ai-fly 0.0.0 → 0.1.0

package/dist/runtime-Dg4en1D8.mjs

@@ -0,0 +1,1372 @@
+import { a as FRAME_TYPE, s as HTTP_METHODS } from "./sdk-C6xDRbzg.mjs";
+import { g as reconcileKeyMetadata, m as loadKeyring, s as applyCatalog, v as saveKeyring } from "./common-4VeA_3wo.mjs";
+import { i as splitBody, n as FabricWireAdapter, t as WireSession } from "./mux-xHl9Jrbi.mjs";
+import { n as desiredPortFor, r as listenWithFallback, t as LOOPBACK_HOST } from "./ports-pI59MtmI.mjs";
+import { Hono } from "hono";
+import { createAdaptorServer } from "@hono/node-server";
+import { WebSocketServer } from "ws";
+/**
+* full jitter：delay = random() * min(cap, base * 2^attempt)。
+* attempt 从 0 起（首次重连窗口 [0, base]）；封顶后窗口恒为 [0, cap]。
+*/
+function fullJitterDelayMs(attempt, opts = {}) {
+	const base = opts.baseMs ?? 1e3;
+	const cap = opts.capMs ?? 6e4;
+	const random = opts.random ?? Math.random;
+	const ceiling = Math.min(cap, base * 2 ** Math.min(Math.max(attempt, 0), 30));
+	return Math.floor(random() * ceiling);
+}
+/** 离线/AUTH 全拒时的快速失败（gateway 映射 503 JSON）。 */
+var OfflineError = class extends Error {
+	code;
+	alias;
+	constructor(code, alias) {
+		super(code === "provider_offline" ? `provider '${alias}' is offline` : `all keys for '${alias}' were rejected`);
+		this.name = "OfflineError";
+		this.code = code;
+		this.alias = alias;
+	}
+};
+/**
+* 真实传输接线：一个 Fabric 实例（open 一次复用）+ connect(provider) + 每连接一个
+* FabricWireAdapter。FabricLike 是 SDK Fabric 的结构子集，适配器仅消费该子集，
+* 故经 unknown 收窄（SDK 类型仅 type import，vitest 不触原生模块）。
+*/
+function createFabricProviderTransport(factory, info) {
+	let fabric;
+	const getFabric = async () => {
+		fabric ??= await factory.open({
+			dataDir: info.dataDir,
+			...info.relayUrls !== void 0 && info.relayUrls.length > 0 ? { relayUrls: info.relayUrls } : {}
+		});
+		return fabric;
+	};
+	return {
+		openSession: async () => {
+			const f = await getFabric();
+			await f.connect(info.providerEndpointId);
+			const adapter = new FabricWireAdapter(f, info.providerEndpointId);
+			let pathCb;
+			const off = f.on((event) => {
+				if (event.type === "path-changed" && event.endpointId === info.providerEndpointId) pathCb?.(event.status);
+			});
+			return {
+				transport: adapter,
+				linkStatus: async () => {
+					const s = await f.linkStatus(info.providerEndpointId);
+					return s === "relay" ? "relay" : s === "direct" ? "direct" : "unknown";
+				},
+				onPathChange(cb) {
+					pathCb = cb;
+				},
+				teardown: async () => {
+					off();
+					adapter.dispose();
+					adapter.close("provider-teardown");
+					await f.disconnect(info.providerEndpointId).catch(() => void 0);
+				}
+			};
+		},
+		shutdown: async () => {
+			const f = fabric;
+			fabric = void 0;
+			if (f !== void 0) await f.shutdown().catch(() => void 0);
+		}
+	};
+}
+var ProviderConnection = class {
+	endpointId;
+	alias;
+	state = "not-connected";
+	root;
+	factory;
+	backoff;
+	pollIntervalMs;
+	onCatalog;
+	onStateChange;
+	reloadRing;
+	ring;
+	session = null;
+	rawSession = null;
+	inflight = /* @__PURE__ */ new Map();
+	dataUpSeq = /* @__PURE__ */ new Map();
+	attempt = 0;
+	connecting = false;
+	intentionalTeardown = false;
+	stopped = false;
+	retryTimer = null;
+	pollTimer = null;
+	lastKeySnapshot = "";
+	servedCount = 0;
+	bufferOverflows = 0;
+	lastError;
+	constructor(opts) {
+		this.ring = opts.ring;
+		this.endpointId = opts.ring.endpointId;
+		this.alias = opts.ring.alias;
+		this.root = opts.root;
+		this.factory = opts.factory;
+		this.backoff = opts.backoff ?? {};
+		this.pollIntervalMs = opts.pollIntervalMs ?? 3e4;
+		this.onCatalog = opts.onCatalog ?? (() => void 0);
+		this.onStateChange = opts.onStateChange ?? (() => void 0);
+		this.reloadRing = opts.reloadRing ?? (() => void 0);
+		this.lastKeySnapshot = JSON.stringify(opts.ring.keys.map((k) => k.key));
+	}
+	get keys() {
+		return this.ring.keys.map((k) => k.key);
+	}
+	get services() {
+		return this.ring.services;
+	}
+	get ports() {
+		return this.ring.ports;
+	}
+	status() {
+		const s = {
+			endpointId: this.endpointId,
+			alias: this.alias,
+			state: this.state,
+			services: [...this.ring.services],
+			ports: { ...this.ring.ports },
+			servedCount: this.servedCount,
+			bufferOverflows: this.bufferOverflows
+		};
+		if (this.lastError !== void 0) s.lastError = this.lastError;
+		return s;
+	}
+	noteBufferOverflow() {
+		this.bufferOverflows++;
+	}
+	start() {
+		if (this.stopped) return;
+		this.pollTimer = setInterval(() => void this.poll(), this.pollIntervalMs);
+		this.attemptConnect();
+	}
+	async stop() {
+		this.stopped = true;
+		if (this.retryTimer !== null) {
+			clearTimeout(this.retryTimer);
+			this.retryTimer = null;
+		}
+		if (this.pollTimer !== null) {
+			clearInterval(this.pollTimer);
+			this.pollTimer = null;
+		}
+		await this.teardownSession("stopped");
+		await this.factory.shutdown().catch(() => void 0);
+	}
+	forward(input, handlers) {
+		if (this.state !== "direct" && this.state !== "relay") throw new OfflineError(this.state === "key-all-invalid" ? "key_all_invalid" : "provider_offline", this.alias);
+		const session = this.session;
+		if (session === null || session.dead) throw new OfflineError("provider_offline", this.alias);
