@textjs/app 0.0.0-stage → 1.0.2

package/dist/server/live.d.ts

@@ -0,0 +1,138 @@
+/**
+ * Live sessions for server-rendered console routes: one React root per
+ * browser tab, rendered on the server, streamed to the frame player as cell
+ * deltas over server-sent events. Input comes back as JSON POSTs.
+ *
+ * - `GET  /__textjs/live?path=&cols=&rows=` opens (or, with `Last-Event-ID` /
+ *   `x-textjs-live: <sid>`, resumes) a session and streams {@link LiveServerMessage}s.
+ * - `POST /__textjs/live` with `x-textjs-live: <sid>` and a JSON array of
+ *   {@link LiveInput}s.
+ *
+ * Frames are paced like the client renderer (≥ `frameIntervalMs` apart) and
+ * coalesced: each frame is diffed against what this connection was last sent,
+ * so a slow socket (`write()` returning `false`) just skips intermediate
+ * states until `drain`. Disconnected sessions survive `reconnectGraceMs`, then
+ * unmount. Session ids are 192-bit random capabilities, bound to the
+ * credentials (cookies, `Authorization`) they were opened with; requests must
+ * be same-origin; only routes in the app manifest can be rendered, and
+ * `authorize` (middleware) runs for every server route a session renders.
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { type LiveInput, type LiveServerMessage } from "../live-protocol.js";
+import type { LiveApp, LiveAppOptions, RouteRuntime } from "./live-app.js";
+export type LiveAppInit = Omit<LiveAppOptions, "routes" | "theme" | "defaultTitle">;
+export interface LiveServerOptions {
+    /** Mount a session's app (binds the route manifest, theme and title). */
+    createApp(init: LiveAppInit): Promise<LiveApp>;
+    /** Which runtime renders `pathname` (client routes are handed back to the browser). */
+    runtimeOf(pathname: string): RouteRuntime;
+    /** Prefix for hrefs sent to the browser. */
+    basePath?: string;
+    /** Concurrent sessions (default 256). */
+    maxSessions?: number;
+    /** How long a disconnected session waits to be resumed (default 30s). */
+    reconnectGraceMs?: number;
+    /** Minimum ms between frames per connection (default 66, the client renderer's pacing). */
+    frameIntervalMs?: number;
+    /** SSE comment interval keeping proxies from idling the stream out (default 15s). */
+    heartbeatMs?: number;
+    /** Forward render errors to the browser console (dev). */
+    exposeErrors?: boolean;
+    /**
+     * May a session render `href`? Called with the visitor's request headers
+     * before a session opens, before every server-side route transition, and
+     * when a session's credentials change. Wire it to `middleware.ts`.
+     */
+    authorize?(href: string, headers: Headers): Promise<boolean>;
+    /** Trust `X-Forwarded-Host` / `-Proto` / `-For` (behind a reverse proxy). */
+    trustProxy?: boolean;
+    /** Concurrent sessions per client address (default 32). */
+    maxSessionsPerClient?: number;
+    log?(message: string): void;
+    onError?(error: unknown): void;
+}
+export declare const MAX_EVENTS = 64;
+/** `true` unless the request is (or claims to be) from another site. */
+export declare function isSameOriginRequest(req: Pick<IncomingMessage, "headers">, trustProxy?: boolean): boolean;
+export declare class LiveSession {
+    private readonly server;
+    private readonly interval;
+    readonly id: string;
+    app: LiveApp | null;
+    private stream;
+    private readonly encoder;
+    private dirty;
+    private blocked;
+    private timer;
+    private grace;
+    private lastSent;
+    private title;
+    /** The last address-bar update and a pending document load, replayed to a reconnecting browser. */
+    private lastUrl;
+    private pendingLoad;
+    disposed: boolean;
+    /** Hash of the cookies / `Authorization` the session was authorized with. */
+    credentials: string;
+    /** Request headers used to authorize route transitions. */
+    headers: Headers;
