acrylblends 1.1.0 → 1.3.0

package/lib/{snapshot-text-BwM6T2nG.js → snapshot-text-CXTnjxGx.js}

@@ -5,7 +5,7 @@ import { r as streamSSE } from "./streaming-BlDaph8U.js";
 import { i as loopbackOnly, r as loopbackAuthority } from "./loopback-only-BbasoF7R.js";
 import "./helpers-BEjcdbgw.js";
 import { d as parseChannelToHost, l as UiControlError, u as WINDOW_ID } from "./protocol-CQ_if7Dg.js";
-import "./src-BTBm4OPD.js";
+import "./src-iBJ2ysV9.js";
 import "./middleware-BfG_fp8P.js";
 import { dirname, join } from "node:path";
 import { closeSync, mkdirSync, openSync, readFileSync, renameSync, statSync, writeSync } from "node:fs";
@@ -31,10 +31,12 @@ const DEFAULT_ACK_MS = 3e3;
 /**
 * The pages and who drives which. One page answers a call, chosen the same way every time: the page whose panel asked for the run that is making the call (`driveFor`), else the page the
 * Host just sent somewhere (it comes back as a new page, `prefer`), else the one in front (it reports `focused`), else the most recently active; a page that did not acknowledge a call in time goes to the end of the line. An explicit desktop `window` picks its page.
+* A call that names its `page` (the page a run was asked from) goes to that page alone, followed into its tab when it reloads or moves, and to no other.
 */
 var UiChannel = class {
 	ackMs;
 	attachWaitMs;
+	requirePage;
 	/** The page the Host sent to a new place and that came back: it keeps being driven until the person focuses another page. */
 	preferred;
 	/** The pages whose panels have a run going, the latest last: a call with no `window` goes to the latest of them that is still connected. */
@@ -42,6 +44,7 @@ var UiChannel = class {
 	constructor(options = {}) {
 		this.ackMs = options.ackMs ?? DEFAULT_ACK_MS;
 		this.attachWaitMs = options.attachWaitMs ?? 0;
+		this.requirePage = options.requirePage === true;
 	}
 	connections = /* @__PURE__ */ new Map();
 	pending = /* @__PURE__ */ new Map();
@@ -54,18 +57,21 @@ var UiChannel = class {
 	* Register a page's stream. A stream already open for the same window is closed first, and its calls settle as `disconnected`.
 	* @returns the function to call when this stream ends.
 	*/
-	attach(windowId, focused, stream, shellWindow) {
+	attach(windowId, focused, stream, shellWindow, tab) {
 		const previous = this.connections.get(windowId);
 		if (previous !== void 0) this.drop(previous, true);
 		const connection = {
 			stream,
 			windowId,
 			shellWindow,
+			tab,
 			focused,
 			lastActive: ++this.clock,
 			suspect: previous?.suspect === true
 		};
 		this.connections.set(windowId, connection);
+		for (const asker of this.askers) if (asker.windowId === windowId) asker.tab ??= tab;
+		else if (tab !== void 0 && asker.tab === tab) asker.windowId = windowId;
 		if (this.askers.some((asker) => asker.windowId === windowId)) this.tell(connection, "1");
 		for (const waiter of [...this.attachWaiters]) waiter(windowId);
 		return () => {
@@ -113,7 +119,11 @@ var UiChannel = class {
 	* @returns the function to call when the run ends.
 	*/
 	driveFor(windowId) {
-		const asker = { windowId };
+		const asker = {
+			origin: windowId,
+			windowId,
+			tab: this.connections.get(windowId)?.tab
+		};
 		this.askers.push(asker);
 		this.tellPage(windowId, "1");
 		return () => {
@@ -123,6 +133,46 @@ var UiChannel = class {
 			if (!this.askers.some((other) => other.windowId === asker.windowId)) this.tellPage(asker.windowId, "0");
 		};
 	}
+	/** Where the page a run was asked from is now: the same window, or the page that replaced it in the same tab. */
+	whereIs(page) {
+		const asker = [...this.askers].reverse().find((entry) => entry.origin === page);
+		return asker === void 0 ? {
+			windowId: page,
+			tab: this.connections.get(page)?.tab
+		} : {
+			windowId: asker.windowId,
+			tab: asker.tab
+		};
+	}
+	/**
+	* A promise for the run's page coming back after a reload or a move: the next page that connects in its tab (or with its window id). Ask for it BEFORE the call that makes the page
+	* leave. Pages of other tabs, another visitor's among them, are never taken for it.