+		const id = session.allocId();
+		this.inflight.set(id, handlers);
+		this.servedCount++;
+		const header = {
+			v: 1,
+			id,
+			serviceId: input.serviceId,
+			method: input.method,
+			path: input.path,
+			bodyLen: input.body.length
+		};
+		if (input.headers !== void 0) header.headers = input.headers;
+		if (input.contentType !== void 0) header.contentType = input.contentType;
+		const plan = splitBody(input.body);
+		(async () => {
+			try {
+				await session.send(FRAME_TYPE.REQ, header, plan.firstInline ? plan.inlineBody : void 0);
+				for (const chunk of plan.chunks) await session.send(FRAME_TYPE.REQ_BODY, {
+					id,
+					seq: chunk.seq,
+					end: chunk.end
+				}, chunk.data);
+			} catch {
+				if (this.inflight.has(id)) {
+					this.inflight.delete(id);
+					session.terminal(id);
+					handlers.onError({
+						id,
+						code: "internal",
+						message: "wire send failed"
+					});
+					handlers.onTerminate({ source: "local" });
+				}
+			}
+		})();
+		return {
+			id,
+			abort: (opts) => this.abortRequest(id, opts),
+			sendData: (bytes) => this.sendWsData(id, session, bytes)
+		};
+	}
+	abortRequest(id, opts) {
+		const session = this.session;
+		const handlers = this.inflight.get(id);
+		this.inflight.delete(id);
+		this.dataUpSeq.delete(id);
+		if (session === null || session.dead) return;
+		if (opts?.ws === true) {
+			const header = { id };
+			if (opts.code !== void 0) header.code = opts.code;
+			session.send(FRAME_TYPE.CLOSE, header).catch(() => void 0);
+		} else {
+			session.send(FRAME_TYPE.ABORT, { id }).catch(() => void 0);
+			session.terminal(id);
+		}
+		if (handlers !== void 0) handlers.onTerminate({ source: "local" });
+	}
+	sendWsData(id, session, bytes) {
+		if (!this.inflight.has(id)) return Promise.resolve();
+		const seq = this.dataUpSeq.get(id) ?? 0;
+		this.dataUpSeq.set(id, seq + 1);
+		return session.send(FRAME_TYPE.DATA_UP, {
+			v: 1,
+			id,
+			seq
+		}, bytes);
+	}
+	setState(next) {
+		if (this.state === next) return;
+		this.state = next;
+		this.onStateChange(this);
+	}
+	async attemptConnect() {
+		if (this.stopped || this.connecting || this.session !== null) return;
+		this.connecting = true;
+		try {
+			const raw = await this.factory.openSession();
+			if (this.stopped) {
+				await raw.teardown().catch(() => void 0);
+				return;
+			}
+			this.intentionalTeardown = false;
+			this.rawSession = raw;
+			this.session = new WireSession({
+				role: "consumer",
+				transport: raw.transport,
+				hooks: {
+					onFrame: (f) => this.handleFrame(f),
+					onPoison: (info) => this.handlePoison(info.id),
+					onIdleTimeout: (id) => this.handleIdleTimeout(id),
+					onDisconnect: (reason) => this.handleDisconnect(reason),
+					onTerminate: (id, cause) => this.handleTerminate(id, cause)
+				}
+			});
+			raw.onPathChange?.((status) => {
+				if (this.state === "direct" || this.state === "relay") this.setState(status === "relay" ? "relay" : status === "direct" ? "direct" : this.state);
+			});
+			this.setState("connected-unauthed");
+			if (this.ring.keys.length > 0) await this.session.send(FRAME_TYPE.AUTH, {
+				v: 1,
+				keys: [...this.keys]
+			});
+		} catch (err) {
+			this.lastError = err.message;
+			this.setState("offline");
+			this.scheduleRetry();
+		} finally {
+			this.connecting = false;
+		}
+	}
+	scheduleRetry() {
+		if (this.stopped) return;
+		if (this.retryTimer !== null) return;
+		const delay = fullJitterDelayMs(this.attempt, this.backoff);
+		this.attempt++;
+		this.retryTimer = setTimeout(() => {
+			this.retryTimer = null;
+			this.attemptConnect();
+		}, delay);
+	}
+	async teardownSession(reason) {
+		const session = this.session;
+		const raw = this.rawSession;
+		this.session = null;
+		this.rawSession = null;
+		if (session !== null && !session.dead) session.dispose(reason);
+		if (raw !== null) await raw.teardown().catch(() => void 0);
+	}
+	/** 主动重建（毒化/复核失败路径）：拆会话后立即重连（不经退避首发，但保留 attempt 防毒化热循环）。 */
+	async rebuild(reason) {
+		if (this.stopped) return;
+		if (this.state !== "key-all-invalid") this.setState("offline");
+		this.intentionalTeardown = true;
+		await this.teardownSession(reason);
+		this.attemptConnect();
+	}
+	handleFrame(frame) {
+		switch (frame.type) {
+			case FRAME_TYPE.AUTH_OK:
+				this.handleAuthOk(frame.header);
+				return;
+			case FRAME_TYPE.AUTH_ERR:
+				this.handleAuthErr();
+				return;
+			case FRAME_TYPE.RESP_META:
+				this.inflight.get(frame.header.id)?.onMeta(frame.header);
+				return;
+			case FRAME_TYPE.RESP_CHUNK:
+				this.inflight.get(frame.header.id)?.onChunk(frame.body);
+				return;
+			case FRAME_TYPE.RESP_END: {
+				const h = this.inflight.get(frame.header.id);
+				if (h !== void 0) {
+					this.inflight.delete(frame.header.id);
+					this.dataUpSeq.delete(frame.header.id);
+					h.onEnd();
+					h.onTerminate({
+						source: "peer",
+						frameType: frame.type
+					});
+				}
+				return;
+			}
+			case FRAME_TYPE.ERROR: {
+				const errId = frame.header.id;
+				if (errId !== void 0) {
+					const h = this.inflight.get(errId);
+					if (h !== void 0) {
+						this.inflight.delete(errId);
+						this.dataUpSeq.delete(errId);
+						h.onError(frame.header);
+						h.onTerminate({
