clinkx 0.3.0 → 1.1.0

package/dist/dashboard-gateway/index.js

@@ -0,0 +1,786 @@
+import { createServer, validateHeaderValue, } from "node:http";
+import { timingSafeEqual } from "node:crypto";
+import { randomUUID } from "node:crypto";
+import { WebSocketServer } from "ws";
+import { DASHBOARD_GATEWAY_V2_SUBPROTOCOL, MAX_GATEWAY_V2_REQUEST_BODY_BYTES, isForwardableV2PostPath, parseGatewayRequest, parseGatewayV2Request, parseGatewayV2Response, } from "../dashboard-companion/protocol.js";
+import { isDashboardPairingToken } from "../dashboard-pairing-token.js";
+const MAX_AGENT_FRAME_BYTES = 24 * 1024 * 1024;
+const MAX_FORWARD_PATH_BYTES = 2_048;
+const MAX_FORWARD_HEADER_BYTES = 64 * 1024;
+const MAX_REQUEST_MESSAGE_BYTES = 64 * 1024;
+const MAX_RESPONSE_BODY_BYTES = 16 * 1024 * 1024;
+const MAX_IN_FLIGHT = 128;
+const MAX_V2_IN_FLIGHT = 8;
+const MAX_V2_SMALL_POST_BYTES = 4 * 1024;
+const MAX_RETIRED_REQUEST_IDS = 1_024;
+const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
+const DEFAULT_PING_INTERVAL_MS = 10_000;
+const RESPONSE_HEADER_ALLOWLIST = new Set([
+    "access-control-allow-headers",
+    "access-control-allow-methods",
+    "access-control-allow-origin",
+    "access-control-expose-headers",
+    "cache-control",
+    "content-length",
+    "content-type",
+    "etag",
+    "vary",
+    "x-clinkx-agent-instance-id",
+]);
+function sendText(response, status, body) {
+    response.writeHead(status, {
+        "cache-control": "no-store",
+        "content-type": "text/plain; charset=utf-8",
+    });
+    response.end(body);
+}
+function sendJson(response, status, error) {
+    const body = `${JSON.stringify({ error })}\n`;
+    response.writeHead(status, {
+        "cache-control": "no-store",
+        "content-type": "application/json; charset=utf-8",
+        "content-length": Buffer.byteLength(body),
+    });
+    response.end(body);
+}
+function requestHeaders(request) {
+    const result = { host: request.headers.host ?? "" };
+    const copy = (source, target) => {
+        const value = request.headers[source];
+        if (typeof value === "string")
+            result[target] = value;
+    };
+    copy("origin", "origin");
+    copy("authorization", "authorization");
+    copy("access-control-request-method", "accessControlRequestMethod");
+    copy("access-control-request-headers", "accessControlRequestHeaders");
+    copy("x-clinkx-agent-instance-id", "agentInstanceId");
+    return result;
+}
+function oneHeader(request, name) {
+    const values = request.headersDistinct[name];
+    if (values === undefined)
+        return undefined;
+    return values.length === 1 && values[0] !== undefined && values[0] !== ""
+        ? values[0]
+        : null;
+}
+const V2_PROGRESS_REPORT_STATUS_OVERRIDE_PATH = /^\/api\/progress-reports\/[A-Za-z0-9][A-Za-z0-9_-]{0,63}\/status-override$/;
+function v2PostBodyLimit(path) {
+    return path === "/api/auth/register/options"
+        || path === "/api/auth/login/options"
+        || path === "/api/auth/logout"
+        || V2_PROGRESS_REPORT_STATUS_OVERRIDE_PATH.test(path)
+        ? MAX_V2_SMALL_POST_BYTES
+        : MAX_GATEWAY_V2_REQUEST_BODY_BYTES;
+}
+function v2RequestHeaders(request, method, path) {
+    const host = oneHeader(request, "host");
+    const origin = oneHeader(request, "origin");
+    const cookie = oneHeader(request, "cookie");
+    const contentType = oneHeader(request, "content-type");
+    const enrollmentCode = oneHeader(request, "x-enrollment-code");
+    if (host == null || origin === null || cookie === null || contentType === null || enrollmentCode === null) {
+        return undefined;
+    }
+    if (method === "POST") {
+        if (contentType === undefined || contentType.toLowerCase() !== "application/json")
+            return undefined;
+        if (enrollmentCode !== undefined
+            && path !== "/api/auth/register/options"
+            && path !== "/api/auth/register/verify")
+            return undefined;
+    }
+    else if (contentType !== undefined || enrollmentCode !== undefined) {
+        return undefined;
+    }
+    return {
+        host,
+        ...(origin === undefined ? {} : { origin }),
+        ...(cookie === undefined ? {} : { cookie }),
+        ...(contentType === undefined ? {} : { contentType }),
+        ...(enrollmentCode === undefined ? {} : { enrollmentCode }),
+    };
+}
+async function readV2RequestBody(request, maximumBytes, signal) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let total = 0;
+        let settled = false;
+        const cleanup = () => {
+            request.off("data", onData);
