dynamodb-reactive 0.3.0 → 0.5.0

package/dist/cloudflare.js

@@ -0,0 +1,456 @@
+// ../client/src/cluster.ts
+var DEFAULT_TICKET_LIFETIME_SECONDS = 60;
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function parseClusterTicket(value) {
+  if (!isRecord(value) || typeof value.token !== "string" || value.token.length === 0 || typeof value.expiresAt !== "number" || !Number.isFinite(value.expiresAt) || typeof value.url !== "string") {
+    throw new Error("Cluster ticket response is invalid");
+  }
+  const url = new URL(value.url);
+  if (url.protocol !== "wss:") throw new Error("Cluster ticket URL must use WSS");
+  return { token: value.token, expiresAt: value.expiresAt, url: url.toString() };
+}
+var encoder = new TextEncoder();
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+}
+function base64UrlDecode(value) {
+  const padded = value.replaceAll("-", "+").replaceAll("_", "/");
+  const binary = atob(padded + "=".repeat((4 - padded.length % 4) % 4));
+  const bytes = new Uint8Array(new ArrayBuffer(binary.length));
+  for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+  return bytes;
+}
+function hmacKey(secret, usage) {
+  return crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    [usage]
+  );
+}
+async function createSignedClusterTicket(options) {
+  const expiresAt = Math.floor((options.now ?? Date.now()) / 1e3) + (options.lifetimeSeconds ?? DEFAULT_TICKET_LIFETIME_SECONDS);
+  const payload = base64UrlEncode(
+    encoder.encode(JSON.stringify({ p: options.principal, exp: expiresAt }))
+  );
+  const signature = new Uint8Array(
+    await crypto.subtle.sign(
+      "HMAC",
+      await hmacKey(options.secret, "sign"),
+      encoder.encode(payload)
+    )
+  );
+  return parseClusterTicket({
+    token: `${payload}.${base64UrlEncode(signature)}`,
+    expiresAt,
+    url: options.url
+  });
+}
+async function verifySignedClusterTicket(token, secret, now = Date.now()) {
+  const parts = token.split(".");
+  if (parts.length !== 2) return void 0;
+  const [payload, signature] = parts;
+  if (!payload || !signature) return void 0;
+  try {
+    const valid = await crypto.subtle.verify(
+      "HMAC",
+      await hmacKey(secret, "verify"),
+      base64UrlDecode(signature),
+      encoder.encode(payload)
+    );
+    if (!valid) return void 0;
+    const claims = JSON.parse(new TextDecoder().decode(base64UrlDecode(payload)));
+    if (!isRecord(claims) || typeof claims.p !== "string" || typeof claims.exp !== "number" || claims.exp <= Math.floor(now / 1e3)) {
+      return void 0;
+    }
+    return claims.p;
+  } catch {
+    return void 0;
+  }
+}
+
+// ../client/src/hub.ts
+var DEFAULT_MAX_ATTACHMENT_BYTES = 2048;
+var ReactiveHubError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ReactiveHubError";
+  }
+};
+function isRecord2(value) {
+  return typeof value === "object" && value !== null;
+}
+function isHubRequest(value) {
+  if (!isRecord2(value)) return false;
+  return (value.type === "subscribe" || value.type === "unsubscribe") && typeof value.connectionId === "string" && typeof value.subscriptionId === "string" && typeof value.generation === "number" && (value.type === "unsubscribe" || typeof value.path === "string");
+}
+function bearerToken(request) {
+  const match = /^Bearer ([^\s]+)$/u.exec(request.headers.get("authorization") ?? "");
+  return match?.[1] ?? "";
+}
+function createHubSocketState(connectionId, principal, connectedAt) {
+  return {
+    connectionId,
+    principal,
+    subscriptions: [],
+    ...connectedAt === void 0 ? {} : { connectedAt }
+  };
+}
+function socketState(socket) {
+  const state = socket.deserializeAttachment();
+  return { ...state, subscriptions: state.subscriptions.filter((entry) => entry.path) };
+}
+function send(socket, event) {
+  try {
+    socket.send(JSON.stringify(event));
+  } catch {
+  }
+}
+function createReactiveHub(options) {
+  const { sockets, versions } = options;
+  const maxAttachmentBytes = options.maxAttachmentBytes ?? DEFAULT_MAX_ATTACHMENT_BYTES;
+  const resolve = (path) => typeof options.paths === "function" ? options.paths(path) : Object.hasOwn(options.paths, path) ? options.paths[path] : void 0;
+  const ownedSocket = (connectionId, principal) => {
+    const socket = sockets.byConnectionId(connectionId);
+    return socket && socketState(socket).principal === principal ? socket : void 0;
+  };
+  const subscribersOf = (path) => sockets.all().flatMap(
+    (socket) => socketState(socket).subscriptions.filter((subscription) => subscription.path === path).map((subscription) => ({ socket, subscription }))
+  );
+  const bump = async (path) => {
+    const fromVersion = await versions.get(path);
+    const toVersion = fromVersion + 1;
+    await versions.set(path, toVersion);
+    return { fromVersion, toVersion };
+  };
+  return {
+    /** Answers the client's `init` and `ping` frames. */
+    message(socket, raw) {
+      let frame;
+      try {
+        frame = JSON.parse(raw);
+      } catch {
+        return;
+      }
+      const type = isRecord2(frame) ? frame.type : void 0;
+      if (type === "init") {
+        send(socket, { type: "connected", connectionId: socketState(socket).connectionId });
+      } else if (type === "ping") {
+        send(socket, { type: "pong" });
+      }
+    },
+    async subscribe(request, principal) {
+      const handler = resolve(request.path);
+      if (!handler) throw new ReactiveHubError("Unknown subscription path");
+      if (!ownedSocket(request.connectionId, principal)) {
+        throw new ReactiveHubError("Unknown connection");
+      }
+      const context = { path: request.path, principal, input: request.input };
+      if (handler.authorize && !await handler.authorize(context)) {
+        throw new ReactiveHubError("Subscription not allowed");
+      }
+      const socket = ownedSocket(request.connectionId, principal);
+      if (!socket) throw new ReactiveHubError("Unknown connection");
+      const state = socketState(socket);
+      const next = {
+        ...state,
+        subscriptions: [
+          ...state.subscriptions.filter((entry) => entry.subscriptionId !== request.subscriptionId),
+          {
+            subscriptionId: request.subscriptionId,
+            generation: request.generation,
+            path: request.path
+          }
+        ]
+      };
+      if (new TextEncoder().encode(JSON.stringify(next)).length > maxAttachmentBytes) {
+        throw new ReactiveHubError("Too many subscriptions on this connection");
+      }
+      socket.serializeAttachment(next);
+      const version = await versions.get(request.path);
+      const data = await handler.snapshot(context);
+      return {
+        type: "snapshot",
+        subscriptionId: request.subscriptionId,
+        generation: request.generation,
+        version,
+        data
+      };
+    },
+    unsubscribe(request, principal) {
+      const socket = ownedSocket(request.connectionId, principal);
+      if (!socket) return;
+      const state = socketState(socket);
+      socket.serializeAttachment({
+        ...state,
+        subscriptions: state.subscriptions.filter(
+          (entry) => entry.subscriptionId !== request.subscriptionId
+        )
+      });
+    },
+    /** Bumps the path's version and asks each of its subscribers to re-fetch. */
+    async notify(path) {
+      const { fromVersion, toVersion } = await bump(path);
+      for (const { socket, subscription } of subscribersOf(path)) {
+        send(socket, {
+          type: "resync",
+          subscriptionId: subscription.subscriptionId,
+          generation: subscription.generation,
+          fromVersion,
+          toVersion,
+          messageId: crypto.randomUUID()
+        });
+      }
+    },
+    /**
+     * Bumps the path's version and sends the same JSON patches to each subscriber.
+     * Use it only when every subscriber of the path sees the same data.
+     */
+    async publish(path, patches) {
+      const { fromVersion, toVersion } = await bump(path);
+      for (const { socket, subscription } of subscribersOf(path)) {
+        send(socket, {
+          type: "patch",
+          subscriptionId: subscription.subscriptionId,
+          generation: subscription.generation,
+          fromVersion,
+          toVersion,
+          messageId: crypto.randomUUID(),
+          patches
+        });
+      }
+    }
+  };
+}
+
+// ../client/src/cloudflare.ts
+var HUB_PRINCIPAL_HEADER = "x-reactive-principal";
+var HUB_ACTION_URL = "https://reactive-hub/";
+var PRESENCE_TAG_PREFIX = "presence:";
+var PRESENCE_KEY_PREFIX = "presence:";
+var DEFAULT_PRESENCE_TIMEOUT_MS = 9e4;
+var HEARTBEAT_TIMEOUT_CLOSE_CODE = 4001;
+function json(value, status = 200) {
+  return Response.json(value, { status, headers: { "cache-control": "no-store" } });
+}
+function error(message, status) {
+  return json({ type: "error", message }, status);
+}
+function workersGlobal(name) {
+  return globalThis[name];
+}
+function createDurableObjectHub(ctx, options) {
+  const versionKey = options.versionKey ?? ((path) => `version:${path}`);
+  const randomId = options.randomId ?? (() => crypto.randomUUID());
+  const hub = createReactiveHub({
+    sockets: {
+      all: () => ctx.getWebSockets(),
+      // Tagging by connection id lets HTTP subscribes find the socket after hibernation.
