires the orphaned trailing edge *and* the new requester's leading edge,
+     * which is the second budget for one session that this map exists to prevent. Hence `dispose()`
+     * rather than `delete` alone. It was named `forgetSessionStreamState` while all four were stream
+     * records; the network requester is not one, so the name lost the word rather than the entry
+     * lost the function.
+     */
+    private forgetSessionState;
+    /**
+     * Throttled callback asking the session's agent for an on-demand IDR (fast drop recovery); ignored by
+     * agents that don't support it.
+     *
+     * **One per session, and the construction is folded in here on purpose.** The throttle is `lastAt` in
+     * the closure, so a second requester for the same session is a second budget — which is what the
+     * `idrRequesters` map exists to prevent, and it prevented it only as long as every caller remembered
+     * to look the session up first. There are two callers now (the drop path and the re-join in
+     * `handleSessionStart`), and a separate `makeIdrRequester` was a factory either of them could reach
+     * past the map. Measured: calling it directly from one caller left every test green.
+     */
+    private idrRequester;
+    /**
+     * Throttled callback asking the session's agent to re-read and report the device's network
+     * condition (#614); ignored by agents that don't support it.
+     *
+     * **Coalescing, where `idrRequester` above drops — and the difference is not a preference.** A
+     * dropped IDR request costs nothing: the next periodic keyframe repairs it. Nothing re-produces a
+     * `network:state`, so a request dropped inside the window leaves that viewer rendering "unknown"
+     * for the life of the session. The trailing edge fires after the last join in a burst, and the
+     * relay addresses the reply to whichever socket holds the session *when it arrives* — so the
+     * viewer that ends up watching is the one served, which a leading edge cannot promise.
+     *
+     * The burst this is for is the dirty blip, not two people: `join()` refuses a live holder, and a
+     * clean `session:leave` runs `forgetSessionState` and builds a fresh requester. A browser socket
+     * that dies in its close handler does neither, so `lastAt` survives into the re-join — which is
+     * the very path this slice exists to serve.
+     *
+     * One per session, constructed here, for the reason written on `idrRequester`: the throttle lives
+     * in the closure, so a second requester is a second budget.
+     */
+    private networkStateRequester;
     private remoteAddressOf;
     private warnProxyMisconfigOnce;
     private handleConnection;
+    /**
+     * @param msg  what the door proved — see `parseInbound`. An Envelope-tier member arrives carrying
+     *             `type` and its correlators and nothing else, so a payload the parser did not check
+     *             cannot be read off it.
+     * @param raw  the frame as it arrived. Agent-origin messages are **forwarded as this**, so a field
+     *             a newer agent added survives a relay that does not know it — `z.object` strips, and
+     *             stripping is wrong in the one direction where the sender is the more recently
+     *             updated side. Browser-origin messages are forwarded as `msg` instead, so a key an attacker
+     *             appended does not survive. It is also where the two stored Envelope payloads come
+     *             from, which is the point: a value read off `raw` is one the parser did not vouch for.
+     */
+    /**
+     * Assign this socket's role if it does not have one, then refuse a message its role may not send.
+     *
+     * @returns `false` when the caller must stop — the socket was closed, or the frame is a failed
+     *          handshake that must not confer a role.
+     */
+    private settleRole;
+    /**
+     * What the door refused, said once and in a form an operator can act on.
+     *
+     * This is where `isAddressed` and `isCorrelated` ended up. Both were predicates whose whole
+     * observable output was a `console.warn` — an id-less request resolved no session and was dropped by
+     * the miss anyway — and the schemas now reject the same frames earlier, including the empty-string
+     * case a bare `z.string()` would have let through. What is new is that the log names the *field*:
+     * "requestId: Too small" instead of "dropped, cannot correlate a reply".
+     *
+     * Worth logging at all for the reason `isCorrelated` gave: the three places a bad frame can be
+     * dropped are otherwise silent, and an operator who upgrades the relay but not an independently
+     * installed `mcp-server` would watch commands do nothing with no trace.