+    /** Client address (per-client session cap). */
+    client: string;
+    /** When the browser detached (`0` while connected). */
+    detachedAt: number;
+    private tokens;
+    private refilledAt;
+    /** Frames and bytes written (telemetry, tests). */
+    framesSent: number;
+    bytesSent: number;
+    constructor(server: LiveServer, interval: number);
+    get connected(): boolean;
+    attach(res: ServerResponse, resumed: boolean): void;
+    /** Take `cost` input events from the rate bucket (`false` when the session is over its rate). */
+    takeTokens(cost: number): boolean;
+    private detach;
+    /** Send a non-frame message (written immediately, in order with frames). */
+    send(message: LiveServerMessage): void;
+    markDirty(): void;
+    private schedule;
+    /** Encode the delta since the last frame this connection received and write it. */
+    readonly flush: () => void;
+    heartbeat(): void;
+    private write;
+    input(events: readonly LiveInput[]): void;
+    close(): void;
+}
+export declare class LiveServer {
+    readonly sessions: Map<string, LiveSession>;
+    readonly reconnectGraceMs: number;
+    private readonly options;
+    private readonly maxSessions;
+    private readonly maxPerClient;
+    private readonly interval;
+    private readonly heartbeatTimer;
+    private readonly basePath;
+    constructor(options: LiveServerOptions);
+    /**
+     * Handle `GET` / `POST` on {@link LIVE_PATH}. `url` is the request URL with
+     * `basePath` already stripped. Returns `false` for other requests.
+     */
+    handle(req: IncomingMessage, res: ServerResponse, url: string): Promise<boolean>;
+    private startStream;
+    /** End a stream with a document load: the browser requests `href`, and middleware answers over HTTP. */
+    private sendLoad;
+    private clientOf;
+    private authorized;
+    /**
+     * A session's cookies or `Authorization` changed since it was authorized:
+     * re-run `authorize` for what it currently shows before trusting the request.
+     */
+    private recheck;
+    /** Make room for a new session: drop the longest-disconnected one. */
+    private evictDisconnected;
+    private openStream;
+    private receiveInput;
+    dispose(session: LiveSession): void;
+    /** Re-render every session (dev: a route module changed). */
+    forEachApp(fn: (app: LiveApp) => void): void;
+    close(): void;
+}
+//# sourceMappingURL=live.d.ts.map

package/dist/server/live.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live.d.ts","sourceRoot":"","sources":["../../src/server/live.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAoI,KAAK,SAAS,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5M,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAGxE,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,OAAO,GAAG,cAAc,CAAC,CAAC;AAEpF,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,SAAS,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,uFAAuF;IACvF,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAAC;IAC1C,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2FAA2F;IAC3F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,SAAS,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,6EAA6E;IAC7E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2DAA2D;IAC3D,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,CAAC,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CAChC;AAGD,eAAO,MAAM,UAAU,KAAK,CAAC;AAY7B,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,EAAE,UAAU,UAAQ,GAAG,OAAO,CAgBtG;AA6CD,qBAAa,WAAW;IA8BpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IA9B3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,OAAO,GAAG,IAAI,CAAQ;IAC3B,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAClD,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,KAAK,CAA8C;IAC3D,OAAO,CAAC,KAAK,CAA8C;IAC3D,OAAO,CAAC,QAAQ,CAAa;IAC7B,OAAO,CAAC,KAAK,CAAuB;IACpC,mGAAmG;IACnG,OAAO,CAAC,OAAO,CAAkC;IACjD,OAAO