+      byConnectionId: (connectionId) => ctx.getWebSockets(connectionId)[0]
+    },
+    versions: {
+      get: async (path) => await ctx.storage.get(versionKey(path)) ?? 0,
+      set: (path, version) => ctx.storage.put(versionKey(path), version)
+    },
+    paths: options.paths,
+    ...options.maxAttachmentBytes === void 0 ? {} : { maxAttachmentBytes: options.maxAttachmentBytes }
+  });
+  if (options.autoPong !== false) {
+    const Pair = workersGlobal("WebSocketRequestResponsePair");
+    if (Pair && ctx.setWebSocketAutoResponse) {
+      ctx.setWebSocketAutoResponse(
+        new Pair(JSON.stringify({ type: "ping" }), JSON.stringify({ type: "pong" }))
+      );
+    }
+  }
+  const tracked = new Set(options.presence?.principals ?? []);
+  const timeoutMs = options.presence?.timeoutMs ?? DEFAULT_PRESENCE_TIMEOUT_MS;
+  const lastSeen = (socket) => Math.max(
+    ctx.getWebSocketAutoResponseTimestamp?.(socket)?.getTime() ?? 0,
+    socket.deserializeAttachment().connectedAt ?? 0
+  );
+  const liveSockets = (principal, closing) => {
+    const now = Date.now();
+    return ctx.getWebSockets(PRESENCE_TAG_PREFIX + principal).filter((socket) => socket !== closing && now - lastSeen(socket) <= timeoutMs);
+  };
+  const reconcile = async (principal, closing) => {
+    const present = liveSockets(principal, closing).length > 0;
+    const key = PRESENCE_KEY_PREFIX + principal;
+    if ((await ctx.storage.get(key) ?? false) === present) return;
+    await ctx.storage.put(key, present);
+    await options.presence?.onChange?.(principal, present);
+  };
+  const scheduleSweep = async () => {
+    const { storage } = ctx;
+    if (!storage.getAlarm || !storage.setAlarm) {
+      throw new Error("Hub presence needs Durable Object alarms");
+    }
+    const seen = [...tracked].flatMap(
+      (principal) => ctx.getWebSockets(PRESENCE_TAG_PREFIX + principal).map((socket) => lastSeen(socket))
+    );
+    if (seen.length === 0) return;
+    const due = Math.min(...seen) + timeoutMs + 1;
+    const current = await storage.getAlarm();
+    if (current === null || current > due) await storage.setAlarm(due);
+  };
+  const closed = async (socket) => {
+    if (tracked.size === 0) return;
+    const { principal } = socket.deserializeAttachment();
+    if (tracked.has(principal)) await reconcile(principal, socket);
+  };
+  const accept = async (request) => {
+    const principal = request.headers.get(HUB_PRINCIPAL_HEADER);
+    if (!principal) return error("Unauthorized", 401);
+    const Pair = options.WebSocketPair ?? workersGlobal("WebSocketPair");
+    if (!Pair) throw new Error("WebSocketPair is not available in this runtime");
+    const pair = new Pair();
+    const connectionId = randomId();
+    const isTracked = tracked.has(principal);
+    ctx.acceptWebSocket(
+      pair[1],
+      isTracked ? [connectionId, PRESENCE_TAG_PREFIX + principal] : [connectionId]
+    );
+    pair[1].serializeAttachment(
+      createHubSocketState(connectionId, principal, isTracked ? Date.now() : void 0)
+    );
+    if (isTracked) {
+      await reconcile(principal);
+      await scheduleSweep();
+    }
+    return new Response(null, { status: 101, webSocket: pair[0] });
+  };
+  const act = async (action) => {
+    try {
+      switch (action.action) {
+        case "subscribe":
+          return json(await hub.subscribe(action.body, action.principal));
+        case "unsubscribe":
+          hub.unsubscribe(action.body, action.principal);
+          return json({ type: "ok" });
+        case "notify":
+          await hub.notify(action.path);
+          return json({ type: "ok" });
+        case "publish":
+          await hub.publish(action.path, action.patches);
+          return json({ type: "ok" });
+        default:
+          return error("Unknown hub action", 400);
+      }
+    } catch (cause) {
+      if (cause instanceof ReactiveHubError) return error(cause.message, 400);
+      throw cause;
+    }
+  };
+  return {
+    hub,
+    /** The Durable Object's `fetch`: WebSocket upgrades and actions from `hubClient`. */
+    async fetch(request) {
+      if (request.headers.get("upgrade") === "websocket") return accept(request);
+      return act(await request.json());
+    },
+    webSocketMessage(socket, message) {
+      if (typeof message === "string") hub.message(socket, message);
+    },
+    async webSocketClose(socket, code) {
+      try {
+        socket.close(code === 1005 ? 1e3 : code, "closed");
+      } catch {
+      }
+      await closed(socket);
+    },
+    async webSocketError(socket) {
+      try {
+        socket.close(1011, "error");
+      } catch {
+      }
+      await closed(socket);
+    },
+    /** Whether `principal` holds a socket that has pinged within the presence timeout. */
+    present(principal) {
+      return liveSockets(principal).length > 0;
+    },
+    /**
+     * The Durable Object's `alarm` when presence is tracked: closes silent
+     * sockets, reports principals that lost their last one, and reschedules.
+     */
+    async alarm() {
+      const now = Date.now();
+      for (const principal of tracked) {
+        for (const socket of ctx.getWebSockets(PRESENCE_TAG_PREFIX + principal)) {
+          if (now - lastSeen(socket) <= timeoutMs) continue;
+          try {
+            socket.close(HEARTBEAT_TIMEOUT_CLOSE_CODE, "Heartbeat timeout");
+          } catch {
+          }
+        }
+        await reconcile(principal);
+      }
+      await scheduleSweep();
+    }
+  };
+}
+function hubClient(stub) {
+  const post = (action) => stub.fetch(new Request(HUB_ACTION_URL, { method: "POST", body: JSON.stringify(action) }));
+  const ok = async (response) => {
+    if (!response.ok) throw new Error(`Hub request failed: HTTP ${response.status}`);
+  };
+  return {
+    /** Forwards a reactive HTTP request and returns the hub's response unchanged. */
+    request: (body, principal) => post(
+      body.type === "subscribe" ? { action: "subscribe", principal, body } : { action: "unsubscribe", principal, body }
+    ),
+    notify: async (path) => ok(await post({ action: "notify", path })),
+    publish: async (path, patches) => ok(await post({ action: "publish", path, patches }))
+  };
+}
+async function handleReactiveRoutes(request, options) {
+  const url = new URL(request.url);
+  const { routes, secret } = options;
+  if (![routes.ticket, routes.socket, routes.reactive].includes(url.pathname)) return void 0;
+  if (!secret) return error("Reactive hub is not configured", 503);
+  if (url.pathname === routes.ticket) {
+    if (request.method !== "POST") return error("Method not allowed", 405);
+    const principal2 = await options.authenticate(request);
+    if (!principal2) return error("Unauthorized", 401);
+    const socketUrl = new URL(routes.socket, url);
+    socketUrl.protocol = "wss:";
+    return json(
+      await createSignedClusterTicket({
+        secret,
+        principal: principal2,
+        url: socketUrl.toString(),
+        ...options.ticketLifetimeSeconds === void 0 ? {} : { lifetimeSeconds: options.ticketLifetimeSeconds }
+      })
+    );
+  }
+  if (url.pathname === routes.socket) {
+    if (request.headers.get("upgrade") !== "websocket") {
+      return error("Expected a WebSocket upgrade", 426);
+    }
+    const principal2 = await verifySignedClusterTicket(url.searchParams.get("token") ?? "", secret);
+    if (!principal2) return new Response("Unauthorized", { status: 401 });
+    const forwarded = new Request(request);
+    forwarded.headers.set(HUB_PRINCIPAL_HEADER, principal2);
+    return options.hub().fetch(forwarded);
+  }
+  if (request.method !== "POST") return error("Method not allowed", 405);
+  const principal = await verifySignedClusterTicket(bearerToken(request), secret);
+  if (!principal) return error("Unauthorized", 401);
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return error("Invalid JSON", 400);
+  }
+  if (!isHubRequest(body)) return error("Unsupported reactive request", 400);
+  return hubClient(options.hub()).request(body, principal);
+}
+
+export { HUB_PRINCIPAL_HEADER, createDurableObjectHub, handleReactiveRoutes, hubClient };
+//# sourceMappingURL=cloudflare.js.map
+//# sourceMappingURL=cloudflare.js.map