+	* @param signal - stop waiting (the act did not move the page after all); the promise then answers `undefined`.
+	* @returns the window id of the page that came back, or `undefined` when it did not within `timeoutMs`.
+	*/
+	expectPageBack(page, timeoutMs, signal) {
+		const { windowId, tab } = this.whereIs(page);
+		return new Promise((resolve) => {
+			const done = (value) => {
+				clearTimeout(timer);
+				this.attachWaiters.delete(waiter);
+				signal?.removeEventListener("abort", stop);
+				resolve(value);
+			};
+			const stop = () => {
+				done(void 0);
+			};
+			signal?.addEventListener("abort", stop, { once: true });
+			const waiter = (attached) => {
+				const connection = this.connections.get(attached);
+				if (attached === windowId || tab !== void 0 && connection?.tab === tab) done(attached);
+			};
+			const timer = setTimeout(() => {
+				done(void 0);
+			}, timeoutMs);
+			this.attachWaiters.add(waiter);
+		});
+	}
 	tellPage(windowId, running) {
 		const connection = this.connections.get(windowId);
 		if (connection !== void 0) this.tell(connection, running);
@@ -138,7 +188,7 @@ var UiChannel = class {
 		if (connection === void 0) return;
 		this.preferred = windowId;
 		connection.lastActive = ++this.clock;
-		for (const asker of this.askers) if (!this.connections.has(asker.windowId)) asker.windowId = windowId;
+		for (const asker of this.askers) if (!this.connections.has(asker.windowId) && (asker.tab === void 0 || asker.tab === connection.tab)) asker.windowId = windowId;
 		if (this.askers.some((asker) => asker.windowId === windowId)) this.tellPage(windowId, "1");
 	}
 	/**
@@ -149,6 +199,8 @@ var UiChannel = class {
 	async call(request, options = {}, retried = false) {
 		if (this.closed) throw new UiControlError("unloaded", "the door was unloaded");
 		const readOnlyCall = request.op === "snapshot" || request.op === "wait";
+		if (options.page !== void 0) return await this.callPage(request, options.page, options, readOnlyCall);
+		if (this.requirePage) throw new UiControlError("no-window", "this door drives only the page whose visitor asked, and the call names no page");
 		if (readOnlyCall && this.attachWaitMs > 0 && this.connections.size === 0) await this.expectNewPage(this.attachWaitMs);
 		const ordered = this.ordered();
 		const candidates = options.window === void 0 ? ordered : ordered.filter((connection) => connection.shellWindow === options.window);
@@ -174,6 +226,25 @@ var UiChannel = class {
 		}
 		throw new UiControlError("timeout", `no page of the app answered within ${String(Math.round(this.ackMs / 1e3))} s: the app's pages are open but none responded. Likely causes: a tab in the background, a page that is still loading after a navigation (look again), a page busy running a long script, or a page that holds the browser's six connections with event streams of its own (a page should keep to two). Bring the app's tab to the front, or navigate it, then look again`);
 	}
+	/**
+	* A call for one page (the page a run was asked from, followed into its tab): it goes to that page alone and never fails over to another one. A page that is between two
+	* documents (it reloads, or moves to another path) is waited for, up to the attach wait.
+	*/
+	async callPage(request, page, options, readOnly) {
+		let target = this.connections.get(this.whereIs(page).windowId);
+		if (target === void 0 && this.attachWaitMs > 0) {
+			const back = await this.expectPageBack(page, this.attachWaitMs);
+			if (back !== void 0) target = this.connections.get(back);
+		}
+		if (target === void 0) throw new UiControlError("no-window", "the page this run is for is not open any more");
+		if (options.signal?.aborted === true) throw new UiControlError("aborted", "the call was cancelled");
+		try {
+			return await this.callOne(target, request, options, readOnly);
+		} catch (cause) {
+			if (cause instanceof Silent) throw new UiControlError("timeout", "the page this run is for did not answer: is its tab in the background or still loading? Look again");
+			throw cause;
+		}
+	}
 	callOne(target, request, options, failOver) {
 		const signal = options.signal;
 		const id = this.nextId;
@@ -239,16 +310,22 @@ var UiChannel = class {
 	}
 	/**
 	* A promise for the window id of the next page that connects and was not connected when this was asked (the page that came back after a reload or a move).