,CAAC,WAAW,CAAkC;IACrD,QAAQ,UAAS;IACjB,6EAA6E;IAC7E,WAAW,SAAM;IACjB,2DAA2D;IAC3D,OAAO,UAAiB;IACxB,+CAA+C;IAC/C,MAAM,SAAM;IACZ,uDAAuD;IACvD,UAAU,SAAK;IACf,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,UAAU,CAAqB;IACvC,mDAAmD;IACnD,UAAU,SAAK;IACf,SAAS,SAAK;gBAGK,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM;IAKnC,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI;IA0BnD,iGAAiG;IACjG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IASjC,OAAO,CAAC,MAAM;IAWd,4EAA4E;IAC5E,IAAI,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI;IAOtC,SAAS,IAAI,IAAI;IAKjB,OAAO,CAAC,QAAQ;IAMhB,mFAAmF;IACnF,QAAQ,CAAC,KAAK,QAAO,IAAI,CASvB;IAEF,SAAS,IAAI,IAAI;IAIjB,OAAO,CAAC,KAAK;IAab,KAAK,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,GAAG,IAAI;IAOzC,KAAK,IAAI,IAAI;CAYd;AAED,qBAAa,UAAU;IACrB,QAAQ,CAAC,QAAQ,2BAAkC;IACnD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiC;IAChE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,OAAO,EAAE,iBAAiB;IAatC;;;OAGG;IACG,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmBtF,OAAO,CAAC,WAAW;IAWnB,wGAAwG;IACxG,OAAO,CAAC,QAAQ;IAKhB,OAAO,CAAC,QAAQ;YAKF,UAAU;IAUxB;;;OAGG;YACW,OAAO;IAWrB,sEAAsE;IACtE,OAAO,CAAC,iBAAiB;YAQX,UAAU;YAmFV,YAAY;IA6D1B,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAKnC,6DAA6D;IAC7D,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAAG,IAAI;IAI5C,KAAK,IAAI,IAAI;CAId"}

package/dist/server/live.js

@@ -0,0 +1,542 @@
+/**
+ * Live sessions for server-rendered console routes: one React root per
+ * browser tab, rendered on the server, streamed to the frame player as cell
+ * deltas over server-sent events. Input comes back as JSON POSTs.
+ *
+ * - `GET  /__textjs/live?path=&cols=&rows=` opens (or, with `Last-Event-ID` /
+ *   `x-textjs-live: <sid>`, resumes) a session and streams {@link LiveServerMessage}s.
+ * - `POST /__textjs/live` with `x-textjs-live: <sid>` and a JSON array of
+ *   {@link LiveInput}s.
+ *
+ * Frames are paced like the client renderer (≥ `frameIntervalMs` apart) and
+ * coalesced: each frame is diffed against what this connection was last sent,
+ * so a slow socket (`write()` returning `false`) just skips intermediate
+ * states until `drain`. Disconnected sessions survive `reconnectGraceMs`, then
+ * unmount. Session ids are 192-bit random capabilities, bound to the
+ * credentials (cookies, `Authorization`) they were opened with; requests must
+ * be same-origin; only routes in the app manifest can be rendered, and
+ * `authorize` (middleware) runs for every server route a session renders.
+ */
+import { createHash, randomBytes } from "node:crypto";
+import { isAppPath, LIVE_PATH, LIVE_PROTOCOL_VERSION, LIVE_SESSION_HEADER, LiveFrameEncoder, MAX_COLS, MAX_ROWS, parseLiveInput, sseEvent } from "../live-protocol.js";
+import { readRequestBody } from "./http.js";
+const MAX_BODY = 512 * 1024;
+export const MAX_EVENTS = 64;
+const BODY_TIMEOUT_MS = 5000;
+/** Input events per second per session (token bucket), with a burst allowance. */
+const INPUT_RATE = 240;
+const INPUT_BURST = 480;
+const SID_RE = /^[A-Za-z0-9_-]{32}$/;
+function first(value) {
+    const v = Array.isArray(value) ? value[0] : value;
+    return v?.split(",")[0]?.trim() || undefined;
+}
+/** `true` unless the request is (or claims to be) from another site. */
+export function isSameOriginRequest(req, trustProxy = false) {
+    const site = req.headers["sec-fetch-site"];
+    if (site !== undefined && site !== "same-origin" && site !== "none")
+        return false;
+    const origin = req.headers.origin;
+    if (origin === undefined || origin === "null")
+        return origin === undefined;
+    try {
+        const u = new URL(origin);
+        if (u.protocol !== "http:" && u.protocol !== "https:")
+            return false;
+        if (u.host === req.headers.host)
+            return true;
+        if (!trustProxy)
+            return false;
+        // Behind a trusted proxy that rewrites Host.
