ds-harness-remote 0.3.8

package/dist/server-connection.js

@@ -0,0 +1,759 @@
+import { NoiseIkSession, createNoisePrologue, fromBase64Url, toBase64Url, } from '@dsh-remote/crypto';
+import { PROTOCOL_VERSION, SecureMessageCodec, createControlFrame, decodeMessage, encodeMessage, parseControlFrame, } from '@dsh-remote/protocol';
+import { RtcDataChannelTransport, } from '@dsh-remote/webrtc';
+import { ServerApiError } from './server-api.js';
+import { PLUGIN_VERSION } from './version.js';
+const DEFAULT_WEBRTC_NEGOTIATE_TIMEOUT_MS = 8_000;
+export class HostServerConnection {
+    config;
+    identity;
+    identities;
+    api;
+    connections;
+    logger;
+    createWebSocket;
+    rtcFactoryProvider;
+    socket;
+    running;
+    stopped = true;
+    online = false;
+    retryWake;
+    tunnels = new Map();
+    terminalError;
+    lastActiveAt;
+    reconnectRequested = false;
+    resumeQueued = false;
+    rtcFactory;
+    constructor(config, identity, identities, api, connections, logger, createWebSocket = url => new WebSocket(url), rtcFactoryProvider) {
+        this.config = config;
+        this.identity = identity;
+        this.identities = identities;
+        this.api = api;
+        this.connections = connections;
+        this.logger = logger;
+        this.createWebSocket = createWebSocket;
+        this.rtcFactoryProvider = rtcFactoryProvider;
+    }
+    start() {
+        if (this.running !== undefined)
+            return;
+        this.stopped = false;
+        this.running = this.run().finally(() => { this.running = undefined; });
+    }
+    resume() {
+        this.terminalError = undefined;
+        this.stopped = false;
+        if (this.running === undefined) {
+            this.start();
+            return;
+        }
+        if (this.resumeQueued)
+            return;
+        this.resumeQueued = true;
+        void this.running.finally(() => {
+            this.resumeQueued = false;
+            if (!this.stopped)
+                this.start();
+        });
+    }
+    async stop() {
+        this.stopped = true;
+        this.reconnectRequested = false;
+        this.retryWake?.();
+        this.retryWake = undefined;
+        this.socket?.close(1000, 'plugin stopped');
+        await this.running;
+        await this.dropTunnels();
+    }
+    isOnline() { return this.online; }
+    lastError() { return this.terminalError; }
+    lastActivity() { return this.lastActiveAt; }
+    isReconnecting() { return !this.online && !this.stopped && this.running !== undefined; }
+    reconnect() {
+        this.terminalError = undefined;
+        this.stopped = false;
+        if (this.running === undefined) {
+            this.start();
+            return;
+        }
+        this.reconnectRequested = true;
+        this.retryWake?.();
+        this.socket?.close(4000, 'manual reconnect');
+        void this.running.finally(() => {
+            if (!this.reconnectRequested || this.stopped)
+                return;
+            this.reconnectRequested = false;
+            this.start();
+        });
+    }
+    async run() {
+        let delayMs = this.config.reconnect.initialDelayMs;
+        while (!this.stopped) {
+            try {
+                await this.connectOnce();
+                delayMs = this.config.reconnect.initialDelayMs;
+            }
+            catch (error) {
+                const code = errorCode(error);
+                this.terminalError = code;
+                this.logger.warn('server control connection failed', { code, retryable: isRetryable(error) });
+                if (TERMINAL_AUTH_ERRORS.has(code) || !this.config.reconnect.enabled)
+                    return;
+            }
+            if (this.stopped)
+                return;
+            if (this.reconnectRequested) {
+                this.reconnectRequested = false;
+                delayMs = this.config.reconnect.initialDelayMs;
+                continue;
+            }
+            if (!this.config.reconnect.enabled)
+                return;
+            await this.waitBeforeRetry(delayMs);
+            if (this.reconnectRequested) {
+                this.reconnectRequested = false;
+                delayMs = this.config.reconnect.initialDelayMs;
+                continue;
+            }
+            delayMs = Math.min(this.config.reconnect.maxDelayMs, delayMs * 2);
+        }
+    }
+    async connectOnce() {
+        const credentials = await this.api.authenticate(this.identity);
+        if (this.stopped)
+            return;
+        const socket = this.createWebSocket(websocketUrl(this.api.baseUrl));
+        this.socket = socket;
+        let acknowledged = false;
+        let messageQueue = Promise.resolve();
+        await new Promise((resolve, reject) => {