+	* @param signal - stop waiting; the promise then answers `undefined`.
 	* @returns that id, or `undefined` when no new page connected within `timeoutMs`.
 	*/
-	expectNewPage(timeoutMs) {
+	expectNewPage(timeoutMs, signal) {
 		const known = new Set(this.connections.keys());
 		return new Promise((resolve) => {
 			const done = (value) => {
 				clearTimeout(timer);
 				this.attachWaiters.delete(waiter);
+				signal?.removeEventListener("abort", stop);
 				resolve(value);
 			};
+			const stop = () => {
+				done(void 0);
+			};
+			signal?.addEventListener("abort", stop, { once: true });
 			const waiter = (windowId) => {
 				if (!known.has(windowId)) done(windowId);
 			};
@@ -454,6 +531,8 @@ function pageChannelRoutes(channel, options) {
 		const focused = c.req.query("focused") === "1";
 		const shellQuery = Number(c.req.query("shell"));
 		const shellWindow = Number.isSafeInteger(shellQuery) && shellQuery > 0 ? shellQuery : void 0;
+		const tabQuery = c.req.query("tab");
+		const tab = tabQuery !== void 0 && WINDOW_ID.test(tabQuery) ? tabQuery : void 0;
 		const signal = c.req.raw.signal;
 		return streamSSE(c, async (stream) => {
 			let end = () => {};
@@ -474,7 +553,7 @@ function pageChannelRoutes(channel, options) {
 				},
 				notify: write,
 				close: end
-			}, shellWindow);
+			}, shellWindow, tab);
 			const beat = setInterval(() => {
 				write("ping", "");
 			}, heartbeatMs);
@@ -508,7 +587,8 @@ function renderSnapshot(snapshot, more = (cursor) => `call ui_snapshot with curs
 		const level = node.level === void 0 ? "" : ` level=${String(node.level)}`;
 		const states = node.states.length === 0 ? "" : ` [${node.states.join(", ")}]`;
 		const value = node.value === void 0 ? "" : ` value=${JSON.stringify(node.value)}`;
-		return `${"  ".repeat(Math.min(node.depth, 8))}- ${node.role}${node.name === "" ? "" : ` ${JSON.stringify(node.name)}`}${level}${states}${value} [ref=${node.ref}]`;
+		const options = node.options === void 0 ? "" : ` options=${JSON.stringify(node.options)}`;
+		return `${"  ".repeat(Math.min(node.depth, 8))}- ${node.role}${node.name === "" ? "" : ` ${JSON.stringify(node.name)}`}${level}${states}${value}${options} [ref=${node.ref}]`;
 	});
 	const rest = snapshot.nextCursor === void 0 ? "" : `\n(${String(snapshot.total - snapshot.nextCursor)} more elements; ${more(snapshot.nextCursor)})`;
 	return `Page: ${snapshot.title || "(untitled)"}\nSnapshot ${String(snapshot.generation)}, ${String(snapshot.nodes.length)} of ${String(snapshot.total)} elements:\n${lines.join("\n")}${rest}`;

package/lib/src-CtkIX_Gg.js

@@ -0,0 +1,427 @@
+import { c as RAW_RESPONSE_HANDLED, i as createAdaptorServer, l as RAW_UPGRADE_HANDLED, r as UpgradeHub, u as Request } from "./test-websocket-CQOSvBth.js";
+import "./serve-static-C1Nkj_xB.js";
+import { Service } from "@deepseek-ai/cordis";
+import z from "@deepseek-ai/schemastery";
+//#region ../../plugins/acryl-node-server/src/index.ts
+/** Stable Cordis plugin name, equal to the package name and the Loader row id. */
+const name = "acryl-node-server";
+const inject = ["router"];
+/** The pathname of a request target, for raw matching: a malformed one matches nothing (`'/'` matches only itself). */
+function pathnameOf(target) {
+	if (target === void 0) return "/";
+	try {
+		return new URL(target, "http://node-server.invalid").pathname;
+	} catch {
+		return "/";
+	}
+}
+/** Every field has a default, so a caller passes only what it changes: `ctx.plugin(plugin, { ... })` takes the partial shape. */
+const Config = z.object({
+	hostname: z.string().default("127.0.0.1").description("Address to bind. Loopback by default; binding elsewhere exposes the app to the network."),
+	port: z.number().min(0).max(65535).default(0).description("Port to listen on; 0 lets the system choose. A taken port, or one a browser refuses, is followed by the next usable one."),
+	scan: z.number().min(0).default(20).description("How many further ports to try when the configured one is taken or a browser refuses it."),
+	websocket: z.object({
+		maxPayload: z.number().min(1).default(1024 * 1024).description("The largest WebSocket frame accepted, in bytes; a bigger one closes the socket with 1009."),
+		heartbeat: z.number().min(0).default(3e4).description("Milliseconds between pings; a peer that did not answer the last one is terminated. 0 turns it off."),
+		grace: z.number().min(0).default(2e3).description("Milliseconds a closing socket gets before it is terminated when its plugin unloads.")