+            request.off("end", onEnd);
+            request.off("error", onError);
+            request.off("aborted", onAborted);
+            signal.removeEventListener("abort", onAbort);
+        };
+        const finish = (body) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            resolve(body);
+        };
+        const onData = (chunk) => {
+            const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            total += bytes.byteLength;
+            if (total > maximumBytes) {
+                request.resume();
+                finish(undefined);
+                return;
+            }
+            chunks.push(bytes);
+        };
+        const onEnd = () => finish(Buffer.concat(chunks));
+        const onError = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            reject(error);
+        };
+        const onAborted = () => finish(undefined);
+        const onAbort = () => {
+            request.resume();
+            finish(undefined);
+        };
+        if (signal.aborted) {
+            onAbort();
+            return;
+        }
+        request.on("data", onData);
+        request.once("end", onEnd);
+        request.once("error", onError);
+        request.once("aborted", onAborted);
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
+}
+function byteSize(value) {
+    return Buffer.byteLength(JSON.stringify(value));
+}
+function isAllowedApiTarget(path) {
+    if (Buffer.byteLength(path) > MAX_FORWARD_PATH_BYTES)
+        return false;
+    const rawPathname = path.split("?", 1)[0] ?? "";
+    if (/%(?:00|2e|2f|5c)/i.test(rawPathname) || rawPathname.includes("\\"))
+        return false;
+    try {
+        const parsed = new URL(path, "http://dashboard-gateway.invalid");
+        return parsed.origin === "http://dashboard-gateway.invalid"
+            && `${parsed.pathname}${parsed.search}` === path
+            && (parsed.pathname === "/api" || parsed.pathname.startsWith("/api/"));
+    }
+    catch {
+        return false;
+    }
+}
+function decodeBase64(value) {
+    if (typeof value !== "string" || value.length % 4 !== 0)
+        return undefined;
+    const padding = value.endsWith("==") ? 2 : value.endsWith("=") ? 1 : 0;
+    const decodedLength = (value.length / 4) * 3 - padding;
+    if (decodedLength > MAX_RESPONSE_BODY_BYTES)
+        return undefined;
+    const decoded = Buffer.from(value, "base64");
+    return decoded.length === decodedLength && decoded.toString("base64") === value
+        ? decoded
+        : undefined;
+}
+function allowedResponseHeaders(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return undefined;
+    if (byteSize(value) > MAX_FORWARD_HEADER_BYTES)
+        return undefined;
+    const result = {};
+    for (const [name, headerValue] of Object.entries(value)) {
+        const normalized = name.toLowerCase();
+        if (typeof headerValue !== "string")
+            return undefined;
+        if (RESPONSE_HEADER_ALLOWLIST.has(normalized)) {
+            try {
+                validateHeaderValue(normalized, headerValue);
+            }
+            catch {
+                return undefined;
+            }
+            result[normalized] = headerValue;
+        }
+    }
+    return result;
+}
+function tokenMatches(header, expectedToken) {
+    const prefix = "Bearer ";
+    if (header === undefined || !header.startsWith(prefix))
+        return false;
+    const actual = Buffer.from(header.slice(prefix.length));
+    const expected = Buffer.from(expectedToken);
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+function rejectUpgrade(socket, status, reason) {
+    const body = `${reason}\n`;
+    socket.end(`HTTP/1.1 ${status} ${reason}\r\n` +
+        "Connection: close\r\n" +
+        "Cache-Control: no-store\r\n" +
+        "Content-Type: text/plain; charset=utf-8\r\n" +
+        `Content-Length: ${Buffer.byteLength(body)}\r\n\r\n${body}`);
+}
+export function createDashboardGateway(options) {
+    if (!isDashboardPairingToken(options.token)) {
+        throw new Error("Dashboard gateway token is invalid");
+    }
+    const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+    if (!Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs <= 0) {
+        throw new Error("Dashboard gateway request timeout must be a positive integer");
+    }
+    const pingIntervalMs = options.pingIntervalMs ?? DEFAULT_PING_INTERVAL_MS;
+    if (!Number.isSafeInteger(pingIntervalMs) || pingIntervalMs <= 0) {
+        throw new Error("Dashboard gateway ping interval must be a positive integer");
+    }
+    // Production default 10s → 20s miss window, which is max(15s, 2×interval).