+            let settled = false;
+            const helloTimer = setTimeout(() => socket.close(4001, 'hello timeout'), 10_000);
+            const finish = (error) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(helloTimer);
+                this.online = false;
+                if (this.socket === socket)
+                    this.socket = undefined;
+                void this.dropTunnels().finally(() => error === undefined ? resolve() : reject(error));
+            };
+            socket.onopen = () => {
+                this.sendControl('hello', {
+                    role: 'host',
+                    deviceId: this.identity.deviceId,
+                    accessToken: credentials.accessToken,
+                    protocols: [PROTOCOL_VERSION],
+                    clientVersion: PLUGIN_VERSION,
+                    capabilities: this.rtcFactoryProvider === undefined || this.config.forceRelay
+                        ? ['transport.relay', 'harness.api.v1']
+                        : ['transport.p2p', 'transport.turn', 'transport.relay', 'harness.api.v1'],
+                });
+            };
+            socket.onmessage = event => {
+                messageQueue = messageQueue.then(async () => {
+                    const frame = decodeControl(event.data);
+                    this.lastActiveAt = Date.now();
+                    if (frame.type === 'hello.ack') {
+                        const payload = requireHelloAck(frame.payload);
+                        acknowledged = true;
+                        clearTimeout(helloTimer);
+                        this.online = true;
+                        this.terminalError = undefined;
+                        this.logger.info('server control connection online', {
+                            serverVersion: payload.serverVersion,
+                            connectionSessionId: shortId(payload.connectionSessionId),
+                        });
+                        return;
+                    }
+                    if (!acknowledged)
+                        throw new ControlConnectionError('INVALID_MESSAGE', 'Server sent a frame before hello.ack.');
+                    await this.handleFrame(frame);
+                }).catch(error => {
+                    const code = errorCode(error);
+                    this.terminalError = code;
+                    this.logger.error('server control frame failed', {
+                        code,
+                        reason: diagnosticReason(error),
+                    });
+                    socket.close(4008, 'invalid control frame');
+                });
+            };
+            socket.onerror = () => {
+                if (!acknowledged)
+                    finish(new ControlConnectionError('CONNECTION_FAILED', 'Unable to open the Server WebSocket.'));
+            };
+            socket.onclose = event => {
+                const close = async () => {
+                    await messageQueue.catch(() => undefined);
+                    if (event.code === 4002) {
+                        try {
+                            await this.api.refreshCredentials();
+                        }
+                        catch (error) {
+                            finish(asError(error));
+                            return;
+                        }
+                    }
+                    if (event.code === 4004) {
+                        finish(new ControlConnectionError('DEVICE_REVOKED', 'The Server revoked this Host device.'));
+                        return;
+                    }
+                    if (acknowledged)
+                        this.terminalError = closeCode(event.code);
+                    finish(acknowledged ? undefined : new ControlConnectionError(closeCode(event.code), event.reason || 'Server control connection closed.'));
+                };
+                void close();
+            };
+        });
+    }
+    async handleFrame(frame) {
+        if (frame.type === 'ping') {
+            const nonce = objectValue(frame.payload, 'nonce');
+            if (typeof nonce !== 'string')
+                throw new ControlConnectionError('INVALID_MESSAGE', 'Control ping has no nonce.');
+            this.sendControl('pong', { nonce });
+            return;
+        }
+        if (frame.type === 'pong')
+            return;
+        if (frame.type === 'connect.incoming') {
+            await this.handleConnectIncoming(requireConnectIncoming(frame.payload));
+            return;
+        }
+        if (frame.type === 'secure.handshake') {
+            await this.handleHandshake(requireHandshake(frame.payload));
+            return;
+        }
+        if (frame.type === 'relay') {
+            await this.handleRelay(requireRelay(frame.payload));