package/dist/cloudflare.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../client/src/cluster.ts","../../client/src/hub.ts","../../client/src/cloudflare.ts"],"names":["isRecord","principal"],"mappings":";AAeA,IAAM,+BAAA,GAAkC,EAAA;AAcxC,SAAS,SAAS,KAAA,EAAkD;AAClE,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,IAAA;AAChD;AAGO,SAAS,mBAAmB,KAAA,EAA+B;AAChE,EAAA,IACE,CAAC,QAAA,CAAS,KAAK,CAAA,IACf,OAAO,MAAM,KAAA,KAAU,QAAA,IACvB,KAAA,CAAM,KAAA,CAAM,MAAA,KAAW,CAAA,IACvB,OAAO,KAAA,CAAM,SAAA,KAAc,QAAA,IAC3B,CAAC,MAAA,CAAO,QAAA,CAAS,KAAA,CAAM,SAAS,CAAA,IAChC,OAAO,KAAA,CAAM,GAAA,KAAQ,QAAA,EACrB;AACA,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAAA,EACtD;AACA,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,IAAI,QAAA,KAAa,MAAA,EAAQ,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAC9E,EAAA,OAAO,EAAE,KAAA,EAAO,KAAA,CAAM,KAAA,EAAO,SAAA,EAAW,MAAM,SAAA,EAAW,GAAA,EAAK,GAAA,CAAI,QAAA,EAAS,EAAE;AAC/E;AAgHA,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAEhC,SAAS,gBAAgB,KAAA,EAA2B;AAClD,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAC5D,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,UAAA,CAAW,GAAA,EAAK,GAAG,CAAA,CAAE,UAAA,CAAW,GAAA,EAAK,GAAG,CAAA,CAAE,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClF;AAEA,SAAS,gBAAgB,KAAA,EAAwC;AAC/D,EAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,GAAA,EAAK,GAAG,CAAA,CAAE,UAAA,CAAW,KAAK,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,GAAS,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,MAAA,CAAO,MAAA,GAAS,CAAA,IAAM,CAAC,CAAC,CAAA;AACtE,EAAA,MAAM,QAAQ,IAAI,UAAA,CAAW,IAAI,WAAA,CAAY,MAAA,CAAO,MAAM,CAAC,CAAA;AAC3D,EAAA,KAAA,IAAS,KAAA,GAAQ,CAAA,EAAG,KAAA,GAAQ,MAAA,CAAO,MAAA,EAAQ,KAAA,IAAS,CAAA,EAAG,KAAA,CAAM,KAAK,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,KAAK,CAAA;AAC7F,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,OAAA,CAAQ,QAAgB,KAAA,EAA8C;AAC7E,EAAA,OAAO,OAAO,MAAA,CAAO,SAAA;AAAA,IACnB,KAAA;AAAA,IACA,OAAA,CAAQ,OAAO,MAAM,CAAA;AAAA,IACrB,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,KAAA;AAAA,IACA,CAAC,KAAK;AAAA,GACR;AACF;AAmBA,eAAsB,0BACpB,OAAA,EACwB;AACxB,EAAA,MAAM,SAAA,GACJ,IAAA,CAAK,KAAA,CAAA,CAAO,OAAA,CAAQ,GAAA,IAAO,IAAA,CAAK,GAAA,EAAI,IAAK,GAAI,CAAA,IAC5C,OAAA,CAAQ,eAAA,IAAmB,+BAAA,CAAA;AAC9B,EAAA,MAAM,OAAA,GAAU,eAAA;AAAA,IACd,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,SAAA,CAAU,EAAE,CAAA,EAAG,OAAA,CAAQ,SAAA,EAAW,GAAA,EAAK,SAAA,EAAW,CAAC;AAAA,GACzE;AACA,EAAA,MAAM,YAAY,IAAI,UAAA;AAAA,IACpB,MAAM,OAAO,MAAA,CAAO,IAAA;AAAA,MAClB,MAAA;AAAA,MACA,MAAM,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAQ,MAAM,CAAA;AAAA,MACpC,OAAA,CAAQ,OAAO,OAAO;AAAA;AACxB,GACF;AACA,EAAA,OAAO,kBAAA,CAAmB;AAAA,IACxB,OAAO,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,eAAA,CAAgB,SAAS,CAAC,CAAA,CAAA;AAAA,IAC/C,SAAA;AAAA,IACA,KAAK,OAAA,CAAQ;AAAA,GACd,CAAA;AACH;AAGA,eAAsB,0BACpB,KAAA,EACA,MAAA,EACA,GAAA,GAAM,IAAA,CAAK,KAAI,EACc;AAC7B,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAC/B,EAAA,MAAM,CAAC,OAAA,EAAS,SAAS,CAAA,GAAI,KAAA;AAC7B,EAAA,IAAI,CAAC,OAAA,IAAW,CAAC,SAAA,EAAW,OAAO,MAAA;AACnC,EAAA,IAAI;AAEF,IAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA;AAAA,MAChC,MAAA;AAAA,MACA,MAAM,OAAA,CAAQ,MAAA,EAAQ,QAAQ,CAAA;AAAA,MAC9B,gBAAgB,SAAS,CAAA;AAAA,MACzB,OAAA,CAAQ,OAAO,OAAO;AAAA,KACxB;AACA,IAAA,IAAI,CAAC,OAAO,OAAO,KAAA,CAAA;AACnB,IAAA,MAAM,MAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,IAAI,WAAA,GAAc,MAAA,CAAO,eAAA,CAAgB,OAAO,CAAC,CAAC,CAAA;AACrF,IAAA,IACE,CAAC,QAAA,CAAS,MAAM,KAChB,OAAO,MAAA,CAAO,MAAM,QAAA,IACpB,OAAO,MAAA,CAAO,GAAA,KAAQ,YACtB,MAAA,CAAO,GAAA,IAAO,KAAK,KAAA,CAAM,GAAA,GAAM,GAAI,CAAA,EACnC;AACA,MAAA,OAAO,KAAA,CAAA;AAAA,IACT;AACA,IAAA,OAAO,MAAA,CAAO,CAAA;AAAA,EAChB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;;;ACjPO,IAAM,4BAAA,GAA+B,IAAA;AAgErC,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EAC1C,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AAAA,EACd;AACF,CAAA;AAEA,SAASA,UAAS,KAAA,EAAkD;AAClE,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,IAAA;AAChD;AAGO,SAAS,aAAa,KAAA,EAAgE;AAC3F,EAAA,IAAI,CAACA,SAAAA,CAAS,KAAK,CAAA,EAAG,OAAO,KAAA;AAC7B,EAAA,OAAA,CACG,KAAA,CAAM,SAAS,WAAA,IAAe,KAAA,CAAM,SAAS,aAAA,KAC9C,OAAO,KAAA,CAAM,YAAA,KAAiB,QAAA,IAC9B,OAAO,MAAM,cAAA,KAAmB,QAAA,IAChC,OAAO,KAAA,CAAM,UAAA,KAAe,QAAA,KAC3B,MAAM,IAAA,KAAS,aAAA,IAAiB,OAAO,KAAA,CAAM,IAAA,KAAS,QAAA,CAAA;AAE3D;AAGO,SAAS,YAAY,OAAA,EAA0B;AACpD,EAAA,MAAM,KAAA,GAAQ,qBAAqB,IAAA,CAAK,OAAA,CAAQ,QAAQ,GAAA,CAAI,eAAe,KAAK,EAAE,CAAA;AAClF,EAAA,OAAO,KAAA,GAAQ,CAAC,CAAA,IAAK,EAAA;AACvB;AAGO,SAAS,oBAAA,CACd,YAAA,EACA,SAAA,EACA,WAAA,EACgB;AAChB,EAAA,OAAO;AAAA,IACL,YAAA;AAAA,IACA,SAAA;AAAA,IACA,eAAe,EAAC;AAAA,IAChB,GAAI,WAAA,KAAgB,MAAA,GAAY,EAAC,GAAI,EAAE,WAAA;AAAY,GACrD;AACF;AAEA,SAAS,YAAY,MAAA,EAAmC;AACtD,EAAA,MAAM,KAAA,GAAQ,OAAO,qBAAA,EAAsB;AAG3C,EAAA,OAAO,EAAE,GAAG,KAAA,EAAO,aAAA,EAAe,KAAA,CAAM,aAAA,CAAc,MAAA,CAAO,CAAC,KAAA,KAAU,KAAA,CAAM,IAAI,CAAA,EAAE;AACtF;AAEA,SAAS,IAAA,CAAK,QAAmB,KAAA,EAA6B;AAC5D,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAGO,SAAS,kBAAkB,OAAA,EAA6B;AAC7D,EAAA,MAAM,EAAE,OAAA,EAAS,QAAA,EAAS,GAAI,OAAA;AAC9B,EAAA,MAAM,kBAAA,GAAqB,QAAQ,kBAAA,IAAsB,4BAAA;AACzD,EAAA,MAAM,OAAA,GAAU,CAAC,IAAA,KACf,OAAO,QAAQ,KAAA,KAAU,UAAA,GACrB,QAAQ,KAAA,CAAM,IAAI,IAClB,MAAA,CAAO,MAAA,CAAO,QAAQ,KAAA,EAAO,IAAI,IAC/B,OAAA,CAAQ,KAAA,CAAM,IAAI,CAAA,GAClB,MAAA;AAER,EAAA,MAAM,WAAA,GAAc,CAAC,YAAA,EAAsB,SAAA,KAA6C;AACtF,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,cAAA,CAAe,YAAY,CAAA;AAElD,IAAA,OAAO,UAAU,WAAA,CAAY,MAAM,CAAA,CAAE,SAAA,KAAc,YAAY,MAAA,GAAS,MAAA;AAAA,EAC1E,CAAA;AAEA,EAAA,MAAM,aAAA,GAAgB,CAAC,IAAA,KACrB,OAAA,CAAQ,KAAI,CAAE,OAAA;AAAA,IAAQ,CAAC,MAAA,KACrB,WAAA,CAAY,MAAM,CAAA,CACf,aAAA,CAAc,OAAO,CAAC,YAAA,KAAiB,aAAa,IAAA,KAAS,IAAI,EACjE,GAAA,CAAI,CAAC,kBAAkB,EAAE,MAAA,EAAQ,cAAa,CAAE;AAAA,GACrD;AAEF,EAAA,MAAM,IAAA,GAAO,OAAO,IAAA,KAAiB;AACnC,IAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,GAAA,CAAI,IAAI,CAAA;AAC3C,IAAA,MAAM,YAAY,WAAA,GAAc,CAAA;AAChC,IAAA,MAAM,QAAA,CAAS,GAAA,CAAI,IAAA,EAAM,SAAS,CAAA;AAClC,IAAA,OAAO,EAAE,aAAa,SAAA,EAAU;AAAA,EAClC,CAAA;AAEA,EAAA,OAAO;AAAA;AAAA,IAEL,OAAA,CAAQ,QAAmB,GAAA,EAAmB;AAC5C,MAAA,IAAI,KAAA;AACJ,MAAA,IAAI;AACF,QAAA,KAAA,GAAQ,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,MACxB,CAAA,CAAA,MAAQ;AACN,QAAA;AAAA,MACF;AACA,MAAA,MAAM,IAAA,GAAOA,SAAAA,CAAS,KAAK,CAAA,GAAI,MAAM,IAAA,GAAO,MAAA;AAC5C,MAAA,IAAI,SAAS,MAAA,EAAQ;AACnB,QAAA,IAAA,CAAK,MAAA,EAAQ,EAAE,IAAA,EAAM,WAAA,EAAa,cAAc,WAAA,CAAY,MAAM,CAAA,CAAE,YAAA,EAAc,CAAA;AAAA,MACpF,CAAA,MAAA,IAAW,SAAS,MAAA,EAAQ;AAC1B,QAAA,IAAA,CAAK,MAAA,EAAQ,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA;AAAA,MAC/B;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,SAAA,CAAU,OAAA,EAA2B,SAAA,EAA8C;AACvF,MAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,IAAI,CAAA;AACpC,MAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,iBAAiB,2BAA2B,CAAA;AACpE,MAAA,IAAI,CAAC,WAAA,CAAY,OAAA,CAAQ,YAAA,EAAc,SAAS,CAAA,EAAG;AACjD,QAAA,MAAM,IAAI,iBAAiB,oBAAoB,CAAA;AAAA,MACjD;AACA,MAAA,MAAM,OAAA,GAA0B,EAAE,IAAA,EAAM,OAAA,CAAQ,MAAM,SAAA,EAAW,KAAA,EAAO,QAAQ,KAAA,EAAM;AACtF,MAAA,IAAI,QAAQ,SAAA,IAAa,CAAE,MAAM,OAAA,CAAQ,SAAA,CAAU,OAAO,CAAA,EAAI;AAC5D,QAAA,MAAM,IAAI,iBAAiB,0BAA0B,CAAA;AAAA,MACvD;AAEA,MAAA,MAAM,MAAA,GAAS,WAAA,CAAY,OAAA,CAAQ,YAAA,EAAc,SAAS,CAAA;AAC1D,MAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,iBAAiB,oBAAoB,CAAA;AAC5D,MAAA,MAAM,KAAA,GAAQ,YAAY,MAAM,CAAA;AAChC,MAAA,MAAM,IAAA,GAAuB;AAAA,QAC3B,GAAG,KAAA;AAAA,QACH,aAAA,EAAe;AAAA,UACb,GAAG,MAAM,aAAA,CAAc,MAAA,CAAO,CAAC,KAAA,KAAU,KAAA,CAAM,cAAA,KAAmB,OAAA,CAAQ,cAAc,CAAA;AAAA,UACxF;AAAA,YACE,gBAAgB,OAAA,CAAQ,cAAA;AAAA,YACxB,YAAY,OAAA,CAAQ,UAAA;AAAA,YACpB,MAAM,OAAA,CAAQ;AAAA;AAChB;AACF,OACF;AACA,MAAA,IAAI,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAA,CAAK,UAAU,IAAI,CAAC,CAAA,CAAE,MAAA,GAAS,kBAAA,EAAoB;AAC9E,QAAA,MAAM,IAAI,iBAAiB,2CAA2C,CAAA;AAAA,MACxE;AACA,MAAA,MAAA,CAAO,oBAAoB,IAAI,CAAA;AAG/B,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,GAAA,CAAI,QAAQ,IAAI,CAAA;AAC/C,MAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,QAAA,CAAS,OAAO,CAAA;AAC3C,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,UAAA;AAAA,QACN,gBAAgB,OAAA,CAAQ,cAAA;AAAA,QACxB,YAAY,OAAA,CAAQ,UAAA;AAAA,QACpB,OAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF,CAAA;AAAA,IAEA,WAAA,CAAY,SAA6B,SAAA,EAAyB;AAChE,MAAA,MAAM,MAAA,GAAS,WAAA,CAAY,OAAA,CAAQ,YAAA,EAAc,SAAS,CAAA;AAC1D,MAAA,IAAI,CAAC,MAAA,EAAQ;AACb,MAAA,MAAM,KAAA,GAAQ,YAAY,MAAM,CAAA;AAChC,MAAA,MAAA,CAAO,mBAAA,CAAoB;AAAA,QACzB,GAAG,KAAA;AAAA,QACH,aAAA,EAAe,MAAM,aAAA,CAAc,MAAA;AAAA,UACjC,CAAC,KAAA,KAAU,KAAA,CAAM,cAAA,KAAmB,OAAA,CAAQ;AAAA;AAC9C,OACwB,CAAA;AAAA,IAC5B,CAAA;AAAA;AAAA,IAGA,MAAM,OAAO,IAAA,EAA6B;AACxC,MAAA,MAAM,EAAE,WAAA,EAAa,SAAA,EAAU,GAAI,MAAM,KAAK,IAAI,CAAA;AAClD,MAAA,KAAA,MAAW,EAAE,MAAA,EAAQ,YAAA,EAAa,IAAK,aAAA,CAAc,IAAI,CAAA,EAAG;AAC1D,QAAA,IAAA,CAAK,MAAA,EAAQ;AAAA,UACX,IAAA,EAAM,QAAA;AAAA,UACN,gBAAgB,YAAA,CAAa,cAAA;AAAA,UAC7B,YAAY,YAAA,CAAa,UAAA;AAAA,UACzB,WAAA;AAAA,UACA,SAAA;AAAA,UACA,SAAA,EAAW,OAAO,UAAA;AAAW,SAC9B,CAAA;AAAA,MACH;AAAA,IACF,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,OAAA,CAAQ,IAAA,EAAc,OAAA,EAAqC;AAC/D,MAAA,MAAM,EAAE,WAAA,EAAa,SAAA,EAAU,GAAI,MAAM,KAAK,IAAI,CAAA;AAClD,MAAA,KAAA,MAAW,EAAE,MAAA,EAAQ,YAAA,EAAa,IAAK,aAAA,CAAc,IAAI,CAAA,EAAG;AAC1D,QAAA,IAAA,CAAK,MAAA,EAAQ;AAAA,UACX,IAAA,EAAM,OAAA;AAAA,UACN,gBAAgB,YAAA,CAAa,cAAA;AAAA,UAC7B,YAAY,YAAA,CAAa,UAAA;AAAA,UACzB,WAAA;AAAA,UACA,SAAA;AAAA,UACA,SAAA,EAAW,OAAO,UAAA,EAAW;AAAA,UAC7B;AAAA,SACD,CAAA;AAAA,MACH;AAAA,IACF;AAAA,GACF;AACF;;;AC5PO,IAAM,oBAAA,GAAuB;AACpC,IAAM,cAAA,GAAiB,uBAAA;AACvB,IAAM,mBAAA,GAAsB,WAAA;AAC5B,IAAM,mBAAA,GAAsB,WAAA;AAC5B,IAAM,2BAAA,GAA8B,GAAA;AAE7B,IAAM,4BAAA,GAA+B,IAAA;AA8E5C,SAAS,IAAA,CAAK,KAAA,EAAgB,MAAA,GAAS,GAAA,EAAe;AACpD,EAAA,OAAO,QAAA,CAAS,IAAA,CAAK,KAAA,EAAO,EAAE,MAAA,EAAQ,SAAS,EAAE,eAAA,EAAiB,UAAA,EAAW,EAAG,CAAA;AAClF;AAEA,SAAS,KAAA,CAAM,SAAiB,MAAA,EAA0B;AACxD,EAAA,OAAO,KAAK,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,IAAW,MAAM,CAAA;AAChD;AAEA,SAAS,cAAiB,IAAA,EAA6B;AACrD,EAAA,OAAQ,WAAuC,IAAI,CAAA;AACrD;AAGO,SAAS,sBAAA,CACd,KACA,OAAA,EACA;AACA,EAAA,MAAM,aAAa,OAAA,CAAQ,UAAA,KAAe,CAAC,IAAA,KAAiB,WAAW,IAAI,CAAA,CAAA,CAAA;AAC3E,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,KAAa,MAAM,OAAO,UAAA,EAAW,CAAA;AAC9D,EAAA,MAAM,MAAM,iBAAA,CAAkB;AAAA,IAC5B,OAAA,EAAS;AAAA,MACP,GAAA,EAAK,MAAM,GAAA,CAAI,aAAA,EAAc;AAAA;AAAA,MAE7B,gBAAgB,CAAC,YAAA,KAAiB,IAAI,aAAA,CAAc,YAAY,EAAE,CAAC;AAAA,KACrE;AAAA,IACA,QAAA,EAAU;AAAA,MACR,GAAA,EAAK,OAAO,IAAA,KAAU,MAAM,GAAA,CAAI,QAAQ,GAAA,CAAY,UAAA,CAAW,IAAI,CAAC,CAAA,IAAM,CAAA;AAAA,MAC1E,GAAA,EAAK,CAAC,IAAA,EAAM,OAAA,KAAY,GAAA,CAAI,QAAQ,GAAA,CAAI,UAAA,CAAW,IAAI,CAAA,EAAG,OAAO;AAAA,KACnE;AAAA,IACA,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,GAAI,QAAQ,kBAAA,KAAuB,MAAA,GAC/B,EAAC,GACD,EAAE,kBAAA,EAAoB,OAAA,CAAQ,kBAAA;AAAmB,GACtD,CAAA;AAED,EAAA,IAAI,OAAA,CAAQ,aAAa,KAAA,EAAO;AAC9B,IAAA,MAAM,IAAA,GAAO,cAA8C,8BAA8B,CAAA;AACzF,IAAA,IAAI,IAAA,IAAQ,IAAI,wBAAA,EAA0B;AACxC,MAAA,GAAA,CAAI,wBAAA;AAAA,QACF,IAAI,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA,EAAG,KAAK,SAAA,CAAU,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAC;AAAA,OAC7E;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,UAAU,IAAI,GAAA,CAAI,QAAQ,QAAA,EAAU,UAAA,IAAc,EAAE,CAAA;AAC1D,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,QAAA,EAAU,SAAA,IAAa,2BAAA;AAIjD,EAAA,MAAM,QAAA,GAAW,CAAC,MAAA,KAChB,IAAA,CAAK,GAAA;AAAA,IACH,GAAA,CAAI,iCAAA,GAAoC,MAAM,CAAA,EAAG,SAAQ,IAAK,CAAA;AAAA,IAC7D,MAAA,CAAO,qBAAA,EAAsB,CAAqB,WAAA,IAAe;AAAA,GACpE;AAEF,EAAA,MAAM,WAAA,GAAc,CAAC,SAAA,EAAmB,OAAA,KAAqC;AAC3E,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,OAAO,GAAA,CACJ,aAAA,CAAc,mBAAA,GAAsB,SAAS,EAC7C,MAAA,CAAO,CAAC,MAAA,KAAW,MAAA,KAAW,OAAA,IAAW,GAAA,GAAM,QAAA,CAAS,MAAM,KAAK,SAAS,CAAA;AAAA,EACjF,CAAA;AAEA,EAAA,MAAM,SAAA,GAAY,OAAO,SAAA,EAAmB,OAAA,KAAqC;AAC/E,IAAA,MAAM,OAAA,GAAU,WAAA,CAAY,SAAA,EAAW,OAAO,EAAE,MAAA,GAAS,CAAA;AACzD,IAAA,MAAM,MAAM,mBAAA,GAAsB,SAAA;AAClC,IAAA,IAAA,CAAM,MAAM,GAAA,CAAI,OAAA,CAAQ,IAAa,GAAG,CAAA,IAAM,WAAW,OAAA,EAAS;AAClE,IAAA,MAAM,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAClC,IAAA,MAAM,OAAA,CAAQ,QAAA,EAAU,QAAA,GAAW,SAAA,EAAW,OAAO,CAAA;AAAA,EACvD,CAAA;AAGA,EAAA,MAAM,gBAAgB,YAAY;AAChC,IAAA,MAAM,EAAE,SAAQ,GAAI,GAAA;AACpB,IAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,IAAY,CAAC,QAAQ,QAAA,EAAU;AAC1C,MAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,IAC5D;AACA,IAAA,MAAM,IAAA,GAAO,CAAC,GAAG,OAAO,CAAA,CAAE,OAAA;AAAA,MAAQ,CAAC,SAAA,KACjC,GAAA,CAAI,aAAA,CAAc,mBAAA,GAAsB,SAAS,CAAA,CAAE,GAAA,CAAI,CAAC,MAAA,KAAW,QAAA,CAAS,MAAM,CAAC;AAAA,KACrF;AACA,IAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AACvB,IAAA,MAAM,MAAM,IAAA,CAAK,GAAA,CAAI,GAAG,IAAI,IAAI,SAAA,GAAY,CAAA;AAC5C,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,QAAA,EAAS;AACvC,IAAA,IAAI,YAAY,IAAA,IAAQ,OAAA,GAAU,KAAK,MAAM,OAAA,CAAQ,SAAS,GAAG,CAAA;AAAA,EACnE,CAAA;AAEA,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,KAAmC;AACvD,IAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACxB,IAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAA,CAAO,qBAAA,EAAsB;AACnD,IAAA,IAAI,QAAQ,GAAA,CAAI,SAAS,GAAG,MAAM,SAAA,CAAU,WAAW,MAAM,CAAA;AAAA,EAC/D,CAAA;AAEA,EAAA,MAAM,MAAA,GAAS,OAAO,OAAA,KAAwC;AAC5D,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,oBAAoB,CAAA;AAC1D,IAAA,IAAI,CAAC,SAAA,EAAW,OAAO,KAAA,CAAM,gBAAgB,GAAG,CAAA;AAChD,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,aAAA,IAAiB,aAAA,CAAwC,eAAe,CAAA;AAC7F,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAC3E,IAAA,MAAM,IAAA,GAAO,IAAI,IAAA,EAAK;AACtB,IAAA,MAAM,eAAe,QAAA,EAAS;AAC9B,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA;AACvC,IAAA,GAAA,CAAI,eAAA;AAAA,MACF,KAAK,CAAC,CAAA;AAAA,MACN,YAAY,CAAC,YAAA,EAAc,sBAAsB,SAAS,CAAA,GAAI,CAAC,YAAY;AAAA,KAC7E;AACA,IAAA,IAAA,CAAK,CAAC,CAAA,CAAE,mBAAA;AAAA,MACN,qBAAqB,YAAA,EAAc,SAAA,EAAW,YAAY,IAAA,CAAK,GAAA,KAAQ,MAAS;AAAA,KAClF;AACA,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,MAAM,UAAU,SAAS,CAAA;AACzB,MAAA,MAAM,aAAA,EAAc;AAAA,IACtB;AACA,IAAA,OAAO,IAAI,QAAA,CAAS,IAAA,EAAM,EAAE,MAAA,EAAQ,KAAK,SAAA,EAAW,IAAA,CAAK,CAAC,CAAA,EAAmB,CAAA;AAAA,EAC/E,CAAA;AAEA,EAAA,MAAM,GAAA,GAAM,OAAO,MAAA,KAAyC;AAC1D,IAAA,IAAI;AACF,MAAA,QAAQ,OAAO,MAAA;AAAQ,QACrB,KAAK,WAAA;AACH,UAAA,OAAO,IAAA,CAAK,MAAM,GAAA,CAAI,SAAA,CAAU,OAAO,IAAA,EAAM,MAAA,CAAO,SAAS,CAAC,CAAA;AAAA,QAChE,KAAK,aAAA;AACH,UAAA,GAAA,CAAI,WAAA,CAAY,MAAA,CAAO,IAAA,EAAM,MAAA,CAAO,SAAS,CAAA;AAC7C,UAAA,OAAO,IAAA,CAAK,EAAE,IAAA,EAAM,IAAA,EAAM,CAAA;AAAA,QAC5B,KAAK,QAAA;AACH,UAAA,MAAM,GAAA,CAAI,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA;AAC5B,UAAA,OAAO,IAAA,CAAK,EAAE,IAAA,EAAM,IAAA,EAAM,CAAA;AAAA,QAC5B,KAAK,SAAA;AACH,UAAA,MAAM,GAAA,CAAI,OAAA,CAAQ,MAAA,CAAO,IAAA,EAAM,OAAO,OAAO,CAAA;AAC7C,UAAA,OAAO,IAAA,CAAK,EAAE,IAAA,EAAM,IAAA,EAAM,CAAA;AAAA,QAC5B;AACE,UAAA,OAAO,KAAA,CAAM,sBAAsB,GAAG,CAAA;AAAA;AAC1C,IACF,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,iBAAiB,gBAAA,EAAkB,OAAO,KAAA,CAAM,KAAA,CAAM,SAAS,GAAG,CAAA;AACtE,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,GAAA;AAAA;AAAA,IAGA,MAAM,MAAM,OAAA,EAAqC;AAC/C,MAAA,IAAI,OAAA,CAAQ,QAAQ,GAAA,CAAI,SAAS,MAAM,WAAA,EAAa,OAAO,OAAO,OAAO,CAAA;AACzE,MAAA,OAAO,GAAA,CAAK,MAAM,OAAA,CAAQ,IAAA,EAAoB,CAAA;AAAA,IAChD,CAAA;AAAA,IAEA,gBAAA,CAAiB,QAAgC,OAAA,EAAqC;AACpF,MAAA,IAAI,OAAO,OAAA,KAAY,QAAA,EAAU,GAAA,CAAI,OAAA,CAAQ,QAAQ,OAAO,CAAA;AAAA,IAC9D,CAAA;AAAA,IAEA,MAAM,cAAA,CAAe,MAAA,EAAgC,IAAA,EAA6B;AAChF,MAAA,IAAI;AACF,QAAA,MAAA,CAAO,KAAA,CAAM,IAAA,KAAS,IAAA,GAAO,GAAA,GAAO,MAAM,QAAQ,CAAA;AAAA,MACpD,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,MAAM,OAAO,MAAM,CAAA;AAAA,IACrB,CAAA;AAAA,IAEA,MAAM,eAAe,MAAA,EAA+C;AAClE,MAAA,IAAI;AACF,QAAA,MAAA,CAAO,KAAA,CAAM,MAAM,OAAO,CAAA;AAAA,MAC5B,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,MAAM,OAAO,MAAM,CAAA;AAAA,IACrB,CAAA;AAAA;AAAA,IAGA,QAAQ,SAAA,EAA4B;AAClC,MAAA,OAAO,WAAA,CAAY,SAAS,CAAA,CAAE,MAAA,GAAS,CAAA;AAAA,IACzC,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,KAAA,GAAuB;AAC3B,MAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,MAAA,KAAA,MAAW,aAAa,OAAA,EAAS;AAC/B,QAAA,KAAA,MAAW,MAAA,IAAU,GAAA,CAAI,aAAA,CAAc,mBAAA,GAAsB,SAAS,CAAA,EAAG;AACvE,UAAA,IAAI,GAAA,GAAM,QAAA,CAAS,MAAM,CAAA,IAAK,SAAA,EAAW;AACzC,UAAA,IAAI;AACF,YAAA,MAAA,CAAO,KAAA,CAAM,8BAA8B,mBAAmB,CAAA;AAAA,UAChE,CAAA,CAAA,MAAQ;AAAA,UAER;AAAA,QACF;AAEA,QAAA,MAAM,UAAU,SAAS,CAAA;AAAA,MAC3B;AACA,MAAA,MAAM,aAAA,EAAc;AAAA,IACtB;AAAA,GACF;AACF;AAKO,SAAS,UAAU,IAAA,EAAe;AACvC,EAAA,MAAM,OAAO,CAAC,MAAA,KACZ,IAAA,CAAK,KAAA,CAAM,IAAI,OAAA,CAAQ,cAAA,EAAgB,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,IAAA,CAAK,UAAU,MAAM,CAAA,EAAG,CAAC,CAAA;AAC1F,EAAA,MAAM,EAAA,GAAK,OAAO,QAAA,KAAuB;AACvC,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,QAAA,CAAS,MAAM,CAAA,CAAE,CAAA;AAAA,EACjF,CAAA;AACA,EAAA,OAAO;AAAA;AAAA,IAEL,OAAA,EAAS,CAAC,IAAA,EAA6C,SAAA,KACrD,IAAA;AAAA,MACE,IAAA,CAAK,IAAA,KAAS,WAAA,GACV,EAAE,MAAA,EAAQ,WAAA,EAAa,SAAA,EAAW,IAAA,EAAK,GACvC,EAAE,MAAA,EAAQ,aAAA,EAAe,WAAW,IAAA;AAAK,KAC/C;AAAA,IACF,MAAA,EAAQ,OAAO,IAAA,KAAiB,EAAA,CAAG,MAAM,IAAA,CAAK,EAAE,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,CAAC,CAAA;AAAA,IACzE,OAAA,EAAS,OAAO,IAAA,EAAc,OAAA,KAC5B,EAAA,CAAG,MAAM,IAAA,CAAK,EAAE,MAAA,EAAQ,SAAA,EAAW,IAAA,EAAM,OAAA,EAAS,CAAC;AAAA,GACvD;AACF;AAuBA,eAAsB,oBAAA,CACpB,SACA,OAAA,EAC+B;AAC/B,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAC/B,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,OAAA;AAC3B,EAAA,IAAI,CAAC,CAAC,MAAA,CAAO,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAQ,MAAA,CAAO,QAAQ,CAAA,CAAE,QAAA,CAAS,GAAA,CAAI,QAAQ,GAAG,OAAO,MAAA;AACpF,EAAA,IAAI,CAAC,MAAA,EAAQ,OAAO,KAAA,CAAM,kCAAkC,GAAG,CAAA;AAE/D,EAAA,IAAI,GAAA,CAAI,QAAA,KAAa,MAAA,CAAO,MAAA,EAAQ;AAClC,IAAA,IAAI,QAAQ,MAAA,KAAW,MAAA,EAAQ,OAAO,KAAA,CAAM,sBAAsB,GAAG,CAAA;AACrE,IAAA,MAAMC,UAAAA,GAAY,MAAM,OAAA,CAAQ,YAAA,CAAa,OAAO,CAAA;AACpD,IAAA,IAAI,CAACA,UAAAA,EAAW,OAAO,KAAA,CAAM,gBAAgB,GAAG,CAAA;AAChD,IAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,MAAA,CAAO,QAAQ,GAAG,CAAA;AAC5C,IAAA,SAAA,CAAU,QAAA,GAAW,MAAA;AACrB,IAAA,OAAO,IAAA;AAAA,MACL,MAAM,yBAAA,CAA0B;AAAA,QAC9B,MAAA;AAAA,QACA,SAAA,EAAAA,UAAAA;AAAA,QACA,GAAA,EAAK,UAAU,QAAA,EAAS;AAAA,QACxB,GAAI,QAAQ,qBAAA,KAA0B,MAAA,GAClC,EAAC,GACD,EAAE,eAAA,EAAiB,OAAA,CAAQ,qBAAA;AAAsB,OACtD;AAAA,KACH;AAAA,EACF;AAEA,EAAA,IAAI,GAAA,CAAI,QAAA,KAAa,MAAA,CAAO,MAAA,EAAQ;AAClC,IAAA,IAAI,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,MAAM,WAAA,EAAa;AAClD,MAAA,OAAO,KAAA,CAAM,gCAAgC,GAAG,CAAA;AAAA,IAClD;AACA,IAAA,MAAMA,UAAAA,GAAY,MAAM,yBAAA,CAA0B,GAAA,CAAI,aAAa,GAAA,CAAI,OAAO,CAAA,IAAK,EAAA,EAAI,MAAM,CAAA;AAC7F,IAAA,IAAI,CAACA,YAAW,OAAO,IAAI,SAAS,cAAA,EAAgB,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AACnE,IAAA,MAAM,SAAA,GAAY,IAAI,OAAA,CAAQ,OAAO,CAAA;AACrC,IAAA,SAAA,CAAU,OAAA,CAAQ,GAAA,CAAI,oBAAA,EAAsBA,UAAS,CAAA;AACrD,IAAA,OAAO,OAAA,CAAQ,GAAA,EAAI,CAAE,KAAA,CAAM,SAAS,CAAA;AAAA,EACtC;AAEA,EAAA,IAAI,QAAQ,MAAA,KAAW,MAAA,EAAQ,OAAO,KAAA,CAAM,sBAAsB,GAAG,CAAA;AACrE,EAAA,MAAM,YAAY,MAAM,yBAAA,CAA0B,WAAA,CAAY,OAAO,GAAG,MAAM,CAAA;AAC9E,EAAA,IAAI,CAAC,SAAA,EAAW,OAAO,KAAA,CAAM,gBAAgB,GAAG,CAAA;AAChD,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,QAAQ,IAAA,EAAK;AAAA,EAC5B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA,CAAM,gBAAgB,GAAG,CAAA;AAAA,EAClC;AACA,EAAA,IAAI,CAAC,YAAA,CAAa,IAAI,GAAG,OAAO,KAAA,CAAM,gCAAgC,GAAG,CAAA;AACzE,EAAA,OAAO,UAAU,OAAA,CAAQ,GAAA,EAAK,CAAA,CAAE,OAAA,CAAQ,MAAM,SAAS,CAAA;AACzD","file":"cloudflare.js","sourcesContent":["import { ReactiveClient } from './client.js';\nimport type { ReactiveClientConfig } from './types.js';\n\n/**\n * Cluster workers run on machines with no inbound access. They authenticate\n * outbound with a long-lived runner token, exchange it for a short-lived ticket,\n * and hold a reactive WebSocket that pushes work to them. These helpers use only\n * Web standards (fetch, WebSocket, Web Crypto), so the same code runs in Node and\n * in Workers runtimes, whichever backend serves the reactive protocol.