+    // Tests inject a short interval; a literal 15s floor would make those tests wait 15s.
+    const pongDeadlineMs = pingIntervalMs * 2;
+    const pending = new Map();
+    const retiredRequestIds = new Set();
+    let agent;
+    let v2Reservations = 0;
+    const reserveV2Request = () => {
+        if (v2Reservations >= MAX_V2_IN_FLIGHT)
+            return false;
+        v2Reservations += 1;
+        return true;
+    };
+    const releaseV2Request = () => {
+        if (v2Reservations > 0)
+            v2Reservations -= 1;
+    };
+    const dropPending = (id) => {
+        const item = pending.get(id);
+        if (item === undefined)
+            return undefined;
+        pending.delete(id);
+        if (item.version === 2)
+            releaseV2Request();
+        return item;
+    };
+    const retireRequestId = (id) => {
+        retiredRequestIds.add(id);
+        while (retiredRequestIds.size > MAX_RETIRED_REQUEST_IDS) {
+            const oldest = retiredRequestIds.values().next().value;
+            if (oldest === undefined)
+                break;
+            retiredRequestIds.delete(oldest);
+        }
+    };
+    const failPending = (status, error) => {
+        for (const [id, item] of pending) {
+            clearTimeout(item.timeout);
+            dropPending(id);
+            if (!item.response.writableEnded)
+                sendJson(item.response, status, error);
+        }
+    };
+    const server = createServer({ maxHeaderSize: MAX_FORWARD_HEADER_BYTES }, (request, response) => {
+        if (request.method === "GET" && request.url === "/healthz") {
+            sendText(response, 200, "ok\n");
+            return;
+        }
+        const method = request.method ?? "";
+        const path = request.url ?? "";
+        if (!isAllowedApiTarget(path)) {
+            sendJson(response, 404, "not_found");
+            return;
+        }
+        const v2Post = method === "POST" && isForwardableV2PostPath(path);
+        if (v2Post) {
+            if (agent === undefined || agent.websocket.readyState !== 1 || agent.version !== 2) {
+                request.resume();
+                sendJson(response, 503, "dashboard_passkey_companion_unavailable");
+                return;
+            }
+            if (!reserveV2Request()) {
+                request.resume();
+                sendJson(response, 503, "dashboard_gateway_capacity_exceeded");
+                return;
+            }
+            const bodyReadAbort = new AbortController();
+            const requestDeadlineAt = Date.now() + requestTimeoutMs;
+            let pendingId;
+            let reservationHeld = true;
+            let bodyTimedOut = false;
+            let bodyDeadline;
+            const clearBodyDeadline = () => {
+                if (bodyDeadline !== undefined) {
+                    clearTimeout(bodyDeadline);
+                    bodyDeadline = undefined;
+                }
+            };
+            const releaseReservation = () => {
+                if (!reservationHeld)
+                    return;
+                reservationHeld = false;
+                releaseV2Request();
+            };
+            response.once("close", () => {
+                if (pendingId !== undefined) {
+                    const item = dropPending(pendingId);
+                    if (item !== undefined) {
+                        clearTimeout(item.timeout);
+                        retireRequestId(pendingId);
+                    }
+                    return;
+                }
+                clearBodyDeadline();
+                bodyReadAbort.abort();
+                releaseReservation();
+            });
+            bodyDeadline = setTimeout(() => {
+                if (!reservationHeld)
+                    return;
+                bodyTimedOut = true;
+                bodyReadAbort.abort();
+                releaseReservation();
+                if (!response.destroyed && !response.writableEnded) {
+                    sendJson(response, 504, "dashboard_companion_timeout");
+                }
+            }, Math.max(1, requestDeadlineAt - Date.now()));
+            bodyDeadline.unref();
+            const headers = v2RequestHeaders(request, "POST", path);
+            if (headers === undefined) {
+                request.resume();
+                clearBodyDeadline();
+                bodyReadAbort.abort();
+                releaseReservation();
+                sendJson(response, 400, "invalid_request");
+                return;
+            }