+            return;
+        }
+        if (frame.type === 'signal.offer') {
+            await this.handleSignalOffer(requireSignal(frame.payload));
+            return;
+        }
+        if (frame.type === 'signal.ice') {
+            this.handleSignalIce(requireSignalIce(frame.payload));
+            return;
+        }
+        if (frame.type === 'transport.selected')
+            return;
+        if (frame.type === 'signal.answer')
+            return;
+        if (frame.type === 'error') {
+            const payload = requireControlError(frame.payload);
+            if (payload.code === 'DEVICE_REVOKED') {
+                this.terminalError = payload.code;
+                this.socket?.close(4004, 'device revoked');
+            }
+            else if (payload.connectionId !== undefined) {
+                await this.dropTunnel(payload.connectionId, payload.code);
+                this.logger.warn('server closed a remote connection', {
+                    code: payload.code,
+                    connectionId: shortId(payload.connectionId),
+                    retryable: payload.retryable,
+                });
+            }
+            else {
+                this.terminalError = payload.code;
+                this.logger.warn('server returned a control error', { code: payload.code, retryable: payload.retryable });
+            }
+            return;
+        }
+        throw new ControlConnectionError('INVALID_MESSAGE', `Unexpected Server control frame: ${frame.type}`);
+    }
+    async handleConnectIncoming(payload) {
+        let descriptor;
+        try {
+            descriptor = await this.api.deviceFor(payload.clientDeviceId);
+        }
+        catch (error) {
+            this.sendControl('connect.rejected', { connectionId: payload.connectionId });
+            this.logger.warn('connection rejected by account authorization', {
+                clientDeviceId: shortId(payload.clientDeviceId),
+                code: errorCode(error),
+            });
+            return;
+        }
+        if (descriptor.role !== 'client' || descriptor.deviceId !== payload.clientDeviceId
+            || descriptor.identityKey !== payload.clientIdentityKey) {
+            this.sendControl('connect.rejected', { connectionId: payload.connectionId });
+            this.logger.warn('connection rejected by peer identity validation', {
+                clientDeviceId: shortId(payload.clientDeviceId),
+            });
+            return;
+        }
+        const existing = this.identities.trustedPeer(descriptor.deviceId);
+        if (existing !== undefined && existing.publicKey !== descriptor.identityKey) {
+            this.sendControl('connect.rejected', { connectionId: payload.connectionId });
+            this.logger.warn('connection rejected by pinned peer identity', {
+                clientDeviceId: shortId(payload.clientDeviceId),
+            });
+            return;
+        }
+        const peer = existing !== undefined
+            && existing.membershipId === descriptor.membershipId
+            && existing.name === descriptor.name
+            && existing.platform === descriptor.platform
+            ? existing
+            : await this.identities.trustPeer({
+                deviceId: descriptor.deviceId,
+                name: descriptor.name,
+                platform: descriptor.platform,
+                publicKey: descriptor.identityKey,
+                membershipId: descriptor.membershipId,
+            });
+        const previous = this.tunnels.get(payload.connectionId);
+        previous?.noise.destroy();
+        const noise = new NoiseIkSession({
+            role: 'responder',
+            localPrivateKey: this.identity.privateKey,
+            localPublicKey: this.identity.publicKey,
+            remotePublicKey: peer.publicKey,
+            prologue: createNoisePrologue(payload.connectionId, this.identity.deviceId, peer.deviceId),
+        });
+        this.tunnels.set(payload.connectionId, {
+            connectionId: payload.connectionId,
+            membershipId: descriptor.membershipId,
+            peer,
+            noise,
+            transport: 'negotiating',
+        });
+        this.sendControl('connect.accepted', { connectionId: payload.connectionId });
+    }
+    async handleHandshake(payload) {
+        const tunnel = this.tunnels.get(payload.connectionId);
+        if (tunnel !== undefined
+            && tunnel.channel !== undefined
+            && payload.targetDeviceId === this.identity.deviceId
+            && payload.step === 1) {
+            // A queued Relay/WebRTC fallback can deliver the initiator's first
+            // handshake again after the authenticated channel is already ready.