+	}).default({})
+});
+/**
+* Milliseconds a request already in flight, or an upgraded socket's own owner, may finish once the server stops taking new work. A save during a
+* restart must not be cut; a stream that never ends must not hold the stop open.
+*/
+const STOP_GRACE_MS = 2e3;
+var NodeServer = class extends Service {
+	hostname;
+	config;
+	server;
+	router;
+	hub;
+	bound = 0;
+	/** The one stop this server runs: a second call (the disposer after an explicit stop) waits on the same promise. */
+	stopping;
+	/** Requests whose response has not finished yet: the stop waits for them before their sockets are cut. */
+	active = 0;
+	/** Upgraded sockets this server handed out (WebSockets): neither close() nor closeAllConnections() reaches them, so the stop tracks them itself. */
+	upgraded = /* @__PURE__ */ new Set();
+	/** Raw routes registered by the host's compatibility layer (see {@link registerRaw}). */
+	rawExact = /* @__PURE__ */ new Map();
+	rawPrefix = /* @__PURE__ */ new Map();
+	rawUpgrades = /* @__PURE__ */ new Map();
+	/** Gates registered by a host that maps an app's URLs (see {@link NodeServer.gate}); they run in the order they were added. */
+	gates = [];
+	/** One raw dispatch per upgrade request: a second listener (or a re-added one) must never emit the same request again. */
+	rawUpgradeSeen = /* @__PURE__ */ new WeakSet();
+	constructor(ctx, config) {
+		super(ctx, "nodeServer");
+		this.config = config;
+		this.hostname = config.hostname;
+		const router = ctx.router;
+		this.router = router;
+		this.server = createAdaptorServer({
+			fetch: (request, bindings) => {
+				const { incoming, outgoing } = bindings;
+				this.active += 1;
+				let finished = false;
+				const settle = () => {
+					if (finished) return;
+					finished = true;
+					this.active -= 1;
+				};
+				outgoing.once("finish", settle);
+				outgoing.once("close", settle);
+				if (incoming.headers.upgrade !== void 0) {
+					const websocket = incoming.headers.upgrade.toLowerCase() === "websocket";
+					return new Response("", {
+						status: websocket ? 503 : 400,
+						headers: { connection: "close" }
+					});
+				}
+				if (this.gates.length > 0) {
+					const requestLike = request;
+					const connection = {
+						remoteAddress: incoming.socket.remoteAddress,
+						localPort: incoming.socket.localPort
+					};
+					for (const gate of this.gates) {
+						const answer = gate(requestLike, connection);
+						if (answer !== void 0) return answer;
+					}
+				}
+				const raw = this.rawFor(incoming);
+				if (raw !== void 0) {
+					(async () => {
+						try {
+							await raw(incoming, outgoing);
+						} catch {
+							if (!outgoing.headersSent) {
+								outgoing.writeHead(500, { "content-type": "text/plain; charset=utf-8" });
+								outgoing.end("internal error");
+							} else outgoing.destroy();
+						}
+					})();
+					return RAW_RESPONSE_HANDLED;
+				}
+				return router.fetch(new Request(request), {
+					remoteAddress: incoming.socket.remoteAddress,
+					localPort: incoming.socket.localPort
+				});
+			},
+			hostname: config.hostname,
+			overrideGlobalObjects: false
+		});
+		this.server.on("upgrade", (request, socket, head) => {
+			if (this.rawUpgradeSeen.has(request)) return;
+			this.upgraded.add(socket);
+			socket.once("close", () => {
+				this.upgraded.delete(socket);
+			});
+			socket.on("error", () => {
+				socket.destroy();
+			});
+			const websocket = request.headers.upgrade?.toLowerCase() === "websocket";