\n */\n\nexport const DEFAULT_CLUSTER_TICKET_PATH = '/api/cluster/token';\nexport const DEFAULT_CLUSTER_HTTP_PATH = '/api/reactive';\nconst DEFAULT_RETRY_DELAY_MS = 10_000;\nconst DEFAULT_REQUEST_TIMEOUT_MS = 10_000;\nconst DEFAULT_TICKET_LIFETIME_SECONDS = 60;\n// Workers are few and long-lived, and the server needs their pings to know they are alive.\nconst DEFAULT_CLUSTER_HEARTBEAT_MS = 30_000;\n\n/** Short-lived credential returned by the ticket endpoint. */\nexport interface ClusterTicket {\n  /** Sent as the WebSocket `token` query parameter and the HTTP bearer token. */\n  token: string;\n  /** Expiry in epoch seconds. */\n  expiresAt: number;\n  /** `wss:` URL of the reactive WebSocket. */\n  url: string;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null;\n}\n\n/** Validates a ticket endpoint response; the socket URL must use `wss:`. */\nexport function parseClusterTicket(value: unknown): ClusterTicket {\n  if (\n    !isRecord(value) ||\n    typeof value.token !== 'string' ||\n    value.token.length === 0 ||\n    typeof value.expiresAt !== 'number' ||\n    !Number.isFinite(value.expiresAt) ||\n    typeof value.url !== 'string'\n  ) {\n    throw new Error('Cluster ticket response is invalid');\n  }\n  const url = new URL(value.url);\n  if (url.protocol !== 'wss:') throw new Error('Cluster ticket URL must use WSS');\n  return { token: value.token, expiresAt: value.expiresAt, url: url.toString() };\n}\n\nexport interface ClusterWorkerConfig {\n  /** Origin of the application that serves the ticket and reactive HTTP endpoints. */\n  baseUrl: string;\n  /** Long-lived runner credential exchanged for tickets. */\n  runnerToken: string | (() => string | Promise<string>);\n  /** Ticket endpoint path. Defaults to `/api/cluster/token`. */\n  ticketPath?: string;\n  /** Reactive HTTP endpoint path. Defaults to `/api/reactive`. */\n  httpPath?: string;\n  /** Delay between ticket, connect, and reconnect attempts. Defaults to 10 seconds. */\n  retryDelay?: number;\n  /** Ticket request timeout. Defaults to 10 seconds. */\n  requestTimeout?: number;\n  /** Stops retrying when aborted. */\n  signal?: AbortSignal;\n  /** Called with each failed ticket or connect attempt before the next retry. */\n  onRetry?: (error: Error) => void;\n  /** Extra client options; the URL, HTTP URL, and auth are managed here. */\n  client?: Omit<ReactiveClientConfig, 'url' | 'httpUrl' | 'auth'>;\n  /** Fetch implementation for ticket requests. Defaults to the global fetch. */\n  fetch?: typeof fetch;\n}\n\nfunction toError(cause: unknown): Error {\n  return cause instanceof Error ? cause : new Error(String(cause));\n}\n\nfunction abortError(signal: AbortSignal): Error {\n  return toError(signal.reason ?? new Error('Cluster worker connection aborted'));\n}\n\nfunction wait(milliseconds: number, signal?: AbortSignal): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(abortError(signal));\n      return;\n    }\n    const onAbort = () => {\n      clearTimeout(timer);\n      reject(abortError(signal!));\n    };\n    const timer = setTimeout(() => {\n      signal?.removeEventListener('abort', onAbort);\n      resolve();\n    }, milliseconds);\n    signal?.addEventListener('abort', onAbort, { once: true });\n  });\n}\n\n/** Requests a ticket from the application using the runner token. */\nexport async function fetchClusterTicket(\n  config: Pick<\n    ClusterWorkerConfig,\n    'baseUrl' | 'runnerToken' | 'ticketPath' | 'requestTimeout' | 'fetch'\n  >,\n): Promise<ClusterTicket> {\n  const runnerToken =\n    typeof config.runnerToken === 'function' ? await config.runnerToken() : config.runnerToken;\n  const endpoint = new URL(config.ticketPath ?? DEFAULT_CLUSTER_TICKET_PATH, config.baseUrl);\n  const response = await (config.fetch ?? fetch)(endpoint, {\n    method: 'POST',\n    headers: { authorization: `Bearer ${runnerToken}` },\n    signal: AbortSignal.timeout(config.requestTimeout ?? DEFAULT_REQUEST_TIMEOUT_MS),\n  });\n  if (!response.ok) {\n    throw new Error(`Cluster ticket request failed: HTTP ${response.status}`);\n  }\n  return parseClusterTicket(await response.json());\n}\n\n/**\n * Connects a cluster worker, retrying ticket and connect failures until it\n * succeeds or `signal` aborts. Each (re)connect fetches a fresh ticket. The\n * returned client keeps reconnecting on its own; subscribe to work with\n * `client.subscribe(...)` and stop with `client.disconnect()`.\n */\nexport async function connectClusterWorker(config: ClusterWorkerConfig): Promise<ReactiveClient> {\n  const retryDelay = config.retryDelay ?? DEFAULT_RETRY_DELAY_MS;\n  const httpUrl = new URL(config.httpPath ?? DEFAULT_CLUSTER_HTTP_PATH, config.baseUrl).toString();\n  for (;;) {\n    if (config.signal?.aborted) throw abortError(config.signal);\n    let client: ReactiveClient | undefined;\n    try {\n      // The first ticket only supplies the socket URL; the client fetches its own\n      // ticket for every connection so reconnects never reuse an expired one.\n      // oxlint-disable-next-line no-await-in-loop -- Attempts retry serially.\n      const ticket = await fetchClusterTicket(config);\n      client = new ReactiveClient({\n        reconnectDelay: retryDelay,\n        maxReconnectAttempts: Number.MAX_SAFE_INTEGER,\n        heartbeatInterval: DEFAULT_CLUSTER_HEARTBEAT_MS,\n        ...config.client,\n        url: ticket.url,\n        httpUrl,\n        auth: async () => (await fetchClusterTicket(config)).token,\n      });\n      // oxlint-disable-next-line no-await-in-loop -- Attempts retry serially.\n      await client.connect();\n      return client;\n    } catch (cause) {\n      // connect() keeps reconnecting after it rejects; stop it before retrying.\n      client?.disconnect();\n      if (config.signal?.aborted) throw abortError(config.signal);\n      config.onRetry?.(toError(cause));\n      // oxlint-disable-next-line no-await-in-loop -- Backoff belongs to the retry loop.\n      await wait(retryDelay, config.signal);\n    }\n  }\n}\n\nconst encoder = new TextEncoder();\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n  let binary = '';\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/u, '');\n}\n\nfunction base64UrlDecode(value: string): Uint8Array<ArrayBuffer> {\n  const padded = value.replaceAll('-', '+').replaceAll('_', '/');\n  const binary = atob(padded + '='.repeat((4 - (padded.length % 4)) % 4));\n  const bytes = new Uint8Array(new ArrayBuffer(binary.length));\n  for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);\n  return bytes;\n}\n\nfunction hmacKey(secret: string, usage: 'sign' | 'verify'): Promise<CryptoKey> {\n  return crypto.subtle.importKey(\n    'raw',\n    encoder.encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    [usage],\n  );\n}\n\nexport interface SignedClusterTicketOptions {\n  /** HMAC secret shared only by the servers that mint and verify tickets. */\n  secret: string;\n  /** Service principal the ticket authenticates as. */\n  principal: string;\n  /** `wss:` URL returned to the worker. */\n  url: string;\n  /** Ticket lifetime. Defaults to 60 seconds. */\n  lifetimeSeconds?: number;\n  /** Current time in milliseconds, for tests. */\n  now?: number;\n}\n\n/**\n * Mints a stateless HMAC-signed ticket. Verifying it needs no storage read,\n * which keeps reconnect storms off the database.\n */\nexport async function createSignedClusterTicket(\n  options: SignedClusterTicketOptions,\n): Promise<ClusterTicket> {\n  const expiresAt =\n    Math.floor((options.now ?? Date.now()) / 1000) +\n    (options.lifetimeSeconds ?? DEFAULT_TICKET_LIFETIME_SECONDS);\n  const payload = base64UrlEncode(\n    encoder.encode(JSON.stringify({ p: options.principal, exp: expiresAt })),\n  );\n  const signature = new Uint8Array(\n    await crypto.subtle.sign(\n      'HMAC',\n      await hmacKey(options.secret, 'sign'),\n      encoder.encode(payload),\n    ),\n  );\n  return parseClusterTicket({\n    token: `${payload}.