+							source: "peer",
+							frameType: frame.type
+						});
+					}
+				}
+				return;
+			}
+			case FRAME_TYPE.DATA_DOWN:
+				this.inflight.get(frame.header.id)?.onWsData(frame.body);
+				return;
+			case FRAME_TYPE.CLOSE: {
+				const h = this.inflight.get(frame.header.id);
+				if (h !== void 0) {
+					this.inflight.delete(frame.header.id);
+					this.dataUpSeq.delete(frame.header.id);
+					h.onWsClose(frame.header.code);
+					h.onTerminate({
+						source: "peer",
+						frameType: frame.type
+					});
+				}
+				return;
+			}
+			case FRAME_TYPE.PING: return;
+			default: return;
+		}
+	}
+	handleAuthOk(header) {
+		const session = this.session;
+		if (session === null) return;
+		session.markAuthed();
+		this.attempt = 0;
+		this.lastError = void 0;
+		const services = [];
+		const seen = /* @__PURE__ */ new Set();
+		for (const g of header.groups) for (const s of g.services) if (!seen.has(s.serviceId)) {
+			seen.add(s.serviceId);
+			services.push(s);
+		}
+		let ring = applyCatalog(this.ring, {
+			alias: header.alias,
+			relayUrls: header.relayUrls,
+			services
+		});
+		ring = reconcileKeyMetadata(ring, header.groups.map((g) => ({
+			keyId: g.keyId,
+			group: g.group
+		})));
+		this.ring = ring;
+		this.alias = ring.alias;
+		saveKeyring(this.root, ring);
+		this.onCatalog(this, ring);
+		this.setState("direct");
+		this.rawSession?.linkStatus().then((s) => {
+			if (s === "relay") this.setState("relay");
+			else if (s === "direct") this.setState("direct");
+		}).catch(() => void 0);
+	}
+	handleAuthErr() {
+		this.lastError = "all keys rejected by provider";
+		this.setState("key-all-invalid");
+		this.intentionalTeardown = true;
+		this.teardownSession("auth-err");
+	}
+	handlePoison(id) {
+		this.rebuild("protocol-seq");
+	}
+	handleIdleTimeout(id) {
+		const session = this.session;
+		const handlers = this.inflight.get(id);
+		this.inflight.delete(id);
+		this.dataUpSeq.delete(id);
+		if (session !== null && !session.dead) {
+			session.send(FRAME_TYPE.ABORT, { id }).catch(() => void 0);
+			session.terminal(id);
+		}
+		handlers?.onTerminate({ source: "local" });
+	}
+	handleDisconnect(reason) {
+		const handlers = [...this.inflight.entries()];
+		this.inflight.clear();
+		this.dataUpSeq.clear();
+		this.session = null;
+		this.rawSession = null;
+		const cause = reason === void 0 ? { source: "disconnected" } : {
+			source: "disconnected",
+			reason
+		};
+		for (const [, h] of handlers) h.onTerminate(cause);
+		if (this.stopped || this.intentionalTeardown) {
+			this.intentionalTeardown = false;
+			return;
+		}
+		this.lastError = reason ?? "connection lost";
+		this.setState("offline");
+		this.scheduleRetry();
+	}
+	handleTerminate(id, cause) {
+		if (cause.source === "peer") return;
+		const handlers = this.inflight.get(id);
+		if (handlers === void 0) return;
+		this.inflight.delete(id);
+		this.dataUpSeq.delete(id);
+		handlers.onTerminate(cause);
+	}
+	async poll() {
+		if (this.stopped) return;
+		if (this.state === "key-all-invalid") {
+			const fresh = this.reloadRing(this.endpointId);
+			if (fresh === void 0) return;
+			const snapshot = JSON.stringify(fresh.keys.map((k) => k.key));
+			if (snapshot !== this.lastKeySnapshot) {
+				this.ring = fresh;
+				this.alias = fresh.alias;
+				this.lastKeySnapshot = snapshot;
+				this.setState("offline");
+				this.attemptConnect();
+			}
+			return;
+		}
+		if (this.rawSession === null || this.session === null) return;
+		if (this.state !== "direct" && this.state !== "relay" && this.state !== "connected-unauthed") return;
+		try {
+			if (await this.rawSession.linkStatus() === "unknown" && !this.stopped && this.session !== null) await this.rebuild("link-status-unknown");
+		} catch {}
+	}
+	/** key add 等外部环变更接入（运行中引擎热更新钥环）。 */
+	refreshRing(ring) {
+		this.ring = ring;
+		this.alias = ring.alias;
+		const snapshot = JSON.stringify(ring.keys.map((k) => k.key));
+		const changed = snapshot !== this.lastKeySnapshot;
+		this.lastKeySnapshot = snapshot;
+		if (changed && this.state === "key-all-invalid") {
+			this.setState("offline");
+			this.attemptConnect();
+		} else if (changed && (this.state === "direct" || this.state === "relay") && this.session !== null) this.session.send(FRAME_TYPE.AUTH, {
+			v: 1,
+			keys: [...this.keys]
+		}).catch(() => void 0);
+	}
+};
+var ProviderManager = class {
+	opts;
+	conns = /* @__PURE__ */ new Map();
+	constructor(opts) {
+		this.opts = opts;
+		for (const ring of opts.rings) this.conns.set(ring.endpointId, new ProviderConnection({
+			ring,
+			root: opts.root,
+			factory: opts.sessionFactory(ring),
+			...opts.backoff !== void 0 ? { backoff: opts.backoff } : {},
+			...opts.pollIntervalMs !== void 0 ? { pollIntervalMs: opts.pollIntervalMs } : {},
+			onCatalog: (conn, updated) => {
+				opts.onCatalog?.(conn.endpointId, updated.alias, updated.services, updated.ports);
+			},
+			onStateChange: (conn) => {
+				opts.onStateChange?.(conn.endpointId, conn.state);
+			},
+			reloadRing: (endpointId) => loadKeyring(opts.root, endpointId)
+		}));
+	}
+	start() {
+		for (const conn of this.conns.values()) conn.start();
+	}
+	async stop() {
+		await Promise.all([...this.conns.values()].map((c) => c.stop()));