+            // It belongs to this exact tunnel, so ignore it without taking the
+            // Host's shared control connection offline.
+            this.logger.warn('duplicate secure handshake ignored', {
+                connectionId: shortId(tunnel.connectionId),
+                peerDeviceId: shortId(tunnel.peer.deviceId),
+            });
+            return;
+        }
+        if (tunnel === undefined || payload.targetDeviceId !== this.identity.deviceId || payload.step !== 1) {
+            throw new ControlConnectionError('SECURE_CHANNEL_FAILED', 'Noise IK handshake is not valid for this connection.');
+        }
+        tunnel.noise.readHandshake(fromBase64Url(payload.data));
+        const reply = tunnel.noise.writeHandshake();
+        if (!tunnel.noise.complete)
+            throw new ControlConnectionError('SECURE_CHANNEL_FAILED', 'Noise IK handshake did not complete.');
+        const viaWebRtc = tunnel.rtc !== undefined && (tunnel.transport === 'p2p' || tunnel.transport === 'turn');
+        if (!viaWebRtc && tunnel.transport === 'negotiating')
+            tunnel.transport = 'relay';
+        const mode = viaWebRtc ? (tunnel.transport === 'turn' ? 'TURN' : 'P2P') : 'Relay';
+        const transmit = viaWebRtc
+            ? (ciphertext) => tunnel.rtc.send(ciphertext)
+            : (ciphertext) => this.sendRelay(tunnel, ciphertext);
+        const channel = new ServerNoiseChannel(tunnel, transmit, () => {
+            if (this.tunnels.get(tunnel.connectionId) === tunnel)
+                this.tunnels.delete(tunnel.connectionId);
+        }, mode);
+        tunnel.channel = channel;
+        await this.connections.accept(channel);
+        // Publish the responder handshake only after the channel is registered.
+        // The Client starts its first RPC as soon as step 2 arrives; sending the
+        // reply earlier lets WebRTC deliver that RPC while tunnel.channel is still
+        // undefined, which silently drops the request.
+        this.sendControl('secure.handshake', {
+            connectionId: tunnel.connectionId,
+            targetDeviceId: tunnel.peer.deviceId,
+            step: 2,
+            data: toBase64Url(reply),
+        });
+        this.logger.info('authenticated peer channel ready', {
+            connectionId: shortId(tunnel.connectionId),
+            peerDeviceId: shortId(tunnel.peer.deviceId),
+            transport: mode,
+        });
+    }
+    async handleRelay(payload) {
+        if (payload.targetDeviceId !== this.identity.deviceId) {
+            throw new ControlConnectionError('INVALID_MESSAGE', 'Relay frame target does not match this Host.');
+        }
+        const tunnel = this.tunnels.get(payload.connectionId);
+        if (tunnel?.channel === undefined) {
+            this.logger.warn('stale relay frame ignored', {
+                connectionId: shortId(payload.connectionId),
+            });
+            return;
+        }
+        try {
+            tunnel.channel.receive(payload.counter, fromBase64Url(payload.ciphertext));
+        }
+        catch (error) {
+            await tunnel.channel.close();
+            throw new ControlConnectionError('SECURE_CHANNEL_FAILED', asError(error).message);
+        }
+    }
+    async handleSignalOffer(payload) {
+        const tunnel = this.tunnels.get(payload.connectionId);
+        if (tunnel === undefined || payload.targetDeviceId !== this.identity.deviceId) {
+            this.logger.warn('stale webrtc offer ignored', { connectionId: shortId(payload.connectionId) });
+            return;
+        }
+        if (tunnel.channel !== undefined || tunnel.rtc !== undefined) {
+            // Late or duplicate offer after relay establishment / RTC start: ignore.