+        const proto = first(req.headers["x-forwarded-proto"]);
+        return u.host === first(req.headers["x-forwarded-host"]) && (proto === undefined || `${proto}:` === u.protocol);
+    }
+    catch {
+        return false;
+    }
+}
+/** The request headers of a Node request as Web `Headers`. */
+function headersOf(req) {
+    const out = new Headers();
+    for (const [k, v] of Object.entries(req.headers)) {
+        if (v === undefined)
+            continue;
+        if (Array.isArray(v))
+            for (const item of v)
+                out.append(k, item);
+        else
+            out.set(k, v);
+    }
+    return out;
+}
+/** What a session's identity is bound to. */
+function credentialsOf(req) {
+    const h = req.headers;
+    return createHash("sha256")
+        .update(`${h.cookie ?? ""}\u0000${h.authorization ?? ""}`)
+        .digest("base64url");
+}
+function withTimeout(p, ms) {
+    let timer;
+    return Promise.race([p, new Promise((r) => (timer = setTimeout(() => r("timeout"), ms)))]).finally(() => clearTimeout(timer));
+}
+function newSessionId() {
+    return randomBytes(24).toString("base64url");
+}
+function intParam(v, lo, hi, fallback) {
+    const n = v === null ? Number.NaN : Number.parseInt(v, 10);
+    return Number.isFinite(n) ? Math.max(lo, Math.min(hi, n)) : fallback;
+}
+function safePath(p) {
+    if (p === null || !p.startsWith("/") || p.startsWith("//") || p.length > 2048 || /[\u0000-\u001f\\]/.test(p))
+        return "/";
+    return p;
+}
+function pathOf(href) {
+    const q = href.search(/[?#]/);
+    return q < 0 ? href : href.slice(0, q);
+}
+export class LiveSession {
+    server;
+    interval;
+    id;
+    app = null;
+    stream = null;
+    encoder = new LiveFrameEncoder();
+    dirty = true;
+    blocked = false;
+    timer = null;
+    grace = null;
+    lastSent = -Infinity;
+    title = null;
+    /** The last address-bar update and a pending document load, replayed to a reconnecting browser. */
+    lastUrl = null;
+    pendingLoad = null;
+    disposed = false;
+    /** Hash of the cookies / `Authorization` the session was authorized with. */
+    credentials = "";
+    /** Request headers used to authorize route transitions. */
+    headers = new Headers();
+    /** Client address (per-client session cap). */
+    client = "";
+    /** When the browser detached (`0` while connected). */
+    detachedAt = 0;
+    tokens = INPUT_BURST;
+    refilledAt = performance.now();
+    /** Frames and bytes written (telemetry, tests). */
+    framesSent = 0;
+    bytesSent = 0;
+    constructor(server, interval) {
+        this.server = server;
+        this.interval = interval;
+        this.id = newSessionId();
+    }
+    get connected() {
+        return this.stream !== null;
+    }
+    attach(res, resumed) {
+        if (this.grace !== null)
+            clearTimeout(this.grace);
+        this.grace = null;
+        const prev = this.stream;
+        this.stream = res;
+        // Newest connection wins (a duplicated stream or a reconnect racing the old socket).
+        if (prev !== null && prev !== res)
+            prev.end();
+        this.blocked = false;
+        this.encoder.reset();
+        this.dirty = true;
+        this.lastSent = -Infinity;
+        this.detachedAt = 0;
+        this.write(sseEvent({ t: "hello", v: LIVE_PROTOCOL_VERSION, sid: this.id, resumed }, this.id));
+        if (this.title !== null)
+            this.write(sseEvent({ t: "title", title: this.title }));
+        // Messages a disconnected browser missed.
+        if (resumed && this.lastUrl !== null)
+            this.write(sseEvent({ ...this.lastUrl, replace: true }));
+        if (this.pendingLoad !== null) {
+            this.write(sseEvent(this.pendingLoad));
+            res.end();
+            return;
+        }
+        res.on("close", () => this.detach(res));
+        this.app?.setActive?.(true);
+        this.schedule();
+    }
+    /** Take `cost` input events from the rate bucket (`false` when the session is over its rate). */
+    takeTokens(cost) {
+        const now = performance.now();
+        this.tokens = Math.min(INPUT_BURST, this.tokens + ((now - this.refilledAt) / 1000) * INPUT_RATE);
+        this.refilledAt = now;
+        if (this.tokens < cost)
+            return false;
+        this.tokens -= cost;
+        return true;
+    }
+    detach(res) {
+        if (this.stream !== res)
+            return;
+        this.stream = null;
+        this.detachedAt = performance.now();
+        if (this.timer !== null)
+            clearTimeout(this.timer);
+        this.timer = null;
+        // Nobody is watching: stop painting until a browser reattaches.