+	}
+	snapshot() {
+		return [...this.conns.values()].map((c) => c.status());
+	}
+	routeFor(providerId) {
+		return this.conns.get(providerId);
+	}
+	connection(providerId) {
+		return this.conns.get(providerId);
+	}
+};
+/** 每次 pull 从待消费队列搬入 ReadableStream 的批量上限（约束 controller 内排队）。 */
+const PUMP_BATCH_BYTES = 262144;
+/** null-body 状态码：Response 构造不允许携带正文。 */
+const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([
+	204,
+	205,
+	304
+]);
+const ERROR_HTTP_MAPPING = {
+	rate_limited: {
+		status: 429,
+		type: "rate_limit_error"
+	},
+	quota_exceeded: {
+		status: 429,
+		type: "rate_limit_error"
+	},
+	forbidden_method: {
+		status: 405,
+		type: "invalid_request_error"
+	},
+	forbidden_header: {
+		status: 400,
+		type: "invalid_request_error"
+	},
+	body_too_large: {
+		status: 413,
+		type: "invalid_request_error"
+	},
+	unknown_service: {
+		status: 404,
+		type: "invalid_request_error"
+	},
+	path_not_offered: {
+		status: 404,
+		type: "invalid_request_error"
+	},
+	unauthorized: {
+		status: 401,
+		type: "authentication_error"
+	},
+	key_all_invalid: {
+		status: 503,
+		type: "api_error"
+	},
+	upstream_unreachable: {
+		status: 502,
+		type: "api_error"
+	},
+	upstream_status: {
+		status: 502,
+		type: "api_error"
+	},
+	secret_missing: {
+		status: 502,
+		type: "api_error"
+	},
+	protocol_version: {
+		status: 500,
+		type: "api_error"
+	},
+	protocol_seq: {
+		status: 500,
+		type: "api_error"
+	},
+	protocol_error: {
+		status: 500,
+		type: "api_error"
+	},
+	internal: {
+		status: 500,
+		type: "api_error"
+	},
+	aborted: {
+		status: null,
+		type: "api_error"
+	},
+	idle_timeout: {
+		status: null,
+		type: "api_error"
+	},
+	buffer_overflow: {
+		status: null,
+		type: "api_error"
+	}
+};
+function buildErrorJson(code, message, type) {
+	return { error: {
+		message,
+		type,
+		code
+	} };
+}
+function errorResponse(status, code, message, type) {
+	return new Response(JSON.stringify(buildErrorJson(code, message, type)) + "\n", {
+		status,
+		headers: { "content-type": "application/json" }
+	});
+}
+/** ERROR 帧 → 本地 HTTP 响应/连接处置。返回 null 表示按连接错误关闭处置。 */
+function errorResponseFor(code, message) {
+	const m = ERROR_HTTP_MAPPING[code];
+	if (m.status === null) return null;
+	return errorResponse(m.status, code, message, m.type);
+}
+/** 剥离集合：凭据类（协议双向零过桥）+ 由帧内专门字段/提供方配置承载的归属类 + 逐跳头。 */
+const STRIP_REQUEST_HEADERS = /* @__PURE__ */ new Set([
+	"authorization",
+	"proxy-authorization",
+	"cookie",
+	"host",
+	"content-type",
+	"content-length",
+	"transfer-encoding",
+	"connection",
+	"upgrade",
+	"keep-alive",
+	"proxy-connection",
+	"te",
+	"trailer",
+	"expect",
+	"set-cookie"
+]);
+/** WS 握手透传头（connection/upgrade/sec-websocket-*；spec REQ 条款放行集）。 */
+const WS_HANDSHAKE_PASS = /* @__PURE__ */ new Set([
+	"connection",
+	"upgrade",
+	"sec-websocket-key",
+	"sec-websocket-version",
+	"sec-websocket-protocol",
+	"sec-websocket-extensions"
+]);
+/**
+* 本地请求头 → REQ.headers：小写键、去凭据/归属/逐跳；非升级请求剥 WS 握手头，
+* 升级请求放行 WS_HANDSHAKE_PASS（sec-websocket-key 端到端透传，使上游 accept 与
+* 本地计算恒等）。content-type 抽到独立字段。超过 32 项抛 LocalHeaderOverflow。
+*/
+function filterRequestHeaders(raw, isUpgrade) {
+	const out = {};
+	let contentType;
+	const ct = raw["content-type"];
+	if (typeof ct === "string") contentType = ct;
+	else if (Array.isArray(ct)) {
+		const first = ct[0];
+		if (first !== void 0) contentType = first;
+	}
+	for (const [name, value] of Object.entries(raw)) {
+		if (typeof value !== "string") continue;
+		const isWsHandshake = WS_HANDSHAKE_PASS.has(name);
+		if (STRIP_REQUEST_HEADERS.has(name) && !(isUpgrade && isWsHandshake)) continue;
+		if (name.startsWith("sec-websocket-") && !isWsHandshake) continue;
+		if (!isUpgrade && isWsHandshake) continue;
+		out[name] = value;
+	}
+	return {
+		headers: Object.keys(out).length > 0 ? out : void 0,
+		contentType
+	};
+}
+/** 本地请求头数超限（REQ.headers ≤32）：本地即拒，不发起转发。 */
+var LocalHeaderOverflowError = class extends Error {
+	constructor() {
+		super("too many headers");
+		this.name = "LocalHeaderOverflowError";
+	}
+};
+function assertHeaderCount(filtered) {
+	if (filtered.headers !== void 0 && Object.keys(filtered.headers).length > 32) throw new LocalHeaderOverflowError();
+}
+/** 本地请求正文超限（与提供方 8MiB 重组上限同值；本地先拒，节省注定失败的转发）。 */
+var LocalBodyTooLargeError = class extends Error {
+	constructor(limit) {
+		super(`request body exceeds local limit of ${limit} bytes`);
+		this.name = "LocalBodyTooLargeError";
+	}
+};
+async function readRequestBody(incoming, limit) {
+	const chunks = [];
+	let total = 0;
+	for await (const chunk of incoming) {
+		const buf = chunk;
+		total += buf.length;
+		if (total > limit) throw new LocalBodyTooLargeError(limit);
+		chunks.push(buf);
+	}
+	if (chunks.length === 1) return new Uint8Array(chunks[0]);
+	return new Uint8Array(Buffer.concat(chunks));
+}
+var Gateway = class {
+	listeners = /* @__PURE__ */ new Map();
+	wss = new WebSocketServer({ noServer: true });
+	strictPorts;
+	receiveLimit;
+	bodyLimit;
+	onNotice;
+	resolveRoute;
+	stopped = false;
+	constructor(opts) {
+		this.resolveRoute = opts.resolveRoute;
+		this.strictPorts = opts.strictPorts ?? false;
+		this.receiveLimit = opts.receiveBufferLimitBytes ?? 4194304;