+            this.logger.warn('duplicate webrtc offer ignored', { connectionId: shortId(tunnel.connectionId) });
+            return;
+        }
+        if (this.config.forceRelay) {
+            // Device-level forced degradation (webrtc plan §11).
+            this.logger.warn('webrtc offer ignored: forceRelay is enabled', { connectionId: shortId(tunnel.connectionId) });
+            return;
+        }
+        if (this.rtcFactory === undefined && this.rtcFactoryProvider !== undefined) {
+            this.rtcFactory = await this.rtcFactoryProvider().catch(() => undefined);
+        }
+        if (this.rtcFactory === undefined) {
+            // No Node RTC backend on this Host (webrtc plan §6.2): drop the offer so
+            // the initiator times out and falls back to the Relay data plane.
+            this.logger.warn('webrtc offer ignored: no RTC backend available', { connectionId: shortId(tunnel.connectionId) });
+            return;
+        }
+        let iceServers = [];
+        try {
+            iceServers = await this.api.turnCredentials(tunnel.connectionId);
+        }
+        catch (error) {
+            this.logger.warn('TURN credentials unavailable; trying direct candidates', {
+                connectionId: shortId(tunnel.connectionId),
+                code: errorCode(error),
+            });
+        }
+        const rtc = new RtcDataChannelTransport({
+            role: 'responder',
+            factory: this.rtcFactory,
+            iceServers,
+            onSignal: signal => this.sendRtcSignal(tunnel, signal),
+            negotiateTimeoutMs: DEFAULT_WEBRTC_NEGOTIATE_TIMEOUT_MS,
+            label: `host<-${tunnel.peer.deviceId}`,
+        });
+        tunnel.rtc = rtc;
+        rtc.onMessage(data => tunnel.channel?.receive(undefined, data));
+        rtc.onClose(() => {
+            void this.handleRtcFailed(tunnel, rtc, new Error('WebRTC data channel closed.'));
+        });
+        void rtc.connect().then(() => {
+            this.handleRtcOpened(tunnel, rtc.selectedTransport() ?? 'p2p');
+        }).catch(error => {
+            void this.handleRtcFailed(tunnel, rtc, asError(error));
+        });
+        rtc.handleSignal({ type: 'offer', sdp: payload.sdp });
+    }
+    handleSignalIce(payload) {
+        const tunnel = this.tunnels.get(payload.connectionId);
+        if (tunnel === undefined || payload.targetDeviceId !== this.identity.deviceId)
+            return;
+        tunnel.rtc?.handleSignal({ type: 'ice', candidate: payload.candidate });
+    }
+    sendRtcSignal(tunnel, signal) {
+        if (signal.type === 'answer') {
+            this.sendControl('signal.answer', {
+                connectionId: tunnel.connectionId,
+                targetDeviceId: tunnel.peer.deviceId,
+                sdp: signal.sdp,
+            });
+        }
+        else if (signal.type === 'ice') {
+            this.sendControl('signal.ice', {
+                connectionId: tunnel.connectionId,
+                targetDeviceId: tunnel.peer.deviceId,
+                candidate: signal.candidate,
+            });
+        }
+    }
+    handleRtcOpened(tunnel, selected) {
+        if (this.tunnels.get(tunnel.connectionId) !== tunnel || tunnel.rtc === undefined)
+            return;
+        tunnel.transport = selected;
+        this.sendTransportSelected(tunnel, selected);
+        this.logger.info('webrtc data channel ready', {
+            connectionId: shortId(tunnel.connectionId),
+            peerDeviceId: shortId(tunnel.peer.deviceId),
+            transport: selected,
+        });
+    }
+    async handleRtcFailed(tunnel, rtc, error) {
+        if (this.tunnels.get(tunnel.connectionId) !== tunnel || tunnel.rtc !== rtc)