+            void readV2RequestBody(request, v2PostBodyLimit(path), bodyReadAbort.signal).then((body) => {
+                clearBodyDeadline();
+                if (bodyTimedOut || response.destroyed || response.writableEnded || !reservationHeld)
+                    return;
+                if (Date.now() >= requestDeadlineAt) {
+                    releaseReservation();
+                    sendJson(response, 504, "dashboard_companion_timeout");
+                    return;
+                }
+                if (body === undefined) {
+                    releaseReservation();
+                    sendJson(response, 413, "payload_too_large");
+                    return;
+                }
+                if (agent === undefined || agent.websocket.readyState !== 1 || agent.version !== 2) {
+                    releaseReservation();
+                    sendJson(response, 503, "dashboard_passkey_companion_unavailable");
+                    return;
+                }
+                const id = randomUUID();
+                let wireRequest;
+                try {
+                    wireRequest = JSON.stringify(parseGatewayV2Request(JSON.stringify({
+                        v: 2,
+                        type: "request",
+                        id,
+                        method: "POST",
+                        path,
+                        headers,
+                        bodyBase64: body.toString("base64"),
+                    })));
+                }
+                catch {
+                    releaseReservation();
+                    sendJson(response, 400, "invalid_request");
+                    return;
+                }
+                const timeout = setTimeout(() => {
+                    const item = dropPending(id);
+                    if (item === undefined)
+                        return;
+                    retireRequestId(id);
+                    sendJson(item.response, 504, "dashboard_companion_timeout");
+                }, requestDeadlineAt - Date.now());
+                timeout.unref();
+                pending.set(id, { response, method, timeout, version: 2 });
+                pendingId = id;
+                reservationHeld = false;
+                try {
+                    agent.websocket.send(wireRequest, (error) => {
+                        if (!error)
+                            return;
+                        const item = dropPending(id);
+                        if (item === undefined)
+                            return;
+                        clearTimeout(item.timeout);
+                        retireRequestId(id);
+                        sendJson(item.response, 503, "dashboard_passkey_companion_unavailable");
+                    });
+                }
+                catch {
+                    const item = dropPending(id);
+                    if (item !== undefined) {
+                        clearTimeout(item.timeout);
+                        retireRequestId(id);
+                        sendJson(item.response, 503, "dashboard_passkey_companion_unavailable");
+                    }
+                }
+            }).catch(() => {
+                clearBodyDeadline();
+                if (bodyTimedOut || response.destroyed || response.writableEnded)
+                    return;
+                releaseReservation();
+                sendJson(response, 400, "invalid_request");
+            });
+            return;
+        }
+        if (method !== "GET" && method !== "HEAD" && method !== "OPTIONS") {
+            response.setHeader("allow", "GET, HEAD, OPTIONS");
+            sendJson(response, 405, "method_not_allowed");
+            return;
+        }
+        const contentLength = request.headers["content-length"];
+        if (request.headers["transfer-encoding"] !== undefined ||
+            (contentLength !== undefined && contentLength !== "0")) {
+            request.resume();
+            response.setHeader("connection", "close");
+            sendJson(response, 413, "request_body_not_allowed");
+            return;
+        }
+        if (agent === undefined || agent.websocket.readyState !== 1) {
+            sendJson(response, 503, "dashboard_companion_unavailable");
+            return;
+        }
+        if (agent.version === 2 && method === "OPTIONS") {
+            response.setHeader("allow", "GET, HEAD");
+            sendJson(response, 405, "method_not_allowed");
+            return;
+        }
+        if (agent.version === 2 && method !== "OPTIONS") {
+            if (!reserveV2Request()) {
+                sendJson(response, 503, "dashboard_gateway_capacity_exceeded");