+			const handler = this.rawUpgrades.get(pathnameOf(request.url));
+			if (handler === void 0) {
+				if (!websocket || this.hub !== void 0) return;
+				if (socket.destroyed || socket.writableEnded) return;
+				request[RAW_UPGRADE_HANDLED] = true;
+				socket.end("HTTP/1.1 503 Service Unavailable\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
+				return;
+			}
+			if (!websocket) {
+				if (socket.destroyed || socket.writableEnded) return;
+				request[RAW_UPGRADE_HANDLED] = true;
+				socket.end("HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
+				return;
+			}
+			this.rawUpgradeSeen.add(request);
+			request[RAW_UPGRADE_HANDLED] = true;
+			Promise.resolve(handler(request, socket, head)).catch(() => socket.destroy());
+		});
+		ctx.effect(() => () => this.stop(), "acryl-node-server: close listener and open connections");
+	}
+	/**
+	* Stop serving, gracefully, and resolve once the port is free: no new connections; requests already in flight may finish (a stream that never ends is
+	* cut) within {@link STOP_GRACE_MS}; each upgraded socket's owner closes it with a close frame first, and what is left is destroyed. Idempotent - the
+	* disposer calls it.
+	*
+	* Calling this BEFORE the rest of the app is disposed is what makes the grace count: the router has its own disposal, and it aborts in-flight requests
+	* and ends their bodies by design, concurrently with every other disposer (Cordis runs them together). A launcher that disposes the context directly
+	* therefore cuts the request this drains; a launcher that stops the server first lets it answer, then disposes.
+	*/
+	stop() {
+		this.stopping ??= this.closeGracefully();
+		return this.stopping;
+	}
+	async closeGracefully() {
+		const upgrades = this.hub?.close();
+		if (!this.server.listening) {
+			await upgrades;
+			return;
+		}
+		const stopped = new Promise((resolve) => {
+			this.server.close(() => {
+				resolve();
+			});
+		});
+		this.server.closeIdleConnections();
+		const settled = await this.settleStop(STOP_GRACE_MS);
+		this.server.closeIdleConnections();
+		if (!(settled ? await Promise.race([stopped.then(() => true), new Promise((resolve) => {
+			setTimeout(() => {
+				resolve(false);
+			}, 300);
+		})]) : false)) {
+			this.server.closeAllConnections();
+			for (const socket of this.upgraded) socket.destroy();
+			this.upgraded.clear();
+		}
+		await Promise.all([upgrades, stopped]);
+	}
+	/**
+	* Wait, bounded, until no request is in flight and no upgraded socket is left; true when both reached zero inside the bound. Every pass sweeps idle
+	* keep-alive sockets again: the single sweep `close()` does misses one that becomes idle after its request finished, and such a socket would otherwise
+	* hold the stop to its deadline.
+	*/
+	async settleStop(ms) {
+		const deadline = Date.now() + ms;
+		while (Date.now() < deadline) {
+			if (this.active === 0 && this.upgraded.size === 0) return true;
+			this.server.closeIdleConnections();
+			await new Promise((resolve) => setTimeout(resolve, 25));
+		}
+		return this.active === 0 && this.upgraded.size === 0;
+	}
+	/**
+	* Serve a raw node handler at `path`, beside the router: `exact` matches the pathname only, `prefix` the path and everything below it. The
+	* handler gets the platform's `IncomingMessage`/`ServerResponse` and owns the response; the router is not run for it. A path already served
+	* throws. The returned remover restores the path (the server itself goes on serving the rest).