+            return;
+        if (tunnel.channel !== undefined || tunnel.transport === 'p2p' || tunnel.transport === 'turn') {
+            this.logger.warn('webrtc data channel failed; disconnecting peer', {
+                connectionId: shortId(tunnel.connectionId),
+                reason: diagnosticReason(error),
+            });
+            await this.dropTunnel(tunnel.connectionId, 'CONNECTION_FAILED');
+            return;
+        }
+        tunnel.rtc = undefined;
+        tunnel.transport = 'relay';
+        await rtc.close();
+        this.logger.warn('webrtc negotiation failed; falling back to relay', {
+            connectionId: shortId(tunnel.connectionId),
+            reason: diagnosticReason(error),
+        });
+    }
+    sendTransportSelected(tunnel, transport) {
+        this.sendControl('transport.selected', {
+            connectionId: tunnel.connectionId,
+            targetDeviceId: tunnel.peer.deviceId,
+            transport,
+        });
+    }
+    async sendRelay(tunnel, ciphertext) {
+        const counter = Number(tunnel.noise.sendingCounter() - 1n);
+        if (!Number.isSafeInteger(counter) || counter < 0)
+            throw new ControlConnectionError('FRAME_TOO_LARGE', 'Noise transport counter overflowed.');
+        this.sendControl('relay', {
+            connectionId: tunnel.connectionId,
+            targetDeviceId: tunnel.peer.deviceId,
+            counter,
+            ciphertext: toBase64Url(ciphertext),
+        });
+    }
+    sendControl(type, payload) {
+        const socket = this.socket;
+        if (socket === undefined || socket.readyState !== 1)
+            throw new ControlConnectionError('CONNECTION_FAILED', 'Server control socket is not open.');
+        socket.send(JSON.stringify(createControlFrame(type, payload)));
+    }
+    async dropTunnels() {
+        const tunnels = [...this.tunnels.values()];
+        this.tunnels.clear();
+        await Promise.all(tunnels.map(async (tunnel) => {
+            if (tunnel.rtc !== undefined)
+                await tunnel.rtc.close();
+            if (tunnel.channel !== undefined)
+                await tunnel.channel.close();
+            else
+                tunnel.noise.destroy();
+        }));
+        await this.connections.close();
+    }
+    async dropTunnel(connectionId, code) {
+        const tunnel = this.tunnels.get(connectionId);
+        if (tunnel === undefined)
+            return;
+        this.tunnels.delete(connectionId);
+        try {
+            await tunnel.rtc?.close();
+        }
+        catch (error) {
+            this.logger.warn('remote connection RTC cleanup failed', {
+                connectionId: shortId(connectionId),
+                reason: diagnosticReason(error),
+            });
+        }
+        if (tunnel.channel !== undefined) {
+            try {
+                const closed = await this.connections.closeConnection(connectionId, code);
+                if (!closed)
+                    await tunnel.channel.close(code);
+            }
+            catch (error) {
+                await tunnel.channel.close(code).catch(() => undefined);
+                this.logger.warn('remote connection channel cleanup failed', {
+                    connectionId: shortId(connectionId),
+                    reason: diagnosticReason(error),
+                });
+            }
+        }
+        else {
+            tunnel.noise.destroy();
+        }
+    }
+    waitBeforeRetry(baseDelay) {
+        const spread = baseDelay * this.config.reconnect.jitter;
+        const delay = Math.max(0, Math.round(baseDelay - spread + Math.random() * spread * 2));
+        return new Promise(resolve => {