+                return;
+            }
+            const headers = v2RequestHeaders(request, method, path);
+            if (headers === undefined) {
+                releaseV2Request();
+                sendJson(response, 400, "invalid_request");
+                return;
+            }
+            const id = randomUUID();
+            let wireRequest;
+            try {
+                wireRequest = JSON.stringify(parseGatewayV2Request(JSON.stringify({
+                    v: 2,
+                    type: "request",
+                    id,
+                    method,
+                    path,
+                    headers,
+                    bodyBase64: "",
+                })));
+            }
+            catch {
+                releaseV2Request();
+                sendJson(response, 400, "invalid_request");
+                return;
+            }
+            const timeout = setTimeout(() => {
+                const item = dropPending(id);
+                if (item === undefined)
+                    return;
+                retireRequestId(id);
+                sendJson(item.response, 504, "dashboard_companion_timeout");
+            }, requestTimeoutMs);
+            timeout.unref();
+            pending.set(id, { response, method, timeout, version: 2 });
+            try {
+                agent.websocket.send(wireRequest, (error) => {
+                    if (!error)
+                        return;
+                    const item = dropPending(id);
+                    if (item === undefined)
+                        return;
+                    clearTimeout(item.timeout);
+                    retireRequestId(id);
+                    sendJson(item.response, 503, "dashboard_companion_unavailable");
+                });
+            }
+            catch {
+                const item = dropPending(id);
+                if (item !== undefined) {
+                    clearTimeout(item.timeout);
+                    retireRequestId(id);
+                    sendJson(item.response, 503, "dashboard_companion_unavailable");
+                }
+            }
+            response.once("close", () => {
+                if (response.writableEnded)
+                    return;
+                const item = dropPending(id);
+                if (item !== undefined) {
+                    clearTimeout(item.timeout);
+                    retireRequestId(id);
+                }
+            });
+            return;
+        }
+        if (pending.size >= MAX_IN_FLIGHT) {
+            sendJson(response, 503, "dashboard_gateway_capacity_exceeded");
+            return;
+        }
+        const headers = requestHeaders(request);
+        if (byteSize(headers) > MAX_FORWARD_HEADER_BYTES) {
+            sendJson(response, 431, "request_headers_too_large");
+            return;
+        }
+        const id = randomUUID();
+        let wireRequest;
+        try {
+            const admitted = parseGatewayRequest(JSON.stringify({ v: 1, type: "request", id, method, path, headers }));
+            wireRequest = JSON.stringify(admitted);
+        }
+        catch {
+            sendJson(response, 431, "request_headers_too_large");
+            return;
+        }
+        if (Buffer.byteLength(wireRequest) > MAX_REQUEST_MESSAGE_BYTES) {
+            sendJson(response, 431, "request_headers_too_large");
+            return;
+        }
+        const timeout = setTimeout(() => {
+            const item = pending.get(id);
+            if (item === undefined)
+                return;
+            dropPending(id);
+            retireRequestId(id);
+            sendJson(item.response, 504, "dashboard_companion_timeout");
+        }, requestTimeoutMs);
+        timeout.unref();
+        pending.set(id, { response, method, timeout, version: 1 });
+        agent.websocket.send(wireRequest, (error) => {
+            if (!error)
+                return;
+            const item = pending.get(id);
+            if (item === undefined)
+                return;
+            clearTimeout(item.timeout);
+            dropPending(id);
+            retireRequestId(id);
+            sendJson(item.response, 503, "dashboard_companion_unavailable");
+        });
+        response.once("close", () => {
+            if (response.writableEnded)
+                return;
+            const item = pending.get(id);
+            if (item !== undefined)
+                clearTimeout(item.timeout);
+            dropPending(id);
+            if (item !== undefined)
+                retireRequestId(id);
+        });