+     *
+     * **Throttled per socket, and the "per socket" is the whole design.** A first draft wrote one line
+     * per rejected frame, on the direction a viewer with devtools controls and at the rate a gesture
+     * produces — the unbounded, attacker-driven log volume this file already refuses at
+     * `forwardUnacked`, with the reason written beside it. A single module-level timestamp would fix the
+     * volume and break the diagnostic: one noisy socket would silence the *other* socket's first bad
+     * frame, which is the skewed-client case the log exists for. So the state is keyed by socket, in a
+     * `WeakMap` that needs no cleanup, and **the first rejection from any socket is always written** —
+     * the one that names the skew is never the hundredth. What is dropped is only repetition, and the
+     * next line says how much.
+     *
+     * `unknown-type` stays at debug: eleven relay-produced literals land here whenever a client echoes
+     * one back, and none of them is a defect. It shares the throttle so turning debug on cannot
+     * reintroduce the volume.
+     */
+    private logInboundRejection;
     private route;
     private handleAgentResources;
     /**
@@ -104,7 +275,133 @@ export declare class RelayServer {
      */
     private evictAgentSocket;
     private handleAgentRegister;
+    /** The only producer of `error` — all five exits below, and nothing else in the repo sends that message.
+     *
+     *  That is what makes the address possible rather than aspirational: `msg.sessionId` is narrowed to a
+     *  non-empty `string` by the door — the inbound schema, `isAddressed` before it — so every refusal can
+     *  name the join it refuses. Before
+     *  L5d they carried none, and the clients' join waiters matched `sessionId === undefined || sessionId ===
+     *  mine` — with no such key the left half was always true, so any refusal resolved any pending join. */
     private handleSessionStart;
+    /** Shut the device down because nobody is watching it any more. The idle timer's payload, hoisted out
+     *  of the close handler so the release loop there reads as one line per session. */
+    private idleShutdown;
+    /** Where a browser-role command can be dispatched, or what its sender needs to be told instead.
+     *
+     *  Three refusals used to be spread across seven `case` bodies as two conditions each, and the ownership
+     *  one was in none of them. Collapsed here so the set is decided once: a command reaches an agent only if
+     *  the session exists, **this socket holds it**, and the agent is connected. Anything else has prose the
+     *  caller can act on, and each case wraps that prose in the reply type its own waiter reads.
+     *
+     *  The two ownership strings are one reason with different prose, the treatment `#492` settled: telling a
+     *  caller the session is in use when it is idle steers it off a device it could have had.
+     */
+    private dispatchTarget;
+    /** `dispatchTarget` without the ownership clause: is there a session here, and is its agent listening?
+     *
+     *  **The name carries the omission because a doc block does not reach an autocomplete.** This is the
+     *  resolver a future handler must not pick by accident — it is the general-looking one and the unsafe
+     *  one at the same time, which is the pairing worth spelling out.
+     *
+     *  **Still here after #527, and this paragraph used to say it would not be.** It predicted that
+     *  answering "who may shut a device down" would move `device:shutdown` up to `dispatchTarget`. The
+     *  answer turned out to be a *different* gate rather than that one: `mayShutDown` refuses a session
+     *  another client holds and permits an unheld one, because the dashboard's unmount teardown races its
+     *  own viewer socket's close and an owns-it gate refuses the teardown whenever the close lands first —
+     *  leaving the device booted until the idle timer, which is the cost #527 was filed to avoid.
+     *
+     *  So the two are ordered rather than merged: `mayShutDown` decides *who*, this decides *whether it can
+     *  be delivered at all*, and without the second a shutdown addressed to a missing session or a closed
+     *  agent socket is dropped in silence and `mcp-server`'s caller burns a 30s deadline (#542).
+     *
+     *  The disclosure it was written to record stands: a caller that is not the holder still learns whether
+     *  a session id exists and whether its agent is up.
+     */
+    private reachableTargetWithoutOwnership;
+    /** Is `ws` the socket this session is bound to?
+     *
+     *  Until L5c the input path resolved the session and forwarded without asking. `clipboard:data` asks the
+     *  mirror-image question one branch up (`session?.agentSocket !== ws`) with the reason written beside it —
+     *  a second agent on the same relay must not address someone else's session — and the browser direction
+     *  had no equivalent. So any authenticated client that knew a session id could drive a device another
+     *  tester was looking at, and the agent's ack went to the session holder rather than to whoever asked.