+		this.bodyLimit = opts.requestBodyLimitBytes ?? 8388608;
+		this.onNotice = opts.onNotice ?? (() => void 0);
+	}
+	listenerInfo() {
+		return [...this.listeners.values()].map((l) => ({
+			providerId: l.providerId,
+			alias: l.alias,
+			serviceId: l.serviceId,
+			name: l.name,
+			port: l.port,
+			requested: l.requested,
+			autoAssigned: l.autoAssigned
+		}));
+	}
+	/**
+	* 目录同步（AUTH_OK 初次/refresh 全量替换）：新增服务建监听（冲突自动错开 + NOTICE），
+	* 被移除服务关端口 + 终结其在途请求；既有服务仅刷新展示元数据（端口偏好改动需重启
+	* 网关生效——ports 命令是独立进程，裁决记录于报告）。
+	*/
+	async syncProviderServices(providerId, alias, services, ports) {
+		if (this.stopped) return;
+		const desired = new Map(services.map((s) => [s.serviceId, s]));
+		for (const key of [...this.listeners.keys()]) {
+			const l = this.listeners.get(key);
+			if (l.providerId === providerId && !desired.has(l.serviceId)) this.removeService(key, "service removed by provider");
+		}
+		for (const service of services) {
+			const key = `${providerId}/${service.serviceId}`;
+			const existing = this.listeners.get(key);
+			if (existing !== void 0) {
+				existing.alias = alias;
+				existing.name = service.name;
+				continue;
+			}
+			await this.addService(providerId, alias, service, ports);
+		}
+	}
+	async addService(providerId, alias, service, ports) {
+		const key = `${providerId}/${service.serviceId}`;
+		let listenerRef;
+		const app = new Hono();
+		app.all("*", (c) => {
+			const l = listenerRef;
+			if (l === void 0) return errorResponse(503, "internal", "service listener not ready", "api_error");
+			return this.handleHttp(c.env.incoming, c.env.outgoing, l);
+		});
+		const server = createAdaptorServer({ fetch: app.fetch });
+		const listener = {
+			providerId,
+			alias,
+			serviceId: service.serviceId,
+			name: service.name,
+			server,
+			port: 0,
+			requested: desiredPortFor(service, ports),
+			autoAssigned: false,
+			sockets: /* @__PURE__ */ new Set(),
+			inflight: /* @__PURE__ */ new Set()
+		};
+		listenerRef = listener;
+		server.on("connection", (s) => {
+			listener.sockets.add(s);
+			s.on("close", () => listener.sockets.delete(s));
+		});
+		server.on("upgrade", (req, socket, head) => {
+			if (req.headers.upgrade?.toLowerCase() !== "websocket") {
+				socket.destroy();
+				return;
+			}
+			this.handleUpgrade(req, socket, head, listener);
+		});
+		try {
+			const assignment = await listenWithFallback(server, {
+				desired: listener.requested,
+				strict: this.strictPorts
+			});
+			listener.port = assignment.port;
+			listener.autoAssigned = assignment.autoAssigned;
+			if (assignment.autoAssigned && assignment.reason !== void 0) this.onNotice(`NOTICE: service '${service.name}' - ${assignment.reason} - listening on ${LOOPBACK_HOST}:${assignment.port} instead of ${LOOPBACK_HOST}:${assignment.requested}`);
+		} catch (err) {
+			server.close();
+			throw err;
+		}
+		this.listeners.set(key, listener);
+	}
+	/** 关闭某服务监听：终结在途（ABORT/CLOSE + 本地连接错误关闭）并断开全部 socket。 */
+	removeService(key, reason) {
+		const listener = this.listeners.get(key);
+		if (listener === void 0) return;
+		this.listeners.delete(key);
+		for (const ctx of [...listener.inflight]) ctx.forceAbort();
+		listener.server.close();
+		for (const s of [...listener.sockets]) s.destroy();
+		this.onNotice(`NOTICE: service '${listener.name}' closed (${reason})`);
+	}
+	async stop() {
+		this.stopped = true;
+		for (const key of [...this.listeners.keys()]) {
+			const listener = this.listeners.get(key);
+			for (const ctx of [...listener.inflight]) ctx.forceAbort();
+			listener.server.close();
+			for (const s of [...listener.sockets]) s.destroy();
+			this.listeners.delete(key);
+		}
+		this.wss.close();
+	}
+	routeOr503(listener) {
+		const route = this.resolveRoute(listener.providerId);
+		if (route === void 0) return errorResponse(503, "provider_offline", `provider '${listener.alias}' is offline`, "api_error");
+		return route;
+	}
+	async handleHttp(incoming, outgoing, listener) {
+		if (this.stopped) return errorResponse(503, "provider_offline", "gateway is shutting down", "api_error");
+		const method = (incoming.method ?? "GET").toUpperCase();
+		if (!HTTP_METHODS.includes(method)) return errorResponse(405, "forbidden_method", `http method not allowed: ${method}`, "invalid_request_error");
+		let path = incoming.url ?? "/";
+		if (!path.startsWith("/") || path.startsWith("//") || path.startsWith("/\\")) return errorResponse(400, "protocol_error", "invalid request path", "invalid_request_error");
+		if (path.length > 4096) return errorResponse(400, "protocol_error", "request path exceeds 4 KiB", "invalid_request_error");
+		const filtered = filterRequestHeaders(incoming.headers, false);
+		try {
+			assertHeaderCount(filtered);
+		} catch {
+			return errorResponse(400, "protocol_error", "too many request headers (> 32)", "invalid_request_error");
+		}
+		let body;
+		try {
+			body = method === "GET" || method === "HEAD" ? /* @__PURE__ */ new Uint8Array(0) : await readRequestBody(incoming, this.bodyLimit);
+		} catch (err) {
+			if (err instanceof LocalBodyTooLargeError) return errorResponse(413, "body_too_large", err.message, "invalid_request_error");
+			throw err;
+		}
+		const route = this.routeOr503(listener);