+    });
+    const websocketServer = new WebSocketServer({
+        noServer: true,
+        maxPayload: MAX_AGENT_FRAME_BYTES,
+        perMessageDeflate: false,
+        handleProtocols(protocols) {
+            return protocols.has(DASHBOARD_GATEWAY_V2_SUBPROTOCOL)
+                ? DASHBOARD_GATEWAY_V2_SUBPROTOCOL
+                : false;
+        },
+    });
+    websocketServer.on("connection", (websocket) => {
+        websocket.on("error", () => undefined);
+        const version = websocket.protocol === DASHBOARD_GATEWAY_V2_SUBPROTOCOL ? 2 : 1;
+        websocket.on("message", (data, isBinary) => {
+            if (isBinary) {
+                websocket.close(1003, "text messages required");
+                return;
+            }
+            let message;
+            try {
+                const parsed = JSON.parse(data.toString());
+                if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+                    throw new Error();
+                message = parsed;
+            }
+            catch {
+                websocket.close(1007, "invalid response");
+                return;
+            }
+            if (typeof message.id !== "string") {
+                websocket.close(1008, "invalid response");
+                return;
+            }
+            const item = pending.get(message.id);
+            if (item === undefined) {
+                if (retiredRequestIds.delete(message.id))
+                    return;
+                websocket.close(1008, "unknown response id");
+                return;
+            }
+            if (item.version !== version) {
+                websocket.close(1008, "invalid response");
+                return;
+            }
+            if (version === 2) {
+                let parsed;
+                try {
+                    parsed = parseGatewayV2Response(data.toString());
+                }
+                catch {
+                    clearTimeout(item.timeout);
+                    dropPending(message.id);
+                    sendJson(item.response, 502, "invalid_companion_response");
+                    websocket.close(1008, "invalid response");
+                    return;
+                }
+                const body = Buffer.from(parsed.bodyBase64, "base64");
+                const headers = {
+                    ...(parsed.headers.allow === undefined ? {} : { allow: parsed.headers.allow }),
+                    ...(parsed.headers.cacheControl === undefined ? {} : { "cache-control": parsed.headers.cacheControl }),
+                    ...(parsed.headers.contentLength === undefined ? {} : { "content-length": parsed.headers.contentLength }),
+                    ...(parsed.headers.contentType === undefined ? {} : { "content-type": parsed.headers.contentType }),
+                    ...(parsed.headers.etag === undefined ? {} : { etag: parsed.headers.etag }),
+                    ...(parsed.headers.retryAfter === undefined ? {} : { "retry-after": parsed.headers.retryAfter }),
+                    ...(parsed.headers.setCookies === undefined ? {} : { "set-cookie": [...parsed.headers.setCookies] }),
+                    ...(parsed.headers.validatorSchemaId === undefined ? {} : { "x-clinkx-validator-schema-id": parsed.headers.validatorSchemaId }),
+                    ...(parsed.headers.vary === undefined ? {} : { vary: parsed.headers.vary }),
+                };
+                if (parsed.headers.contentLength !== undefined
+                    && item.method !== "HEAD"
+                    && Number(parsed.headers.contentLength) !== body.byteLength) {
+                    clearTimeout(item.timeout);
+                    dropPending(parsed.id);
+                    sendJson(item.response, 502, "invalid_companion_response");
+                    websocket.close(1008, "invalid response");
+                    return;
+                }
+                try {
+                    item.response.writeHead(parsed.status, headers);
+                }
+                catch {
+                    clearTimeout(item.timeout);
+                    dropPending(parsed.id);
+                    try {
+                        if (!item.response.headersSent && !item.response.writableEnded) {
+                            sendJson(item.response, 502, "invalid_companion_response");
+                        }
+                        else {
+                            item.response.destroy();
+                        }
+                    }
+                    catch {
+                        item.response.destroy();