${base64UrlEncode(signature)}`,\n    expiresAt,\n    url: options.url,\n  });\n}\n\n/** Returns the ticket's principal, or `undefined` when it is forged, malformed, or expired. */\nexport async function verifySignedClusterTicket(\n  token: string,\n  secret: string,\n  now = Date.now(),\n): Promise<string | undefined> {\n  const parts = token.split('.');\n  if (parts.length !== 2) return undefined;\n  const [payload, signature] = parts as [string, string];\n  if (!payload || !signature) return undefined;\n  try {\n    // crypto.subtle.verify compares in constant time.\n    const valid = await crypto.subtle.verify(\n      'HMAC',\n      await hmacKey(secret, 'verify'),\n      base64UrlDecode(signature),\n      encoder.encode(payload),\n    );\n    if (!valid) return undefined;\n    const claims: unknown = JSON.parse(new TextDecoder().decode(base64UrlDecode(payload)));\n    if (\n      !isRecord(claims) ||\n      typeof claims.p !== 'string' ||\n      typeof claims.exp !== 'number' ||\n      claims.exp <= Math.floor(now / 1000)\n    ) {\n      return undefined;\n    }\n    return claims.p;\n  } catch {\n    return undefined;\n  }\n}\n","import type {\n  JsonPatch,\n  SnapshotResponse,\n  SubscribeRequest,\n  UnsubscribeRequest,\n  WebSocketEvent,\n} from './protocol.js';\n\n/**\n * Protocol core for a reactive hub: the server half of the wire protocol for\n * backends that hold WebSockets themselves (for example a Cloudflare Durable\n * Object). It keeps every piece of per-socket state on the socket's attachment so\n * the state survives hibernation, and it has no runtime imports, so it runs and\n * tests in Node.\n */\n\n/** Hibernation limits a socket attachment to 2,048 bytes of serialized JSON. */\nexport const DEFAULT_MAX_ATTACHMENT_BYTES = 2_048;\n\n/** One subscription held by a socket. */\nexport interface HubSubscription {\n  subscriptionId: string;\n  generation: number;\n  path: string;\n}\n\n/** State kept on each socket's attachment. */\nexport interface HubSocketState {\n  connectionId: string;\n  principal: string;\n  subscriptions: HubSubscription[];\n  /** Epoch ms the socket was accepted; the liveness baseline before its first ping. */\n  connectedAt?: number;\n}\n\n/** The parts of a hibernatable WebSocket the hub uses; faked in tests. */\nexport interface HubSocket {\n  send(message: string): void;\n  deserializeAttachment(): unknown;\n  serializeAttachment(value: unknown): void;\n}\n\nexport interface HubSockets {\n  all(): HubSocket[];\n  byConnectionId(connectionId: string): HubSocket | undefined;\n}\n\n/** Monotonic per-path versions. Versions only need to grow while sockets stay open. */\nexport interface HubVersions {\n  get(path: string): Promise<number>;\n  set(path: string, version: number): Promise<void>;\n}\n\nexport interface HubPathContext {\n  path: string;\n  principal: string;\n  input: unknown;\n}\n\nexport interface HubPath {\n  /**\n   * Runs before the subscription is stored. Return false to reject it. Every\n   * subscriber of a path receives its pushes, so authorise here, not in `snapshot`.\n   */\n  authorize?(context: HubPathContext): boolean | Promise<boolean>;\n  /** Current data for the path, sent as the subscription snapshot. */\n  snapshot(context: HubPathContext): unknown;\n}\n\n/** Fixed paths by name, or a resolver for parameterised paths such as `drafts.<id>`. */\nexport type HubPaths = Record<string, HubPath> | ((path: string) => HubPath | undefined);\n\nexport interface ReactiveHubOptions {\n  sockets: HubSockets;\n  versions: HubVersions;\n  paths: HubPaths;\n  /** Rejects subscribes that would grow an attachment past this size. */\n  maxAttachmentBytes?: number;\n}\n\n/** Thrown for requests the caller is not allowed to make. */\nexport class ReactiveHubError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'ReactiveHubError';\n  }\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null;\n}\n\n/** Validates a reactive HTTP body for the subscribe and unsubscribe requests a hub serves. */\nexport function isHubRequest(value: unknown): value is SubscribeRequest | UnsubscribeRequest {\n  if (!isRecord(value)) return false;\n  return (\n    (value.type === 'subscribe' || value.type === 'unsubscribe') &&\n    typeof value.connectionId === 'string' &&\n    typeof value.subscriptionId === 'string' &&\n    typeof value.generation === 'number' &&\n    (value.type === 'unsubscribe' || typeof value.path === 'string')\n  );\n}\n\n/** Returns the bearer token from an `Authorization` header, or an empty string. */\nexport function bearerToken(request: Request): string {\n  const match = /^Bearer ([^\\s]+)$/u.exec(request.headers.get('authorization') ?? '');\n  return match?.[1] ?? '';\n}\n\n/** Initial attachment for a newly accepted socket. */\nexport function createHubSocketState(\n  connectionId: string,\n  principal: string,\n  connectedAt?: number,\n): HubSocketState {\n  return {\n    connectionId,\n    principal,\n    subscriptions: [],\n    ...(connectedAt === undefined ? {} : { connectedAt }),\n  };\n}\n\nfunction socketState(socket: HubSocket): HubSocketState {\n  const state = socket.deserializeAttachment() as HubSocketState;\n  // Attachments written before subscriptions carried a path have no path; they\n  // are dropped rather than fanned out to every notification.\n  return { ...state, subscriptions: state.subscriptions.filter((entry) => entry.path) };\n}\n\nfunction send(socket: HubSocket, event: WebSocketEvent): void {\n  try {\n    socket.send(JSON.stringify(event));\n  } catch {\n    // A socket closing mid-broadcast is cleaned up by its close handler.\n  }\n}\n\n/** Creates the protocol core for one hub instance. */\nexport function createReactiveHub(options: ReactiveHubOptions) {\n  const { sockets, versions } = options;\n  const maxAttachmentBytes = options.maxAttachmentBytes ?? DEFAULT_MAX_ATTACHMENT_BYTES;\n  const resolve = (path: string): HubPath | undefined =>\n    typeof options.paths === 'function'\n      ? options.paths(path)\n      : Object.hasOwn(options.paths, path)\n        ? options.paths[path]\n        : undefined;\n\n  const ownedSocket = (connectionId: string, principal: string): HubSocket | undefined => {\n    const socket = sockets.byConnectionId(connectionId);\n    // The HTTP caller must own the WebSocket it registers against.\n    return socket && socketState(socket).principal === principal ? socket : undefined;\n  };\n\n  const subscribersOf = (path: string) =>\n    sockets.all().flatMap((socket) =>\n      socketState(socket)\n        .subscriptions.filter((subscription) => subscription.path === path)\n        .map((subscription) => ({ socket, subscription })),\n    );\n\n  const bump = async (path: string) => {\n    const fromVersion = await versions.get(path);\n    const toVersion = fromVersion + 1;\n    await versions.set(path, toVersion);\n    return { fromVersion, toVersion };\n  };\n\n  return {\n    /** Answers the client's `init` and `ping` frames. */\n    message(socket: HubSocket, raw: string): void {\n      let frame: unknown;\n      try {\n        frame = JSON.parse(raw);\n      } catch {\n        return;\n      }\n      const type = isRecord(frame) ? frame.type : undefined;\n      if (type === 'init') {\n        send(socket, { type: 'connected', connectionId: socketState(socket).connectionId });\n      } else if (type === 'ping') {\n        send(socket, { type: 'pong' });\n      }\n    },\n\n    async subscribe(request: SubscribeRequest, principal: string): Promise<SnapshotResponse> {\n      const handler = resolve(request.path);\n      if (!handler) throw new ReactiveHubError('Unknown subscription path');\n      if (!ownedSocket(request.connectionId, principal)) {\n        throw new ReactiveHubError('Unknown connection');\n      }\n      const context: HubPathContext = { path: request.path, principal, input: request.input };\n      if (handler.authorize && !(await handler.authorize(context))) {\n        throw new ReactiveHubError('Subscription not allowed');\n      }\n      // Re-read after the awaits so a concurrent subscribe on the same socket is kept.\n      const socket = ownedSocket(request.connectionId, principal);\n      if (!socket) throw new ReactiveHubError('Unknown connection');\n      const state = socketState(socket);\n      const next: HubSocketState = {\n        ...state,\n        subscriptions: [\n          ...state.subscriptions.filter((entry) => entry.subscriptionId !== request.subscriptionId),\n          {\n            subscriptionId: request.subscriptionId,\n            generation: request.generation,\n            path: request.path,\n          },\n        ],\n      };\n      if (new TextEncoder().encode(JSON.stringify(next)).length > maxAttachmentBytes) {\n        throw new ReactiveHubError('Too many subscriptions on this connection');\n      }\n      socket.serializeAttachment(next);\n      // Read the version before the data so a concurrent notify can only make the\n      // client re-fetch, never miss a change.