+		if (route instanceof Response) return route;
+		const input = {
+			serviceId: listener.serviceId,
+			method,
+			path,
+			body,
+			upgrade: false,
+			...filtered.headers !== void 0 ? { headers: filtered.headers } : {},
+			...filtered.contentType !== void 0 ? { contentType: filtered.contentType } : {}
+		};
+		const ctx = new HttpStreamCtx(listener, this.receiveLimit, (pid) => this.noteBufferOverflow(pid), method);
+		listener.inflight.add(ctx);
+		const responsePromise = new Promise((resolve) => {
+			ctx.resolveMeta = resolve;
+		});
+		let handle;
+		try {
+			handle = route.forward(input, ctx.handlers());
+		} catch (err) {
+			listener.inflight.delete(ctx);
+			if (err instanceof OfflineError) return errorResponse(503, err.code, `${err.message} (provider '${err.alias}')`, "api_error");
+			throw err;
+		}
+		ctx.attach(handle);
+		outgoing.on("close", () => ctx.clientClosed());
+		outgoing.on("error", () => void 0);
+		return await responsePromise;
+	}
+	handleUpgrade(req, socket, head, listener) {
+		if (this.stopped) {
+			socket.destroy();
+			return;
+		}
+		const route = this.resolveRoute(listener.providerId);
+		if (route === void 0) {
+			writeRawJsonError(socket, 503, "provider_offline", `provider '${listener.alias}' is offline`);
+			return;
+		}
+		const path = req.url ?? "/";
+		if (!path.startsWith("/") || path.startsWith("//") || path.startsWith("/\\")) {
+			writeRawJsonError(socket, 400, "protocol_error", "invalid request path");
+			return;
+		}
+		const filtered = filterRequestHeaders(req.headers, true);
+		const input = {
+			serviceId: listener.serviceId,
+			method: "GET",
+			path,
+			body: /* @__PURE__ */ new Uint8Array(0),
+			upgrade: true,
+			...filtered.headers !== void 0 ? { headers: filtered.headers } : {}
+		};
+		const ctx = new WsStreamCtx(listener, this, this.receiveLimit, (pid) => this.noteBufferOverflow(pid));
+		listener.inflight.add(ctx);
+		let handle;
+		try {
+			handle = route.forward(input, ctx.beginUpgrade(req, socket, head));
+		} catch (err) {
+			listener.inflight.delete(ctx);
+			if (err instanceof OfflineError) writeRawJsonError(socket, 503, err.code, `${err.message} (provider '${err.alias}')`);
+			else writeRawJsonError(socket, 500, "internal", err.message);
+			return;
+		}
+		ctx.attach(handle);
+		socket.on("close", () => ctx.clientClosed());
+		socket.on("error", () => ctx.clientClosed());
+	}
+	/** ws 库本地握手入口（WsStreamCtx 在 RESP_META(101) 后调用）。 */
+	acceptWsUpgrade(req, socket, head, cb) {
+		this.wss.handleUpgrade(req, socket, head, cb);
+	}
+	/** 接收缓冲超限记账（ctx 兜底路径 → 对应提供者连接的 bufferOverflows 计数）。 */
+	noteBufferOverflow(providerId) {
+		this.resolveRoute(providerId)?.noteBufferOverflow();
+	}
+};
+/** 升级前的原始 socket 写 JSON 错误（尚无 hono Response 通道）。 */
+function writeRawJsonError(socket, status, code, message) {
+	if (socket === void 0 || socket.destroyed || !socket.writable) return;
+	const type = ERROR_HTTP_MAPPING[code]?.type ?? "api_error";
+	const body = JSON.stringify(buildErrorJson(code, message, type));
+	socket.write(`HTTP/1.1 ${status} ${reasonFor(status)}\r\ncontent-type: application/json\r\nconnection: close\r\ncontent-length: ${Buffer.byteLength(body)}\r\n\r\n${body}`);
+	socket.end();
+}
+function reasonFor(status) {
+	return {
+		400: "Bad Request",
+		404: "Not Found",
+		405: "Method Not Allowed",
+		413: "Payload Too Large",
+		429: "Too Many Requests",
+		500: "Internal Server Error",
+		502: "Bad Gateway",
+		503: "Service Unavailable",
+		504: "Gateway Timeout"
+	}[status] ?? "Error";
+}
+var HttpStreamCtx = class {
+	listener;
+	limit;
+	noteOverflow;
+	finished = false;
+	handle;
+	/** forward 返回前对端已同步触发中止（overflow 等）——handle 就绪后补发。 */
+	abortPending = false;
+	resolveMeta;
+	state = "pending";
+	controller;
+	queue = [];
+	queuedBytes = 0;
+	ended = false;
+	nullBody = false;
+	dropBody;
+	status = 200;
+	contentType = "application/octet-stream";
+	extraHeaders = {};
+	constructor(listener, limit, noteOverflow, method) {
+		this.listener = listener;
+		this.limit = limit;
+		this.noteOverflow = noteOverflow;
+		this.dropBody = method === "HEAD";
+	}
+	handlers() {
+		return {
+			onMeta: (h) => this.onMeta(h),
+			onChunk: (b) => this.onChunk(b),
+			onEnd: () => this.onEnd(),
+			onError: (h) => this.onError(h),
+			onWsData: () => void 0,
+			onWsClose: () => void 0,
+			onTerminate: (cause) => this.onTerminate(cause)
+		};
+	}
+	onMeta(header) {
+		if (this.finished || this.state !== "pending") return;
+		this.status = header.status;
+		this.contentType = header.contentType;
+		const extra = {};
+		const rid = header.headers?.["x-request-id"];
+		if (rid !== void 0) extra["x-request-id"] = rid;
+		const retry = header.headers?.["retry-after"];
+		if (retry !== void 0) extra["retry-after"] = retry;
+		this.extraHeaders = extra;
+		this.state = "streaming";
+		this.nullBody = NULL_BODY_STATUSES.has(header.status) || this.dropBody;
+		if (this.nullBody) {
+			this.resolveMeta?.(this.metaResponse(null));
+			this.resolveMeta = void 0;
+			return;
+		}
+		const stream = new ReadableStream({
+			start: (controller) => {
+				this.controller = controller;
+				this.pump();
+			},
+			pull: () => this.pump(),
+			cancel: () => this.clientClosed()
+		});