+                    }
+                    websocket.close(1008, "invalid response");
+                    return;
+                }
+                clearTimeout(item.timeout);
+                dropPending(parsed.id);
+                item.response.end(item.method === "HEAD" ? undefined : body);
+                return;
+            }
+            if (message.v !== 1 || message.type !== "response") {
+                websocket.close(1008, "invalid response");
+                return;
+            }
+            const status = message.status;
+            const headers = allowedResponseHeaders(message.headers);
+            const body = decodeBase64(message.bodyBase64);
+            if (!Number.isInteger(status) || status < 100 || status > 599 || headers === undefined || body === undefined) {
+                clearTimeout(item.timeout);
+                dropPending(message.id);
+                sendJson(item.response, 502, "invalid_companion_response");
+                websocket.close(1008, "invalid response");
+                return;
+            }
+            clearTimeout(item.timeout);
+            dropPending(message.id);
+            item.response.writeHead(status, headers);
+            item.response.end(item.method === "HEAD" ? undefined : body);
+        });
+    });
+    server.on("upgrade", (request, socket, head) => {
+        if (request.url !== "/agent") {
+            rejectUpgrade(socket, 404, "Not Found");
+            return;
+        }
+        if (!tokenMatches(request.headers.authorization, options.token)) {
+            rejectUpgrade(socket, 401, "Unauthorized");
+            return;
+        }
+        const offeredProtocols = request.headersDistinct["sec-websocket-protocol"];
+        const offersV2 = offeredProtocols?.some((value) => value.split(",").some((protocol) => protocol.trim() === DASHBOARD_GATEWAY_V2_SUBPROTOCOL)) ?? false;
+        if (offeredProtocols !== undefined && !offersV2) {
+            rejectUpgrade(socket, 426, "Upgrade Required");
+            return;
+        }
+        if (agent !== undefined && agent.websocket.readyState === 1) {
+            rejectUpgrade(socket, 409, "Conflict");
+            return;
+        }
+        websocketServer.handleUpgrade(request, socket, head, (websocket) => {
+            if (agent !== undefined) {
+                failPending(503, "dashboard_companion_unavailable");
+            }
+            let lastPongAt = Date.now();
+            const heartbeat = setInterval(() => {
+                if (websocket.readyState !== 1)
+                    return;
+                if (Date.now() - lastPongAt > pongDeadlineMs) {
+                    websocket.terminate();
+                    return;
+                }
+                try {
+                    websocket.ping();
+                }
+                catch {
+                    websocket.terminate();
+                }
+            }, pingIntervalMs);
+            heartbeat.unref();
+            websocket.on("pong", () => {
+                lastPongAt = Date.now();
+            });
+            websocket.once("close", () => {
+                clearInterval(heartbeat);
+                if (agent?.websocket === websocket) {
+                    agent = undefined;
+                    failPending(503, "dashboard_companion_unavailable");
+                }
+            });
+            agent = { websocket, version: websocket.protocol === DASHBOARD_GATEWAY_V2_SUBPROTOCOL ? 2 : 1 };
+            retiredRequestIds.clear();
+            websocketServer.emit("connection", websocket, request);
+        });
+    });
+    return {
+        listen(port, host) {
+            return new Promise((resolve, reject) => {
+                const onError = (error) => reject(error);
+                server.once("error", onError);
+                server.listen(port, host, () => {
+                    server.off("error", onError);
+                    resolve();
+                });
+            });
+        },
+        address() {
+            return server.address();
+        },
+        close() {
+            return new Promise((resolve, reject) => {
+                agent?.websocket.terminate();
+                if (!server.listening) {
+                    resolve();
+                    return;
+                }
+                server.close((error) => {
+                    if (error)
+                        reject(error);
+                    else
+                        resolve();
+                });
+            });
+        },
+    };
+}
+//# sourceMappingURL=index.js.map