hyperbrane 0.1.1 → 0.2.0

package/dist/portal-gateway/transport-worker.js

@@ -0,0 +1,205 @@
+import { randomBytes, randomUUID } from "node:crypto";
+import { readdir, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { jwtVerify } from "jose";
+import { dimensionLayout, isDimensionName } from "../dimension/api.js";
+import { createLocalService } from "../sandbox/providers/local/localService.js";
+const TRANSPORT_PROTOCOL = 1;
+const TOKEN_PARAM = "hyb_token";
+const HEARTBEAT_MS = 15_000;
+const connections = new Map();
+async function wired(dimensionName) {
+    const files = await readdir(join(data, "portals")).catch(() => []);
+    for (const file of files.filter((name) => name.endsWith(".json"))) {
+        const portal = await readFile(join(data, "portals", file), "utf8").then((text) => JSON.parse(text), () => null);
+        if (portal?.gatewayName === gateway && portal.dimensionName === dimensionName && portal.state === "ready")
+            return true;
+    }
+    return false;
+}
+async function authorized(url) {
+    const token = url.searchParams.get(TOKEN_PARAM);
+    if (!token)
+        return false;
+    try {
+        await jwtVerify(token, key, { algorithms: ["HS256"], requiredClaims: ["exp"] });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function cors(request, response) {
+    const origin = request.headers.get("origin");
+    if (!origin)
+        return response;
+    response.headers.set("access-control-allow-origin", origin);
+    response.headers.append("vary", "Origin");
+    return response;
+}
+async function preflight(request) {
+    const headers = new Headers({
+        "access-control-allow-methods": "GET, POST, OPTIONS",
+        "access-control-max-age": "600",
+    });
+    const asked = request.headers.get("access-control-request-headers");
+    if (asked)
+        headers.set("access-control-allow-headers", asked);
+    return cors(request, new Response(null, { status: 204, headers }));
+}
+async function answer(handler, request, server) {
+    server.timeout(request, 0);
+    if (!(await authorized(new URL(request.url))))
+        return Response.json({ error: "a valid token is required" }, { status: 401 });
+    try {
+        return await handler(request, server);
+    }
+    catch (error) {
+        const { name, message } = error instanceof Error ? error : new Error(String(error));
+        return Response.json({ name, message }, { status: 500 });
+    }
+}
+function guarded(handler) {
+    return async (request, server) => {
+        const response = await answer(handler, request, server);
+        return response && cors(request, response);
+    };
+}
+function relay(connection, send, end) {
+    connection.onData(send);
+    void connection.closed.then(end);
+}
+const encoder = new TextEncoder();
+function multipartFrames() {
+    const boundary = randomBytes(24).toString("hex");
+    const part = (type, data) => Buffer.concat([encoder.encode(`\r\ncontent-type: ${type}\r\n\r\n`), data, encoder.encode(`\r\n--${boundary}`)]);
+    return {
+        contentType: `multipart/mixed; boundary="${boundary}"`,
+        open: (id) => Buffer.concat([encoder.encode(`--${boundary}`), part("application/json", encoder.encode(JSON.stringify({ connection: id })))]),
+        data: (chunk) => part("application/octet-stream", chunk),
+        heartbeat: part("application/octet-stream", new Uint8Array()),
+        end: encoder.encode("--\r\n"),
+    };
+}
+function lineFrames() {
+    const decoder = new TextDecoder();
+    let pending = "";
+    return {
+        contentType: "text/event-stream",
+        open: (id) => encoder.encode(`event: open\ndata: ${JSON.stringify({ connection: id })}\n\n`),
+        data(chunk) {
+            const lines = (pending + decoder.decode(chunk, { stream: true })).split("\n");
+            pending = lines.pop();
+            return encoder.encode(lines.map((line) => `data: ${line.replace(/\r$/, "")}\n\n`).join(""));
+        },
+        heartbeat: encoder.encode(": ping\n\n"),
+        end: encoder.encode("event: close\ndata: {}\n\n"),
+    };
+}
+function stream(connection, frames) {
+    const id = randomUUID();
+    let heartbeat;
+    let open = true;
+    const finish = () => {
+        open = false;
+        clearInterval(heartbeat);