+	*/
+	registerRaw(route) {
+		const table = route.kind === "exact" ? this.rawExact : this.rawPrefix;
+		if (table.has(route.path)) throw new Error(`acryl-node-server: ${route.path} is already served`);
+		table.set(route.path, route.handler);
+		return () => {
+			if (table.get(route.path) === route.handler) table.delete(route.path);
+		};
+	}
+	/**
+	* Answer matching requests before raw routes and the router, so a host can keep an app's URLs in scope under a prefix (the frame's canvas). A gate runs
+	* synchronously and can answer with a promise (see {@link RequestGate}); gates run in the order they were added, and the returned remover takes this one back.
+	*/
+	gate(handler) {
+		this.gates.push(handler);
+		return () => {
+			const at = this.gates.indexOf(handler);
+			if (at !== -1) this.gates.splice(at, 1);
+		};
+	}
+	/**
+	* A gate's asynchronous answer: run the request it was given through the router, in the adapter's request form (a gate never makes one itself), with the
+	* socket facts. The raw routes do not run for that request.
+	*/
+	throughRouter(request, connection = {}) {
+		return this.router.fetch(new Request(request), connection);
+	}
+	/**
+	* Claim an upgrade path for a raw node handler: the handler receives `(req, socket, head)` and from then on owns the socket. The router's
+	* WebSocket handling never sees a claimed upgrade. A path already claimed throws; the remover releases the claim. The transport's one raw
+	* listener exists for the server's whole lifetime and consults this registry, so claims coming and going never add or remove a listener.
+	*/
+	registerRawUpgrade(route) {
+		if (this.rawUpgrades.has(route.path)) throw new Error(`acryl-node-server: the upgrade path ${route.path} is already claimed`);
+		this.rawUpgrades.set(route.path, route.handler);
+		return () => {
+			if (this.rawUpgrades.get(route.path) !== route.handler) return;
+			this.rawUpgrades.delete(route.path);
+		};
+	}
+	/** The raw handler for a request: an exact path first, then the longest matching prefix. */
+	rawFor(incoming) {
+		const path = pathnameOf(incoming.url);
+		const exact = this.rawExact.get(path);
+		if (exact !== void 0) return exact;
+		let best;
+		for (const [prefix, handler] of this.rawPrefix) if ((path === prefix || path.startsWith(`${prefix}/`)) && (best === void 0 || prefix.length > best.length)) best = {
+			length: prefix.length,
+			handler
+		};
+		return best?.handler;
+	}
+	/**
+	* `upgradeWebSocket` for the plugin that asks (call it once, in `apply`): `app.get('/ws', upgrade((c) => ({ onMessage(event, ws) { ... } })))`. Checks go in ordinary middleware on the
+	* route, and a handler that returns a `Response` refuses the upgrade with that status before any handshake. Every socket it accepts belongs to the calling plugin: when the plugin
+	* unloads they are closed with 1001 within `websocket.grace` and the handler sees `close` once. Pass `{ textOnly: true }` to drop binary frames. Needs the `ws` package.
+	*/
+	upgrades() {
+		if (!this.hub) {
+			this.hub = new UpgradeHub(this.config.websocket);
+			this.hub.attach(this.server, this.ctx.router, { skipWhenRawUpgrade: true });
+		}
+		return this.hub.upgradeWebSocketFor(this.ctx);
+	}
+	/** How many `upgrade` listeners the transport holds (raw plus router setups); a test asserts it does not grow across claim changes. */
+	get upgradeListenerCount() {
+		return this.server.listenerCount("upgrade");
+	}
+	/** How many WebSocket connections are open now. */
+	get sockets() {
+		return this.hub?.size ?? 0;
+	}
+	/** The port in use, 0 before the server listens. */
+	get port() {
+		return this.bound;
+	}
+	/** The address clients use. */
+	get url() {
+		return `http://${this.hostname.includes(":") ? `[${this.hostname}]` : this.hostname}:${String(this.bound)}`;
+	}
+	/** Bind, scanning past taken ports and past the ports a browser refuses. */
+	async listen() {
+		const { port, scan, hostname } = this.config;
+		const last = port === 0 ? 0 : Math.min(65535, port + scan);
+		for (const candidate of portCandidates(port, scan)) try {
+			await new Promise((resolve, reject) => {
+				const onError = (error) => {
+					reject(error);
+				};
+				this.server.once("error", onError);
+				this.server.listen(candidate, hostname, () => {
+					this.server.off("error", onError);
+					resolve();
+				});
+			});
+			this.bound = this.server.address().port;
+			return;
+		} catch (error) {
+			if (!isPortUnavailable(error)) throw error;
+		}
+		throw new Error(`acryl-node-server: no usable port from ${String(port)} to ${String(last)} on ${hostname}: each is taken, or one a browser refuses`);
+	}
+};
+/**
+* The ports every Fetch client refuses to connect to: the Fetch standard's bad ports (https://fetch.spec.whatwg.org/#port-blocking). Chromium
+* refuses a page on one (ERR_UNSAFE_PORT) and Node's fetch answers "bad port"; the list below is the one Node 24 reports, probed port by port
+* on 2026-11-03 (82 ports, 1 to 10080). An app's stable port is hashed into 3100..3999, and 3659 is on the list: without this rule one app in
+* 900 would come up on an address no browser may open, which the frame gate caught that day (verify-frame-token was refused at 3659).