+            const timer = setTimeout(() => { this.retryWake = undefined; resolve(); }, delay);
+            this.retryWake = () => { clearTimeout(timer); resolve(); };
+        });
+    }
+}
+const TERMINAL_AUTH_ERRORS = new Set([
+    'ACCOUNT_AUTH_REQUIRED',
+    'AUTH_INVALID',
+    'DEVICE_OWNERSHIP_REQUIRED',
+    'DEVICE_REVOKED',
+    'TOKEN_EXPIRED',
+]);
+class ServerNoiseChannel {
+    tunnel;
+    transmit;
+    onClose;
+    security;
+    peerDeviceId;
+    peerIdentityKey;
+    mode;
+    handlers = new Set();
+    incoming = new SecureMessageCodec();
+    outgoing = new SecureMessageCodec();
+    closed = false;
+    constructor(tunnel, transmit, onClose, mode) {
+        this.tunnel = tunnel;
+        this.transmit = transmit;
+        this.onClose = onClose;
+        this.mode = mode;
+        this.security = {
+            protocol: 'Noise_IK_25519_ChaChaPoly_SHA256',
+            connectionId: tunnel.connectionId,
+            membershipId: tunnel.membershipId,
+        };
+        this.peerDeviceId = tunnel.peer.deviceId;
+        this.peerIdentityKey = tunnel.peer.publicKey;
+    }
+    async send(message) {
+        if (this.closed)
+            throw new Error('secure channel is closed');
+        for (const plaintext of this.outgoing.encode(encodeMessage(message))) {
+            await this.transmit(this.tunnel.noise.encrypt(plaintext));
+        }
+    }
+    onMessage(handler) {
+        this.handlers.add(handler);
+        return () => this.handlers.delete(handler);
+    }
+    receive(counter, ciphertext) {
+        if (this.closed)
+            return;
+        if (counter !== undefined) {
+            const expected = Number(this.tunnel.noise.receivingCounter());
+            if (!Number.isSafeInteger(counter) || counter !== expected) {
+                throw new ControlConnectionError('INVALID_MESSAGE', 'Relay counter is duplicated or out of order.');
+            }
+        }
+        const plaintext = this.incoming.decode(this.tunnel.noise.decrypt(ciphertext));
+        if (plaintext === undefined)
+            return;
+        const message = decodeMessage(plaintext);
+        for (const handler of this.handlers)
+            handler(message);
+    }
+    async close(_code) {
+        if (this.closed)
+            return;
+        this.closed = true;
+        this.handlers.clear();
+        this.incoming.reset();
+        this.outgoing.reset();
+        this.tunnel.noise.destroy();
+        this.onClose();
+    }
+}
+class ControlConnectionError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+function websocketUrl(baseUrl) {
+    const url = new URL(baseUrl);
+    url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';
+    url.pathname = `${url.pathname.replace(/\/$/, '')}/ws/v1/connect`;
+    return url.toString();
+}
+function decodeControl(data) {
+    if (typeof data !== 'string')
+        throw new ControlConnectionError('INVALID_MESSAGE', 'Server control frames must be text JSON.');
+    try {
+        return parseControlFrame(JSON.parse(data));
+    }
+    catch {
+        throw new ControlConnectionError('INVALID_MESSAGE', 'Server sent an invalid control frame.');
+    }
+}
+function requireHelloAck(value) {
+    const payload = requireObject(value);
+    if (payload.protocol !== PROTOCOL_VERSION || typeof payload.serverVersion !== 'string'
+        || typeof payload.connectionSessionId !== 'string' || !Number.isSafeInteger(payload.heartbeatIntervalMs)
+        || !Number.isSafeInteger(payload.maxControlFrameBytes) || !Number.isSafeInteger(payload.maxRelayFrameBytes)) {
+        throw new ControlConnectionError('INVALID_MESSAGE', 'hello.ack payload is invalid.');
+    }
+    return payload;
+}
+function requireConnectIncoming(value) {