+     *
+     *  An **unheld** session (no `browserSocket`, or one that has gone) is also not owned by the sender. That
+     *  is deliberate rather than incidental: it makes an input arriving inside the reconnect grace fail fast
+     *  instead of being applied to a device with nobody watching the result. */
+    private ownsSession;
+    /** Which owner this socket speaks for. Every connection has one — supplied or minted — so this never
+     *  answers `undefined` and two anonymous sockets can never match by both lacking an identity. */
+    private ownerOf;
+    /** The principal behind a socket — a user id, or `anon` for a connection carrying no cookie and no PAT. */
+    private userOf;
+    /** Everything the bind needs to record about who is joining.
+     *
+     *  **A socket with no record gets one of its own rather than a shared sentinel.** `handleConnection`
+     *  seeds every accepted connection before a message can arrive, so the fallback is unreachable today —
+     *  but a literal would make any two unseeded sockets *equal*, and equal keys pass `ownsSession` while
+     *  equal users pass `mayShutDown`'s same-principal exemption. That rests the whole ownership invariant
+     *  on one call site staying total, which is the shape of dependency the sentinel is supposed to remove.
+     *  Minting keeps the answer "this socket and no other"; storing it keeps repeat calls consistent, since
+     *  a fresh value each time would fail to recognise the very socket that bound the session. `minted` is
+     *  `false` deliberately — the legacy exemption exists for a client that identified itself with nothing,
+     *  not for one the relay failed to record. */
+    private ownerRecord;
+    /**
+     * May this socket shut the session's device down?
+     *
+     * **"Not someone else's" rather than "mine", and the difference is the reason #527 stayed open.** The
+     * dashboard's unmount teardown sends `device:shutdown` from one socket while another socket's `close`
+     * races it to the relay — two connections, no ordering — and if the close lands first the session is
+     * unheld. An owns-it gate refuses the teardown there, and the device stays booted until the five-minute
+     * idle timer: the path #527 named as the reason a gate could not be added at all.
+     *
+     * An unheld session therefore stays shutdownable by anyone authenticated, which is unchanged from today
+     * — this command has never had a gate — and is written down rather than implied. What changes is the
+     * case the issue is about: a device another tester is *holding* can no longer be powered off.
+     */
+    private mayShutDown;
+    /** Input that no ack answers: opening and move frames, rotation, the keyboard-forwarding toggle.
+     *
+     *  Dropped rather than refused when unowned, and that asymmetry with `handleAckedInput` is the whole
+     *  reason these have their own clause: refusing means answering, and there is no waiter here to answer.
+     *  `clipboard:data`'s silent `break` is the precedent that fits — a frame nobody is waiting on. */
+    private forwardUnacked;
+    /** The five inputs an ack answers, so the five that carry a required correlator.
+     *
+     *  Every exit answers the sender. That is the rule this method exists to hold: a request with a waiter on
+     *  a 2s deadline must not be dropped silently, because the caller's fallback reports silence from a
+     *  session that has never acked as **success** (#457) — so a silent drop here would report an input that
+     *  never left the relay as landed, which is worse than the misrouting it replaced. */
+    private handleAckedInput;
+    /**
+     * Tells the sender its payload was refused, in the shape that request's own waiter reads.
+     *
+     * **This is what keeps the door from turning an answered failure into silence.** Before it, a
+     * malformed `open-url` reached the agent and the agent's own guard answered `open-url:error`;
+     * `IOSAgent.ts` says so beside that guard, and names this validation as what would take it over.
+     * Taking the responsibility without taking the answer would have been a regression — worst on the
+     * inputs, and not obviously: `awaitInputAck` reports silence from a session that has never acked as
+     * **success** (#457), so a dropped `input:key` reads to an MCP caller as an input that landed.
+     *
+     * The address and the correlator come from the envelope, which `parseInbound` judges separately from
+     * the payload for exactly this reason — a frame with a good envelope carries everything a reply
+     * needs. `reason: 'malformed'` is not a new member; the input vocabulary already had it, and until
+     * now only agents produced it.
+     *
+     * No ownership check, deliberately: the reply goes to the socket that sent the frame and says only
+     * that its own message was malformed, so it discloses nothing about the session. Every other refusal
+     * in this file answers a question about the session's state and is gated for that reason.
+     */
+    private refuseMalformed;
+    /** Answers the sender in the shape its waiter is keyed on.