+*/
+const RESTRICTED_PORTS = /* @__PURE__ */ new Set([
+	1,
+	7,
+	9,
+	11,
+	13,
+	15,
+	17,
+	19,
+	20,
+	21,
+	22,
+	23,
+	25,
+	37,
+	42,
+	43,
+	53,
+	69,
+	77,
+	79,
+	87,
+	95,
+	101,
+	102,
+	103,
+	104,
+	109,
+	110,
+	111,
+	113,
+	115,
+	117,
+	119,
+	123,
+	135,
+	137,
+	139,
+	143,
+	161,
+	179,
+	389,
+	427,
+	465,
+	512,
+	513,
+	514,
+	515,
+	526,
+	530,
+	531,
+	532,
+	540,
+	548,
+	554,
+	556,
+	563,
+	587,
+	601,
+	636,
+	989,
+	990,
+	993,
+	995,
+	1719,
+	1720,
+	1723,
+	2049,
+	3659,
+	4045,
+	4190,
+	5060,
+	5061,
+	6e3,
+	6566,
+	6665,
+	6666,
+	6667,
+	6668,
+	6669,
+	6679,
+	6697,
+	10080
+]);
+/** Whether a browser refuses to open this port. */
+function isRestrictedPort(port) {
+	return RESTRICTED_PORTS.has(port);
+}
+/**
+* The ports `listen` may try, in order: `port` with at most `scan` further ones, without the ports a browser refuses. Port 0 stays alone: the
+* system chooses it, and the ports it hands out are above the restricted range.
+*/
+function portCandidates(port, scan) {
+	const last = port === 0 ? 0 : Math.min(65535, port + scan);
+	const candidates = [];
+	for (let candidate = port; candidate <= last; candidate += 1) if (!isRestrictedPort(candidate)) candidates.push(candidate);
+	return candidates;
+}
+/**
+* Whether a failed bind means "this port, try the next one". A port another socket holds answers `EADDRINUSE` everywhere. On Windows a port
+* inside a range the system reserves (Hyper-V, WSL and Docker exclude ranges, `netsh interface ipv4 show excludedportrange`) answers
+* `EACCES`, which is a property of that port too; elsewhere `EACCES` means the process may not bind low ports at all, so moving on would
+* only hide the reason.
+*/
+function isPortUnavailable(error, platform = process.platform) {
+	const code = error?.code;
+	return code === "EADDRINUSE" || platform === "win32" && code === "EACCES";
+}
+/** Loads once the server listens, so a plugin that injects `nodeServer` can rely on `url`. A failure to bind fails the plugin. */
+async function apply(ctx, config = {}) {
+	await new NodeServer(ctx, {
+		hostname: "127.0.0.1",
+		port: 0,
+		scan: 20,
+		websocket: {},
+		...config
+	}).listen();
+}
+//#endregion
+export { apply as a, isRestrictedPort as c, STOP_GRACE_MS as i, name as l, NodeServer as n, inject as o, RESTRICTED_PORTS as r, isPortUnavailable as s, Config as t, portCandidates as u };