+        this.app?.setActive?.(false);
+        if (!this.disposed)
+            this.grace = setTimeout(() => this.server.dispose(this), this.server.reconnectGraceMs);
+    }
+    /** Send a non-frame message (written immediately, in order with frames). */
+    send(message) {
+        if (message.t === "title")
+            this.title = message.title;
+        if (message.t === "url")
+            this.lastUrl = message;
+        if (message.t === "load")
+            this.pendingLoad = message;
+        if (this.stream !== null)
+            this.write(sseEvent(message));
+    }
+    markDirty() {
+        this.dirty = true;
+        this.schedule();
+    }
+    schedule() {
+        if (this.stream === null || this.timer !== null || this.blocked || !this.dirty || this.app === null)
+            return;
+        const wait = Math.max(0, this.lastSent + this.interval - performance.now());
+        this.timer = setTimeout(this.flush, wait);
+    }
+    /** Encode the delta since the last frame this connection received and write it. */
+    flush = () => {
+        this.timer = null;
+        if (this.stream === null || this.blocked || !this.dirty || this.app === null)
+            return;
+        this.dirty = false;
+        const frame = this.encoder.encode(this.app.buffer);
+        if (frame === null)
+            return;
+        this.lastSent = performance.now();
+        this.framesSent++;
+        this.write(sseEvent(frame));
+    };
+    heartbeat() {
+        if (this.stream !== null && !this.blocked)
+            this.write(": ♥\n\n");
+    }
+    write(chunk) {
+        const res = this.stream;
+        if (res === null || res.writableEnded)
+            return;
+        this.bytesSent += chunk.length;
+        if (res.write(chunk) || this.blocked)
+            return;
+        this.blocked = true;
+        res.once("drain", () => {
+            if (this.stream !== res)
+                return;
+            this.blocked = false;
+            this.schedule();
+        });
+    }
+    input(events) {
+        const app = this.app;
+        if (app === null)
+            return;
+        if (app.inputMany)
+            app.inputMany(events);
+        else
+            for (const e of events)
+                app.input(e);
+    }
+    close() {
+        this.disposed = true;
+        if (this.timer !== null)
+            clearTimeout(this.timer);
+        if (this.grace !== null)
+            clearTimeout(this.grace);
+        this.timer = null;
+        this.grace = null;
+        const res = this.stream;
+        this.stream = null;
+        res?.end();
+        this.app?.dispose();
+        this.app = null;
+    }
+}
+export class LiveServer {
+    sessions = new Map();
+    reconnectGraceMs;
+    options;
+    maxSessions;
+    maxPerClient;
+    interval;
+    heartbeatTimer;
+    basePath;
+    constructor(options) {
+        this.options = options;
+        this.maxSessions = options.maxSessions ?? 256;
+        this.maxPerClient = options.maxSessionsPerClient ?? 32;
+        this.reconnectGraceMs = options.reconnectGraceMs ?? 30_000;
+        this.interval = options.frameIntervalMs ?? 66;
+        this.basePath = options.basePath ?? "";
+        this.heartbeatTimer = setInterval(() => {
+            for (const s of this.sessions.values())
+                s.heartbeat();
+        }, options.heartbeatMs ?? 15_000);
+        this.heartbeatTimer.unref?.();
+    }
+    /**
+     * Handle `GET` / `POST` on {@link LIVE_PATH}. `url` is the request URL with
+     * `basePath` already stripped. Returns `false` for other requests.