\n      const version = await versions.get(request.path);\n      const data = await handler.snapshot(context);\n      return {\n        type: 'snapshot',\n        subscriptionId: request.subscriptionId,\n        generation: request.generation,\n        version,\n        data,\n      };\n    },\n\n    unsubscribe(request: UnsubscribeRequest, principal: string): void {\n      const socket = ownedSocket(request.connectionId, principal);\n      if (!socket) return;\n      const state = socketState(socket);\n      socket.serializeAttachment({\n        ...state,\n        subscriptions: state.subscriptions.filter(\n          (entry) => entry.subscriptionId !== request.subscriptionId,\n        ),\n      } satisfies HubSocketState);\n    },\n\n    /** Bumps the path's version and asks each of its subscribers to re-fetch. */\n    async notify(path: string): Promise<void> {\n      const { fromVersion, toVersion } = await bump(path);\n      for (const { socket, subscription } of subscribersOf(path)) {\n        send(socket, {\n          type: 'resync',\n          subscriptionId: subscription.subscriptionId,\n          generation: subscription.generation,\n          fromVersion,\n          toVersion,\n          messageId: crypto.randomUUID(),\n        });\n      }\n    },\n\n    /**\n     * Bumps the path's version and sends the same JSON patches to each subscriber.\n     * Use it only when every subscriber of the path sees the same data.\n     */\n    async publish(path: string, patches: JsonPatch[]): Promise<void> {\n      const { fromVersion, toVersion } = await bump(path);\n      for (const { socket, subscription } of subscribersOf(path)) {\n        send(socket, {\n          type: 'patch',\n          subscriptionId: subscription.subscriptionId,\n          generation: subscription.generation,\n          fromVersion,\n          toVersion,\n          messageId: crypto.randomUUID(),\n          patches,\n        });\n      }\n    },\n  };\n}\n\nexport type ReactiveHub = ReturnType<typeof createReactiveHub>;\n","import { createSignedClusterTicket, verifySignedClusterTicket } from './cluster.js';\nimport {\n  bearerToken,\n  createHubSocketState,\n  createReactiveHub,\n  type HubPaths,\n  type HubSocket,\n  type HubSocketState,\n  isHubRequest,\n  ReactiveHubError,\n} from './hub.js';\nimport type { JsonPatch, SubscribeRequest, UnsubscribeRequest } from './protocol.js';\n\n/**\n * Cloudflare Durable Object shell for the reactive hub. It is structural: it\n * takes the Durable Object's `ctx` instead of extending `DurableObject`, so this\n * entry imports nothing from `cloudflare:workers` and builds like every other\n * entry. Your Durable Object class owns its name and migrations and delegates\n * `fetch`, `webSocketMessage`, `webSocketClose` and `webSocketError` to it, plus\n * `alarm` when it tracks presence.\n */\n\n/** Set by the route handler on requests it forwards to the hub; never trusted from clients. */\nexport const HUB_PRINCIPAL_HEADER = 'x-reactive-principal';\nconst HUB_ACTION_URL = 'https://reactive-hub/';\nconst PRESENCE_TAG_PREFIX = 'presence:';\nconst PRESENCE_KEY_PREFIX = 'presence:';\nconst DEFAULT_PRESENCE_TIMEOUT_MS = 90_000;\n/** Close code for a socket the presence sweep found silent. */\nexport const HEARTBEAT_TIMEOUT_CLOSE_CODE = 4001;\n\n/** A hibernatable Workers WebSocket, as far as the hub needs it. */\nexport interface DurableObjectWebSocket extends HubSocket {\n  close(code?: number, reason?: string): void;\n}\n\n/** The parts of `DurableObjectState` the hub uses. */\nexport interface DurableObjectStateLike {\n  acceptWebSocket(socket: DurableObjectWebSocket, tags?: string[]): void;\n  getWebSockets(tag?: string): DurableObjectWebSocket[];\n  setWebSocketAutoResponse?(pair?: unknown): void;\n  /** When the runtime last answered this socket's `ping` itself; needed for presence. */\n  getWebSocketAutoResponseTimestamp?(socket: DurableObjectWebSocket): Date | null;\n  storage: {\n    get<T>(key: string): Promise<T | undefined>;\n    put<T>(key: string, value: T): Promise<void>;\n    /** Needed for presence. */\n    getAlarm?(): Promise<number | null>;\n    /** Needed for presence. */\n    setAlarm?(scheduledTime: number): Promise<void>;\n  };\n}\n\n/** Anything with a Durable Object stub's `fetch`. */\nexport interface HubStub {\n  fetch(request: Request): Promise<Response>;\n}\n\ntype WebSocketPairConstructor = new () => {\n  0: DurableObjectWebSocket;\n  1: DurableObjectWebSocket;\n};\ntype RequestResponsePairConstructor = new (request: string, response: string) => unknown;\n\nexport interface DurableObjectHubOptions {\n  paths: HubPaths;\n  /** Storage key for a path's version. Defaults to `version:<path>`. */\n  versionKey?: (path: string) => string;\n  maxAttachmentBytes?: number;\n  /**\n   * Answers the client's `ping` with `pong` without waking the Durable Object.\n   * Defaults to true.\n   */\n  autoPong?: boolean;\n  /**\n   * Tracks whether these principals hold a live socket, so the hub can report a\n   * worker as online without the worker polling over HTTP. Requires `autoPong`.\n   */\n  presence?: HubPresenceOptions;\n  /** Workers' `WebSocketPair`; injectable for tests. */\n  WebSocketPair?: WebSocketPairConstructor;\n  /** Creates a connection id; injectable for tests. */\n  randomId?: () => string;\n}\n\nexport interface HubPresenceOptions {\n  principals: readonly string[];\n  /**\n   * A socket whose last `ping` is older than this is closed as dead, which is how\n   * a peer that vanished without a close frame is noticed. Clients must ping more\n   * often than this. @default 90000\n   */\n  timeoutMs?: number;\n  /**\n   * Called when a principal gains its first live socket or loses its last one,\n   * for example to `notify` a status path. The last reported state is kept in\n   * storage under `presence:<principal>`, so each change is reported once.\n   */\n  onChange?: (principal: string, present: boolean) => void | Promise<void>;\n}\n\ntype HubAction =\n  | { action: 'subscribe'; principal: string; body: SubscribeRequest }\n  | { action: 'unsubscribe'; principal: string; body: UnsubscribeRequest }\n  | { action: 'notify'; path: string }\n  | { action: 'publish'; path: string; patches: JsonPatch[] };\n\nfunction json(value: unknown, status = 200): Response {\n  return Response.json(value, { status, headers: { 'cache-control': 'no-store' } });\n}\n\nfunction error(message: string, status: number): Response {\n  return json({ type: 'error', message }, status);\n}\n\nfunction workersGlobal<T>(name: string): T | undefined {\n  return (globalThis as Record<string, unknown>)[name] as T | undefined;\n}\n\n/** Wires the hub core to a Durable Object's hibernatable WebSockets and storage. */\nexport function createDurableObjectHub(\n  ctx: DurableObjectStateLike,\n  options: DurableObjectHubOptions,\n) {\n  const versionKey = options.versionKey ?? ((path: string) => `version:${path}`);\n  const randomId = options.randomId ?? (() => crypto.randomUUID());\n  const hub = createReactiveHub({\n    sockets: {\n      all: () => ctx.getWebSockets(),\n      // Tagging by connection id lets HTTP subscribes find the socket after hibernation.\n      byConnectionId: (connectionId) => ctx.getWebSockets(connectionId)[0],\n    },\n    versions: {\n      get: async (path) => (await ctx.storage.get<number>(versionKey(path))) ?? 0,\n      set: (path, version) => ctx.storage.put(versionKey(path), version),\n    },\n    paths: options.paths,\n    ...(options.maxAttachmentBytes === undefined\n      ? {}\n      : { maxAttachmentBytes: options.maxAttachmentBytes }),\n  });\n\n  if (options.autoPong !== false) {\n    const Pair = workersGlobal<RequestResponsePairConstructor>('WebSocketRequestResponsePair');\n    if (Pair && ctx.setWebSocketAutoResponse) {\n      ctx.setWebSocketAutoResponse(\n        new Pair(JSON.stringify({ type: 'ping' }), JSON.stringify({ type: 'pong' })),\n      );\n    }\n  }\n\n  const tracked = new Set(options.presence?.principals ?? []);\n  const timeoutMs = options.presence?.timeoutMs ?? DEFAULT_PRESENCE_TIMEOUT_MS;\n\n  // The runtime records each auto-answered ping without waking the object;\n  // before the first ping the accept time stands in.\n  const lastSeen = (socket: DurableObjectWebSocket): number =>\n    Math.max(\n      ctx.getWebSocketAutoResponseTimestamp?.(socket)?.getTime() ?? 0,\n      (socket.deserializeAttachment() as HubSocketState).connectedAt ?? 0,\n    );\n\n  const liveSockets = (principal: string, closing?: DurableObjectWebSocket) => {\n    const now = Date.now();\n    return ctx\n      .getWebSockets(PRESENCE_TAG_PREFIX + principal)\n      .filter((socket) => socket !