+		this.resolveMeta?.(this.metaResponse(stream));
+		this.resolveMeta = void 0;
+	}
+	metaResponse(body) {
+		const headers = {
+			"content-type": this.contentType,
+			...this.extraHeaders
+		};
+		return new Response(body, {
+			status: this.status,
+			headers
+		});
+	}
+	onChunk(bytes) {
+		if (this.finished || this.state !== "streaming" || this.nullBody) return;
+		if (this.queuedBytes + bytes.length > this.limit) {
+			this.overflow();
+			return;
+		}
+		this.queue.push(bytes);
+		this.queuedBytes += bytes.length;
+		const desired = this.controller?.desiredSize;
+		if (desired !== void 0 && desired !== null && desired > 0) this.pump();
+	}
+	/**
+	* 搬运：把待消费队列批量移入 ReadableStream（≤PUMP_BATCH_BYTES），并对应扣减
+	* queuedBytes。仅由 pull 与 onEnd 驱动——pull 由本地消费方读取触发（真实背压）。
+	*/
+	pump() {
+		const controller = this.controller;
+		if (controller === void 0 || this.state !== "streaming") return;
+		let moved = 0;
+		while (this.queue.length > 0 && moved < PUMP_BATCH_BYTES && (controller.desiredSize ?? 0) > 0) {
+			const chunk = this.queue.shift();
+			moved += chunk.length;
+			this.queuedBytes -= chunk.length;
+			controller.enqueue(chunk);
+		}
+		if (this.ended && this.queue.length === 0 && !this.finished) {
+			this.state = "done";
+			this.finish();
+			try {
+				controller.close();
+			} catch {}
+		}
+	}
+	onEnd() {
+		if (this.finished) return;
+		if (this.state === "pending") {
+			this.finish();
+			this.resolveMeta?.(errorResponse(502, "internal", "response ended without meta", "api_error"));
+			this.resolveMeta = void 0;
+			return;
+		}
+		this.ended = true;
+		if (this.nullBody) {
+			this.state = "done";
+			this.finish();
+			return;
+		}
+		this.pump();
+	}
+	onError(header) {
+		if (this.finished) return;
+		if (this.state === "pending") {
+			const mapped = errorResponseFor(header.code, header.message);
+			this.finish();
+			if (mapped === null) this.resolveMeta?.(errorResponse(504, header.code, header.message, "api_error"));
+			else this.resolveMeta?.(mapped);
+			this.resolveMeta = void 0;
+			return;
+		}
+		this.failStream();
+	}
+	onTerminate(cause) {
+		if (this.finished) return;
+		if (cause.source === "peer") return;
+		if (this.state === "pending") {
+			this.finish();
+			this.resolveMeta?.(errorResponse(502, "upstream_unreachable", `connection lost while waiting for response: ${cause.source}`, "api_error"));
+			this.resolveMeta = void 0;
+			return;
+		}
+		this.failStream();
+	}
+	clientClosed() {
+		if (this.finished) return;
+		this.finish();
+		this.requestAbort();
+	}
+	forceAbort() {
+		if (this.finished) return;
+		this.finish();
+		this.requestAbort();
+		this.failStream();
+	}
+	overflow() {
+		this.noteOverflow(this.listener.providerId);
+		this.finish();
+		this.requestAbort();
+		this.failStream();
+	}
+	/** handle 可能晚于 forward 内的同步回调就绪——就绪前挂起、就绪后补发。 */
+	requestAbort() {
+		if (this.handle !== void 0) this.handle.abort();
+		else this.abortPending = true;
+	}
+	/** forward 返回后由网关绑定 handle；若期间已请求中止则补发。 */
+	attach(handle) {
+		this.handle = handle;
+		if (this.abortPending) handle.abort();
+	}
+	failStream() {
+		const controller = this.controller;
+		this.controller = void 0;
+		if (controller !== void 0) try {
+			controller.error(/* @__PURE__ */ new Error("gateway: local response stream failed"));
+		} catch {}
+	}
+	finish() {
+		this.finished = true;
+		this.listener.inflight.delete(this);
+	}
+};
+var WsStreamCtx = class {
+	listener;
+	gateway;
+	limit;
+	noteOverflow;
+	finished = false;
+	handle;
+	abortPending;
+	ws;
+	/** 本地握手完成前暂存的 DATA_DOWN 字节（计入下行缓冲上限）。 */
+	pendingDown = [];
+	pendingDownBytes = 0;
+	state = "pending";
+	uplinkInFlight = 0;
+	constructor(listener, gateway, limit, noteOverflow) {
+		this.listener = listener;
+		this.gateway = gateway;
+		this.limit = limit;
+		this.noteOverflow = noteOverflow;
+	}
+	/** 升级协商所需的本地侧材料（RESP_META 到达后驱动）。 */
+	beginUpgrade(req, socket, head) {
+		this.req = req;
+		this.socket = socket;
+		this.head = head;
+		return this.handlers();
+	}
+	req;
+	socket;
+	head;
+	handlers() {
+		return {
+			onMeta: (h) => this.onMeta(h),
+			onChunk: (b) => this.onRawChunk(b),
+			onEnd: () => this.onRawEnd(),
+			onError: (h) => this.onError(h),
+			onWsData: (b) => this.onWsData(b),
+			onWsClose: (code) => this.onWsClose(code),
+			onTerminate: (cause) => this.onTerminate(cause)
+		};
+	}
+	onMeta(header) {
+		if (this.finished || this.state !== "pending") return;
+		if (header.status !== 101) {
+			this.state = "raw";
+			const ct = header.contentType;
+			const rid = header.headers?.["x-request-id"];
+			const head = `HTTP/1.1 ${header.status} ${reasonFor(header.status)}\r\ncontent-type: ${ct}\r\nconnection: close\r\n` + (rid !== void 0 ? `x-request-id: ${rid}\r\n` : "");
+			this.socket?.write(head + "\r\n");
+			return;
+		}
+		const req = this.req;
+		const socket = this.socket;
+		const head = this.head ?? Buffer.alloc(0);
+		if (req === void 0 || socket === void 0) {
+			this.finish();
+			return;
+		}
+		this.state = "upgrading";
+		this.gateway.acceptWsUpgrade(req, socket, head, (ws) => this.onLocalWs(ws));
+	}
+	onLocalWs(ws) {
+		if (this.finished) {
+			ws.terminate();
+			return;
+		}
+		this.ws = ws;
+		this.state = "ws";