+     */
+    async handle(req, res, url) {
+        const q = url.indexOf("?");
+        const pathname = q < 0 ? url : url.slice(0, q);
+        if (pathname !== LIVE_PATH)
+            return false;
+        if (!isSameOriginRequest(req, this.options.trustProxy)) {
+            res.statusCode = 403;
+            res.end();
+            return true;
+        }
+        if (req.method === "GET")
+            await this.openStream(req, res, new URLSearchParams(q < 0 ? "" : url.slice(q + 1)));
+        else if (req.method === "POST")
+            await this.receiveInput(req, res);
+        else {
+            res.statusCode = 405;
+            res.setHeader("Allow", "GET, POST");
+            res.end();
+        }
+        return true;
+    }
+    startStream(res) {
+        res.statusCode = 200;
+        res.setHeader("Content-Type", "text/event-stream; charset=utf-8");
+        res.setHeader("Cache-Control", "no-cache, no-transform");
+        res.setHeader("Connection", "keep-alive");
+        res.setHeader("X-Accel-Buffering", "no");
+        res.setHeader("X-Content-Type-Options", "nosniff");
+        res.flushHeaders?.();
+        res.write("retry: 1000\n\n");
+    }
+    /** End a stream with a document load: the browser requests `href`, and middleware answers over HTTP. */
+    sendLoad(res, href) {
+        this.startStream(res);
+        res.end(sseEvent({ t: "load", href: this.basePath + href }));
+    }
+    clientOf(req) {
+        const forwarded = this.options.trustProxy ? first(req.headers["x-forwarded-for"]) : undefined;
+        return forwarded ?? req.socket?.remoteAddress ?? "";
+    }
+    async authorized(href, headers) {
+        if (!this.options.authorize)
+            return true;
+        try {
+            return await this.options.authorize(href, headers);
+        }
+        catch (error) {
+            this.options.onError?.(error);
+            return false;
+        }
+    }
+    /**
+     * A session's cookies or `Authorization` changed since it was authorized:
+     * re-run `authorize` for what it currently shows before trusting the request.
+     */
+    async recheck(session, req) {
+        const credentials = credentialsOf(req);
+        if (credentials === session.credentials)
+            return true;
+        const headers = headersOf(req);
+        const href = session.app?.history.location.href ?? "/";
+        if (!(await this.authorized(href, headers)))
+            return false;
+        session.credentials = credentials;
+        session.headers = headers;
+        return true;
+    }
+    /** Make room for a new session: drop the longest-disconnected one. */
+    evictDisconnected() {
+        let oldest = null;
+        for (const s of this.sessions.values())
+            if (!s.connected && s.detachedAt > 0 && (oldest === null || s.detachedAt < oldest.detachedAt))
+                oldest = s;
+        if (oldest === null)
+            return false;
+        this.dispose(oldest);
+        return true;
+    }
+    async openStream(req, res, params) {
+        const lastId = first(req.headers["last-event-id"]) ?? first(req.headers[LIVE_SESSION_HEADER]);
+        const existing = lastId !== undefined && SID_RE.test(lastId) ? this.sessions.get(lastId) : undefined;
+        if (existing && !existing.disposed) {
+            if (!(await this.recheck(existing, req))) {
+                const href = existing.app?.history.location.href ?? "/";
+                this.dispose(existing);
+                this.sendLoad(res, href);
+                return;
+            }
+            this.startStream(res);
+            existing.attach(res, true);
+            return;
+        }
+        const href = safePath(params.get("path"));
+        if (this.options.runtimeOf(pathOf(href)) === "client") {
+            // Not a server route: let the browser load it as a document.
+            this.sendLoad(res, href);
+            return;
+        }
+        const client = this.clientOf(req);
+        let perClient = 0;
+        for (const s of this.sessions.values())
+            if (s.client === client)
+                perClient++;
+        if ((client !== "" && perClient >= this.maxPerClient) || (this.sessions.size >= this.maxSessions && !this.evictDisconnected())) {
+            res.statusCode = 503;
+            res.setHeader("Retry-After", "5");
+            res.end();
+            return;
+        }
+        const headers = headersOf(req);
+        if (!(await this.authorized(href, headers))) {
+            // Middleware would redirect / reject this route: let the browser ask for it over HTTP.