== closing && now - lastSeen(socket) <= timeoutMs);\n  };\n\n  const reconcile = async (principal: string, closing?: DurableObjectWebSocket) => {\n    const present = liveSockets(principal, closing).length > 0;\n    const key = PRESENCE_KEY_PREFIX + principal;\n    if (((await ctx.storage.get<boolean>(key)) ?? false) === present) return;\n    await ctx.storage.put(key, present);\n    await options.presence?.onChange?.(principal, present);\n  };\n\n  // Wakes when the stalest tracked socket would time out; no tracked sockets, no alarm.\n  const scheduleSweep = async () => {\n    const { storage } = ctx;\n    if (!storage.getAlarm || !storage.setAlarm) {\n      throw new Error('Hub presence needs Durable Object alarms');\n    }\n    const seen = [...tracked].flatMap((principal) =>\n      ctx.getWebSockets(PRESENCE_TAG_PREFIX + principal).map((socket) => lastSeen(socket)),\n    );\n    if (seen.length === 0) return;\n    const due = Math.min(...seen) + timeoutMs + 1;\n    const current = await storage.getAlarm();\n    if (current === null || current > due) await storage.setAlarm(due);\n  };\n\n  const closed = async (socket: DurableObjectWebSocket) => {\n    if (tracked.size === 0) return;\n    const { principal } = socket.deserializeAttachment() as HubSocketState;\n    if (tracked.has(principal)) await reconcile(principal, socket);\n  };\n\n  const accept = async (request: Request): Promise<Response> => {\n    const principal = request.headers.get(HUB_PRINCIPAL_HEADER);\n    if (!principal) return error('Unauthorized', 401);\n    const Pair = options.WebSocketPair ?? workersGlobal<WebSocketPairConstructor>('WebSocketPair');\n    if (!Pair) throw new Error('WebSocketPair is not available in this runtime');\n    const pair = new Pair();\n    const connectionId = randomId();\n    const isTracked = tracked.has(principal);\n    ctx.acceptWebSocket(\n      pair[1],\n      isTracked ? [connectionId, PRESENCE_TAG_PREFIX + principal] : [connectionId],\n    );\n    pair[1].serializeAttachment(\n      createHubSocketState(connectionId, principal, isTracked ? Date.now() : undefined),\n    );\n    if (isTracked) {\n      await reconcile(principal);\n      await scheduleSweep();\n    }\n    return new Response(null, { status: 101, webSocket: pair[0] } as ResponseInit);\n  };\n\n  const act = async (action: HubAction): Promise<Response> => {\n    try {\n      switch (action.action) {\n        case 'subscribe':\n          return json(await hub.subscribe(action.body, action.principal));\n        case 'unsubscribe':\n          hub.unsubscribe(action.body, action.principal);\n          return json({ type: 'ok' });\n        case 'notify':\n          await hub.notify(action.path);\n          return json({ type: 'ok' });\n        case 'publish':\n          await hub.publish(action.path, action.patches);\n          return json({ type: 'ok' });\n        default:\n          return error('Unknown hub action', 400);\n      }\n    } catch (cause) {\n      if (cause instanceof ReactiveHubError) return error(cause.message, 400);\n      throw cause;\n    }\n  };\n\n  return {\n    hub,\n\n    /** The Durable Object's `fetch`: WebSocket upgrades and actions from `hubClient`. */\n    async fetch(request: Request): Promise<Response> {\n      if (request.headers.get('upgrade') === 'websocket') return accept(request);\n      return act((await request.json()) as HubAction);\n    },\n\n    webSocketMessage(socket: DurableObjectWebSocket, message: string | ArrayBuffer): void {\n      if (typeof message === 'string') hub.message(socket, message);\n    },\n\n    async webSocketClose(socket: DurableObjectWebSocket, code: number): Promise<void> {\n      try {\n        socket.close(code === 1005 ? 1000 : code, 'closed');\n      } catch {\n        // Already closed, or the runtime replied to the close frame itself.\n      }\n      await closed(socket);\n    },\n\n    async webSocketError(socket: DurableObjectWebSocket): Promise<void> {\n      try {\n        socket.close(1011, 'error');\n      } catch {\n        // Already closed.\n      }\n      await closed(socket);\n    },\n\n    /** Whether `principal` holds a socket that has pinged within the presence timeout. */\n    present(principal: string): boolean {\n      return liveSockets(principal).length > 0;\n    },\n\n    /**\n     * The Durable Object's `alarm` when presence is tracked: closes silent\n     * sockets, reports principals that lost their last one, and reschedules.\n     */\n    async alarm(): Promise<void> {\n      const now = Date.now();\n      for (const principal of tracked) {\n        for (const socket of ctx.getWebSockets(PRESENCE_TAG_PREFIX + principal)) {\n          if (now - lastSeen(socket) <= timeoutMs) continue;\n          try {\n            socket.close(HEARTBEAT_TIMEOUT_CLOSE_CODE, 'Heartbeat timeout');\n          } catch {\n            // Already closed.\n          }\n        }\n        // oxlint-disable-next-line no-await-in-loop -- Few principals; storage writes stay ordered.\n        await reconcile(principal);\n      }\n      await scheduleSweep();\n    },\n  };\n}\n\nexport type DurableObjectHub = ReturnType<typeof createDurableObjectHub>;\n\n/** Calls a hub Durable Object from the Worker. */\nexport function hubClient(stub: HubStub) {\n  const post = (action: HubAction) =>\n    stub.fetch(new Request(HUB_ACTION_URL, { method: 'POST', body: JSON.stringify(action) }));\n  const ok = async (response: Response) => {\n    if (!response.ok) throw new Error(`Hub request failed: HTTP ${response.status}`);\n  };\n  return {\n    /** Forwards a reactive HTTP request and returns the hub's response unchanged. */\n    request: (body: SubscribeRequest | UnsubscribeRequest, principal: string) =>\n      post(\n        body.type === 'subscribe'\n          ? { action: 'subscribe', principal, body }\n          : { action: 'unsubscribe', principal, body },\n      ),\n    notify: async (path: string) => ok(await post({ action: 'notify', path })),\n    publish: async (path: string, patches: JsonPatch[]) =>\n      ok(await post({ action: 'publish', path, patches })),\n  };\n}\n\nexport interface ReactiveRoutes {\n  /** `POST` exchanges a credential for a signed ticket. */\n  ticket: string;\n  /** WebSocket upgrade, authenticated by the ticket in the `token` query parameter. */\n  socket: string;\n  /** Reactive HTTP subscribe and unsubscribe, authenticated by the ticket as a bearer token. */\n  reactive: string;\n}\n\nexport interface ReactiveRoutesOptions {\n  routes: ReactiveRoutes;\n  /** Ticket signing secret. Requests get 503 when it is not configured. */\n  secret: string | undefined;\n  /** The hub Durable Object stub that serves these routes. */\n  hub: () => HubStub;\n  /** Returns the principal for a ticket request, or undefined to answer 401. */\n  authenticate(request: Request): string | undefined | Promise<string | undefined>;\n  ticketLifetimeSeconds?: number;\n}\n\n/** Serves the ticket, socket and reactive HTTP routes; `undefined` for any other path. */\nexport async function handleReactiveRoutes(\n  request: Request,\n  options: ReactiveRoutesOptions,\n): Promise<Response | undefined> {\n  const url = new URL(request.url);\n  const { routes, secret } = options;\n  if (![routes.ticket, routes.socket, routes.reactive].includes(url.pathname)) return undefined;\n  if (!secret) return error('Reactive hub is not configured', 503);\n\n  if (url.pathname === routes.ticket) {\n    if (request.method !== 'POST') return error('Method not allowed', 405);\n    const principal = await options.authenticate(request);\n    if (!principal) return error('Unauthorized', 401);\n    const socketUrl = new URL(routes.socket, url);\n    socketUrl.protocol = 'wss:';\n    return json(\n      await createSignedClusterTicket({\n        secret,\n        principal,\n        url: socketUrl.toString(),\n        ...(options.ticketLifetimeSeconds === undefined\n          ? {}\n          : { lifetimeSeconds: options.ticketLifetimeSeconds }),\n      }),\n    );\n  }\n\n  if (url.pathname === routes.socket) {\n    if (request.headers.get('upgrade') !== 'websocket') {\n      return error('Expected a WebSocket upgrade', 426);\n    }\n    const principal = await verifySignedClusterTicket(url.searchParams.get('token') ?? '', secret);\n    if (!principal) return new Response('Unauthorized', { status: 401 });\n    const forwarded = new Request(request);\n    forwarded.headers.set(HUB_PRINCIPAL_HEADER, principal);\n    return options.hub().fetch(forwarded);\n  }\n\n  if (request.method !== 'POST') return error('Method not allowed', 405);\n  const principal = await verifySignedClusterTicket(bearerToken(request), secret);\n  if (!principal) return error('Unauthorized', 401);\n  let body: unknown;\n  try {\n    body = await request.json();\n  } catch {\n    return error('Invalid JSON', 400);\n  }\n  if (!isHubRequest(body)) return error('Unsupported reactive request', 400);\n  return hubClient(options.hub()).request(body, principal);\n}\n"]}