+    const payload = requireObject(value);
+    if (typeof payload.connectionId !== 'string' || typeof payload.clientDeviceId !== 'string'
+        || typeof payload.clientIdentityKey !== 'string' || payload.authorization !== 'account'
+        || !Array.isArray(payload.preferredTransports)) {
+        throw new ControlConnectionError('INVALID_MESSAGE', 'connect.incoming payload is invalid.');
+    }
+    return payload;
+}
+function requireHandshake(value) {
+    const payload = requireObject(value);
+    if (typeof payload.connectionId !== 'string' || typeof payload.targetDeviceId !== 'string'
+        || !Number.isSafeInteger(payload.step) || typeof payload.data !== 'string') {
+        throw new ControlConnectionError('INVALID_MESSAGE', 'secure.handshake payload is invalid.');
+    }
+    return payload;
+}
+function requireRelay(value) {
+    const payload = requireObject(value);
+    if (typeof payload.connectionId !== 'string' || typeof payload.targetDeviceId !== 'string'
+        || !Number.isSafeInteger(payload.counter) || typeof payload.ciphertext !== 'string') {
+        throw new ControlConnectionError('INVALID_MESSAGE', 'relay payload is invalid.');
+    }
+    return payload;
+}
+function requireSignal(value) {
+    const payload = requireObject(value);
+    if (typeof payload.connectionId !== 'string' || typeof payload.targetDeviceId !== 'string'
+        || typeof payload.sdp !== 'string' || payload.sdp.length === 0) {
+        throw new ControlConnectionError('INVALID_MESSAGE', 'signal offer/answer payload is invalid.');
+    }
+    return payload;
+}
+function requireSignalIce(value) {
+    const payload = requireObject(value);
+    if (typeof payload.connectionId !== 'string' || typeof payload.targetDeviceId !== 'string'
+        || typeof payload.candidate !== 'object' || payload.candidate === null || Array.isArray(payload.candidate)) {
+        throw new ControlConnectionError('INVALID_MESSAGE', 'signal.ice payload is invalid.');
+    }
+    return payload;
+}
+function requireControlError(value) {
+    const payload = requireObject(value);
+    if (typeof payload.code !== 'string' || typeof payload.message !== 'string'
+        || (payload.connectionId !== undefined && (typeof payload.connectionId !== 'string' || payload.connectionId === ''))) {
+        throw new ControlConnectionError('INVALID_MESSAGE', 'error payload is invalid.');
+    }
+    return payload;
+}
+function requireObject(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new ControlConnectionError('INVALID_MESSAGE', 'Control payload must be an object.');
+    }
+    return value;
+}
+function objectValue(value, key) { return requireObject(value)[key]; }
+function shortId(value) { return value.length <= 12 ? value : `${value.slice(0, 8)}…${value.slice(-4)}`; }
+function asError(error) { return error instanceof Error ? error : new Error('Unknown Server connection error.'); }
+function diagnosticReason(error) {
+    const message = asError(error).message.replace(/[\r\n]+/g, ' ').slice(0, 160);
+    return message || 'Unknown Server connection error.';
+}
+function errorCode(error) { return error instanceof ServerApiError || error instanceof ControlConnectionError ? error.code : 'CONNECTION_FAILED'; }
+function isRetryable(error) { return error instanceof ServerApiError ? error.retryable : errorCode(error) !== 'DEVICE_REVOKED'; }
+function closeCode(code) {
+    if (code === 4002)
+        return 'AUTH_INVALID';
+    if (code === 4004)
+        return 'DEVICE_REVOKED';
+    if (code === 4007)
+        return 'RATE_LIMITED';
+    if (code === 4011)
+        return 'UNSUPPORTED_VERSION';
+    return 'CONNECTION_FAILED';
+}
+//# sourceMappingURL=server-connection.js.map