+            this.sendLoad(res, href);
+            return;
+        }
+        const session = new LiveSession(this, this.interval);
+        session.credentials = credentialsOf(req);
+        session.headers = headers;
+        session.client = client;
+        this.sessions.set(session.id, session);
+        let closedEarly = false;
+        res.once("close", () => {
+            closedEarly = session.app === null;
+        });
+        try {
+            session.app = await this.options.createApp({
+                path: href,
+                cols: intParam(params.get("cols"), 1, MAX_COLS, 120),
+                rows: intParam(params.get("rows"), 1, MAX_ROWS, 36),
+                focused: params.get("focused") !== "0",
+                onFrame: () => session.markDirty(),
+                authorize: this.options.authorize ? (target) => this.authorized(target, session.headers) : undefined,
+                onNavigate: (to, action, runtime, delta) => {
+                    if (!isAppPath(to))
+                        return;
+                    if (runtime === "client") {
+                        // The browser loads the route as a new document (client route, or middleware's call); this session is done.
+                        session.send({ t: "load", href: this.basePath + to });
+                        setTimeout(() => this.dispose(session), 0);
+                    }
+                    else if (action === "pop" && delta !== undefined && delta !== 0)
+                        session.send({ t: "go", delta });
+                    else
+                        session.send({ t: "url", href: this.basePath + to, replace: action === "replace" || action === "pop" });
+                },
+                onTitle: (title) => session.send({ t: "title", title }),
+                onError: (error) => {
+                    this.options.onError?.(error);
+                    if (this.options.exposeErrors)
+                        session.send({ t: "error", message: error instanceof Error ? error.message : String(error) });
+                },
+            });
+        }
+        catch (error) {
+            this.dispose(session);
+            this.options.onError?.(error);
+            if (!res.headersSent)
+                res.statusCode = 500;
+            res.end();
+            return;
+        }
+        if (closedEarly || session.disposed) {
+            this.dispose(session);
+            return;
+        }
+        this.startStream(res);
+        session.attach(res, false);
+        this.options.log?.(` ◇ live session ${session.id.slice(0, 6)}… ${href} (${this.sessions.size} open)`);
+    }
+    async receiveInput(req, res) {
+        const sid = req.headers[LIVE_SESSION_HEADER];
+        const type = req.headers["content-type"] ?? "";
+        if (typeof sid !== "string" || !SID_RE.test(sid) || !type.startsWith("application/json")) {
+            res.statusCode = 400;
+            res.end();
+            return;
+        }
+        const session = this.sessions.get(sid);
+        if (!session || session.disposed) {
+            res.statusCode = 410;
+            res.end();
+            return;
+        }
+        const raw = await withTimeout(readRequestBody(req, MAX_BODY), BODY_TIMEOUT_MS);
+        if (raw === null || raw === "timeout") {
+            res.statusCode = raw === null ? 413 : 408;
+            res.setHeader("Connection", "close");
+            res.end();
+            req.destroy();
+            return;
+        }
+        let body;
+        try {
+            body = JSON.parse(raw);
+        }
+        catch {
+            body = null;
+        }
+        if (!Array.isArray(body) || body.length > MAX_EVENTS) {
+            res.statusCode = body === null || !Array.isArray(body) ? 400 : 413;
+            res.end();
+            return;
+        }
+        if (!session.takeTokens(Math.max(1, body.length))) {
+            res.statusCode = 429;
+            res.setHeader("Retry-After", "1");
+            res.end();
+            return;
+        }
+        if (!(await this.recheck(session, req))) {
+            const href = session.app?.history.location.href ?? "/";
+            session.send({ t: "load", href: this.basePath + href });
+            this.dispose(session);
+            res.statusCode = 403;
+            res.end();
+            return;
+        }
+        const events = [];
+        for (const item of body) {
+            const e = parseLiveInput(item);
+            if (e)
+                events.push(e);
+        }
+        try {
+            session.input(events);
+        }
+        catch (error) {
+            this.options.onError?.(error);
+        }
+        res.statusCode = 204;
+        res.end();
+    }
+    dispose(session) {
+        if (this.sessions.get(session.id) === session)
+            this.sessions.delete(session.id);
+        session.close();
+    }
+    /** Re-render every session (dev: a route module changed). */
+    forEachApp(fn) {
+        for (const s of this.sessions.values())
+            if (s.app)
+                fn(s.app);
+    }
+    close() {
+        clearInterval(this.heartbeatTimer);
+        for (const s of [...this.sessions.values()])
+            this.dispose(s);
+    }
+}
+//# sourceMappingURL=live.js.map