+     *
+     *  `input:type` needs `input:type-error`, not `input:error` — its waiters in `mcp-server` and
+     *  `flow-runner` match on the `input:type-*` pair and ignore an `input:error` entirely. That is why
+     *  adding `input:type` to the terminal set was never the fix for it, and answering it properly here is
+     *  closes the gap `relay/AGENTS.md` recorded: before L5c an `input:type` on an offline agent got nothing
+     *  and burned its caller's full deadline. */
+    private refuseInput;
     /** Relay looks up file_path from DB and enriches it for the agent.
      *
      *  Every exit carries the request's `sessionId`, including the failures. A dashboard viewer holds

package/dist/RelayServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RelayServer.d.ts","sourceRoot":"","sources":["../src/RelayServer.ts"],"names":[],"mappings":"AAuCA,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQvD;AAiED,qBAAa,WAAW;IA0DV,OAAO,CAAC,QAAQ,CAAC,OAAO;IAzDpC,OAAO,CAAC,UAAU,CAA4B;IAC9C,OAAO,CAAC,GAAG,CAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,SAAS,CAAQ;IACzB,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,eAAe,CAAsD;IAC7E,OAAO,CAAC,SAAS,CAAe;IAChC,OAAO,CAAC,aAAa,CAAa;IAClC,OAAO,CAAC,oBAAoB,CAA8C;IAC1E,OAAO,CAAC,sBAAsB,CAA8C;IAC5E,OAAO,CAAC,gBAAgB,CAA8C;IACtE,OAAO,CAAC,mBAAmB,CAA8C;IACzE,OAAO,CAAC,cAAc,CAA8C;IAEpE,OAAO,CAAC,OAAO,CAAoC;IACnD,OAAO,CAAC,YAAY,CAAgC;IAEpD,OAAO,CAAC,iBAAiB,CAAgC;IAEzD,OAAO,CAAC,QAAQ,CAAyC;IAEzD,OAAO,CAAC,aAAa,CAAgC;IACrD,OAAO,CAAC,OAAO,CAAuD;IAMtE,OAAO,CAAC,UAAU,CAAsD;IAIxE,OAAO,CAAC,QAAQ,CAAQ;IAGxB,OAAO,CAAC,UAAU,CAAgC;IAClD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAQ;IAC1C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAQ;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAa;IAEzC,OAAO,CAAC,oBAAoB,CAAQ;IACpC,OAAO,CAAC,kBAAkB,CAKtB;IACJ,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAQ;IACxC,OAAO,CAAC,cAAc,CAKlB;gBAEyB,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE;IA2C5T,OAAO,CAAC,cAAc;IA6FtB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAO1B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAoCtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAmBrB,OAAO;IAKP,OAAO,CAAC,YAAY;IASpB,gBAAgB,CAAC,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAO/D,OAAO,CAAC,gBAAgB;IAcxB,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,sBAAsB;IAc9B,OAAO,CAAC,gBAAgB;IAiIxB,OAAO,CAAC,KAAK;IAqPb,OAAO,CAAC,oBAAoB;IAe5B;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM;IAKd;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAWrB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,eAAe;IAkCvB,+EAA+E;IAC/E,OAAO,CAAC,WAAW;IAOnB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IA2BxB,OAAO,CAAC,mBAAmB;IA4F3B,OAAO,CAAC,kBAAkB;IAgE1B;;;;;;+EAM2E;IAC3E,OAAO,CAAC,uBAAuB;IA4B/B,6FAA6F;IAC7F,OAAO,CAAC,sBAAsB;YAyBhB,mBAAmB;YAwDnB,eAAe;IAoD7B,OAAO,CAAC,oBAAoB;IAO5B,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,qBAAqB;IAO7B,OAAO,CAAC,oBAAoB;YAed,aAAa;IAoC3B,OAAO,CAAC,WAAW;IAiBnB,OAAO,CAAC,WAAW;CAoDpB"}