+		if (this.head !== void 0 && this.head.length > 0) {
+			this.sendData(this.head).catch(() => void 0);
+			this.head = void 0;
+		}
+		for (const pending of this.pendingDown.splice(0)) this.deliverDown(ws, pending);
+		ws.on("message", (data) => {
+			const bytes = rawToBytes(data);
+			if (this.finished) return;
+			if (this.uplinkInFlight + bytes.length > this.limit) {
+				this.overflow();
+				return;
+			}
+			this.sendData(bytes).catch(() => void 0);
+		});
+		ws.on("close", (code) => {
+			if (this.finished) return;
+			this.finish();
+			this.requestAbort({
+				ws: true,
+				code
+			});
+		});
+		ws.on("error", () => {
+			if (this.finished) return;
+			this.finish();
+			this.requestAbort({ ws: true });
+			ws.terminate();
+		});
+	}
+	sendData(bytes) {
+		this.uplinkInFlight += bytes.length;
+		return (this.handle?.sendData(bytes) ?? Promise.resolve()).finally(() => {
+			this.uplinkInFlight -= bytes.length;
+		});
+	}
+	onWsData(bytes) {
+		if (this.finished) return;
+		const ws = this.ws;
+		if (ws === void 0) {
+			if (this.state === "upgrading") {
+				if (this.pendingDownBytes + bytes.length > this.limit) {
+					this.overflow();
+					return;
+				}
+				this.pendingDown.push(bytes);
+				this.pendingDownBytes += bytes.length;
+			}
+			return;
+		}
+		this.deliverDown(ws, bytes);
+	}
+	/** 下行投递 + 本地 socket 缓冲堆积超限兜底。 */
+	deliverDown(ws, bytes) {
+		ws.send(bytes);
+		if (ws.bufferedAmount > this.limit) this.overflow();
+	}
+	onWsClose(code) {
+		if (this.finished) return;
+		this.finish();
+		this.ws?.close(code);
+	}
+	onRawChunk(bytes) {
+		if (this.finished || this.state !== "raw") return;
+		this.socket?.write(bytes);
+	}
+	onRawEnd() {
+		if (this.finished) return;
+		this.finish();
+		if (this.state === "raw") this.socket?.end();
+	}
+	onError(header) {
+		if (this.finished) return;
+		const mapped = errorResponseFor(header.code, header.message);
+		if (this.state === "pending" || this.state === "upgrading") {
+			this.finish();
+			if (mapped === null || this.socket === void 0) this.socket?.destroy();
+			else writeRawJsonError(this.socket, mapped.status, header.code, header.message);
+			return;
+		}
+		if (this.state === "raw") {
+			this.finish();
+			this.socket?.destroy();
+			return;
+		}
+		this.finish();
+		this.ws?.terminate();
+	}
+	onTerminate(cause) {
+		if (this.finished) return;
+		if (cause.source === "peer") return;
+		this.finish();
+		if (this.state === "ws") this.ws?.terminate();
+		else if (this.socket !== void 0 && !this.socket.destroyed) this.socket.destroy();
+	}
+	clientClosed() {
+		if (this.finished) return;
+		this.finish();
+		this.requestAbort({ ws: true });
+	}
+	forceAbort() {
+		if (this.finished) return;
+		this.finish();
+		this.requestAbort({ ws: true });
+		this.ws?.terminate();
+		if (this.socket !== void 0 && !this.socket.destroyed) this.socket.destroy();
+	}
+	requestAbort(opts) {
+		if (this.handle !== void 0) {
+			const o = { ws: opts.ws };
+			if (opts.code !== void 0) o.code = opts.code;
+			this.handle.abort(o);
+		} else this.abortPending = {
+			ws: opts.ws,
+			...opts.code !== void 0 ? { code: opts.code } : {}
+		};
+	}
+	/** forward 返回后由网关绑定 handle；若期间已请求中止则补发（CLOSE/ABORT）。 */
+	attach(handle) {
+		this.handle = handle;
+		const pending = this.abortPending;
+		if (pending !== void 0) {
+			const o = { ws: pending.ws };
+			if (pending.code !== void 0) o.code = pending.code;
+			handle.abort(o);
+		}
+	}
+	overflow() {
+		this.noteOverflow(this.listener.providerId);
+		this.finish();
+		this.requestAbort({ ws: false });
+		this.ws?.terminate();
+		if (this.socket !== void 0 && !this.socket.destroyed) this.socket.destroy();
+	}
+	finish() {
+		this.finished = true;
+		this.listener.inflight.delete(this);
+	}
+};
+function rawToBytes(data) {
+	if (Buffer.isBuffer(data)) return new Uint8Array(data);
+	if (Array.isArray(data)) return new Uint8Array(Buffer.concat(data));
+	if (data instanceof ArrayBuffer) return new Uint8Array(data);
+	return new Uint8Array(Buffer.from(data));
+}
+//#endregion
+//#region src/consumer/runtime.ts
+async function startEngine(opts) {
+	const managerRef = {};
+	const gateway = new Gateway({
+		resolveRoute: (providerId) => managerRef.current?.routeFor(providerId),
+		...opts.strictPorts !== void 0 ? { strictPorts: opts.strictPorts } : {},
+		...opts.onNotice !== void 0 ? { onNotice: opts.onNotice } : {}
+	});
+	const manager = new ProviderManager({
+		rings: opts.rings,
+		root: opts.consumersRoot,
+		sessionFactory: opts.sessionFactoryFor,
+		...opts.pollIntervalMs !== void 0 ? { pollIntervalMs: opts.pollIntervalMs } : {},
+		...opts.backoff !== void 0 ? { backoff: opts.backoff } : {},
+		onCatalog: (providerId, alias, services, ports) => {
+			gateway.syncProviderServices(providerId, alias, services, ports);
+		}
+	});
+	managerRef.current = manager;
+	for (const ring of opts.rings) if (ring.services.length > 0) await gateway.syncProviderServices(ring.endpointId, ring.alias, ring.services, ring.ports);
+	manager.start();
+	return {
+		manager,
+		gateway,
+		stop: async () => {
+			await gateway.stop();
+			await manager.stop();
+		}
+	};
+}
+//#endregion
+export { createFabricProviderTransport as n, startEngine as t };