+{"version":3,"file":"RelayServer.d.ts","sourceRoot":"","sources":["../src/RelayServer.ts"],"names":[],"mappings":"AA2CA,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQvD;AAGD;;gFAEgF;AAChF,eAAO,MAAM,uBAAuB,MAAM,CAAA;AAC1C;;sGAEsG;AACtG,eAAO,MAAM,iCAAiC,MAAM,CAAA;AAqEpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,EACnC,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAUhD;AA8BD,qBAAa,WAAW;IA4FV,OAAO,CAAC,QAAQ,CAAC,OAAO;IA3FpC,OAAO,CAAC,UAAU,CAA4B;IAC9C,OAAO,CAAC,GAAG,CAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,SAAS,CAAQ;IACzB,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,eAAe,CAAsD;IAC7E,OAAO,CAAC,SAAS,CAAe;IAChC,OAAO,CAAC,aAAa,CAAa;IAClC,OAAO,CAAC,oBAAoB,CAA8C;IAC1E,OAAO,CAAC,sBAAsB,CAA8C;IAC5E,OAAO,CAAC,gBAAgB,CAA8C;IACtE,OAAO,CAAC,mBAAmB,CAA8C;IACzE,OAAO,CAAC,cAAc,CAA8C;IACpE;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,UAAU,CAAmC;IACrD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAA2E;IAC3F,OAAO,CAAC,YAAY,CAAgC;IAEpD,OAAO,CAAC,iBAAiB,CAAgC;IAEzD,OAAO,CAAC,QAAQ,CAAyC;IAEzD,OAAO,CAAC,aAAa,CAAgC;IACrD;gCAC4B;IAC5B,OAAO,CAAC,sBAAsB,CAAuC;IACrE,OAAO,CAAC,OAAO,CAAuD;IACtE;uGACmG;IACnG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA+D;IAM5F,OAAO,CAAC,UAAU,CAAsD;IAIxE,OAAO,CAAC,QAAQ,CAAQ;IAGxB,OAAO,CAAC,UAAU,CAAgC;IAClD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAQ;IAC1C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAQ;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAa;IAEzC,OAAO,CAAC,oBAAoB,CAAQ;IACpC,OAAO,CAAC,kBAAkB,CAKtB;IACJ,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAQ;IACxC,OAAO,CAAC,cAAc,CAKlB;gBAEyB,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE;IA2C5T,OAAO,CAAC,cAAc;IA6FtB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAO1B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAoCtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA0BrB,OAAO;IAKP,OAAO,CAAC,YAAY;IAOpB;;;;;;;;OAQG;IACH,OAAO,CAAC,OAAO;IAYf,gBAAgB,CAAC,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAM/D;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,YAAY;IAiBpB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,qBAAqB;IAuB7B,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,sBAAsB;IAc9B,OAAO,CAAC,gBAAgB;IAoKxB;;;;;;;;;;OAUG;IACH;;;;;OAKG;IACH,OAAO,CAAC,UAAU;IAwClB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,mBAAmB;IAgB3B,OAAO,CAAC,KAAK;IAwYb,OAAO,CAAC,oBAAoB;IAc5B;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM;IAKd;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAWrB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,eAAe;IAkCvB,+EAA+E;IAC/E,OAAO,CAAC,WAAW;IAOnB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IA+BxB,OAAO,CAAC,mBAAmB;IA+F3B;;;;;;4GAMwG;IACxG,OAAO,CAAC,kBAAkB;IAqI1B;wFACoF;IACpF,OAAO,CAAC,YAAY;IAUpB;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;IAYtB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,+BAA+B;IASvC;;;;;;;;;;gFAU4E;IAC5E,OAAO,CAAC,WAAW;IAInB;qGACiG;IACjG,OAAO,CAAC,OAAO;IAIf,2GAA2G;IAC3G,OAAO,CAAC,MAAM;IAId;;;;;;;;;;kDAU8C;IAC9C,OAAO,CAAC,WAAW;IASnB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,WAAW;IAiBnB;;;;uGAImG;IACnG,OAAO,CAAC,cAAc;IActB;;;;;0FAKsF;IACtF,OAAO,CAAC,gBAAgB;IAoCxB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,eAAe;IAyBvB;;;;;;iDAM6C;IAC7C,OAAO,CAAC,WAAW;IAanB;;;;;;+EAM2E;IAC3E,OAAO,CAAC,uBAAuB;IA8C/B,6FAA6F;IAC7F,OAAO,CAAC,sBAAsB;YAoChB,mBAAmB;YAwDnB,eAAe;IAoD7B,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,oBAAoB;IAuB5B,OAAO,CAAC,qBAAqB;IAO7B,OAAO,CAAC,oBAAoB;YAed,aAAa;IAoC3B,OAAO,CAAC,WAAW;IAiBnB,OAAO,CAAC,WAAW;CAoDpB"}