+        connections.delete(id);
+        connection.close();
+    };
+    connections.set(id, connection);
+    const body = new ReadableStream({
+        start(controller) {
+            const send = (bytes) => {
+                if (open && bytes.length > 0)
+                    controller.enqueue(bytes);
+            };
+            send(frames.open(id));
+            heartbeat = setInterval(() => send(frames.heartbeat), HEARTBEAT_MS);
+            relay(connection, (data) => send(frames.data(data)), () => {
+                if (!open)
+                    return;
+                send(frames.end);
+                finish();
+                controller.close();
+            });
+        },
+        cancel: finish,
+    });
+    return new Response(body, { headers: { "content-type": frames.contentType, "cache-control": "no-cache, no-transform", "x-accel-buffering": "no" } });
+}
+async function write(request) {
+    const connection = connections.get(request.params.id);
+    if (!connection)
+        return Response.json({ error: "no such connection" }, { status: 404 });
+    connection.write(new Uint8Array(await request.arrayBuffer()));
+    return new Response(null, { status: 204 });
+}
+async function connect(request, server) {
+    const params = new URL(request.url).searchParams;
+    const dimensionName = params.get("dimension") ?? "";
+    const agentName = params.get("agent");
+    if (!isDimensionName(dimensionName) || (agentName !== null && !isDimensionName(agentName))) {
+        return Response.json({ error: "dimension and agent are names" }, { status: 400 });
+    }
+    if (!(await wired(dimensionName)))
+        return Response.json({ error: `dimension ${dimensionName} has no portal to gateway ${gateway}` }, { status: 403 });
+    const socket = agentName === null ? dimensionLayout.transportSocketPath(data, dimensionName) : join(dimensionLayout.runDirectory(data, dimensionName), `${agentName}.sock`);
+    const connection = await machine.connect(socket).catch((error) => error);
+    if (connection instanceof Error)
+        return Response.json({ error: connection.message }, { status: 502 });
+    if (request.headers.get("upgrade")?.toLowerCase() !== "websocket")
+        return stream(connection, agentName === null ? multipartFrames() : lineFrames());
+    if (server.upgrade(request, { data: connection }))
+        return undefined;
+    connection.close();
+    return Response.json({ error: "the websocket upgrade failed" }, { status: 400 });
+}
+function serve(port) {
+    return Bun.serve({
+        port,
+        hostname: "0.0.0.0",
+        routes: {
+            "/connect": {
+                GET: guarded(connect),
+                OPTIONS: preflight,
+            },
+            "/connect/:id": {
+                POST: guarded(write),
+                OPTIONS: preflight,
+            },
+        },
+        websocket: {
+            open(socket) {
+                relay(socket.data, (data) => socket.send(data), () => socket.close());
+            },
+            message(socket, message) {
+                socket.data.write(typeof message === "string" ? Buffer.from(message) : message);
+            },
+            close(socket) {
+                socket.data.close();
+            },
+        },
+    });
+}
+function required(name) {
+    const value = process.env[name];
+    if (!value)
+        throw new Error(`${name} is not set`);
+    return value;
+}
+process.umask(0o077);
+const dir = required("HYB_TRANSPORT_DIR");
+const build = required("HYB_TRANSPORT_BUILD");
+const port = Number(required("HYB_TRANSPORT_PORT"));
+const gateway = required("HYB_GATEWAY");
+const data = required("HYB_DATA");
+const key = new TextEncoder().encode(await readFile(join(dir, "secret"), "utf8"));
+const machine = createLocalService({ kind: "local" });
+const server = serve(port);
+for (const signal of ["SIGTERM", "SIGINT"]) {
+    process.once(signal, () => {
+        server.stop(true);
+        process.exit(0);
+    });
+}
+await writeFile(join(dir, "ready"), `${process.pid} ${build} ${TRANSPORT_PROTOCOL}\n`);

package/dist/portal-gateway/transportBundle.d.ts

@@ -0,0 +1,2 @@
+export declare const transportEntry: () => string;
+export declare const transportBundle: () => Promise<import("../lib/scriptBundle.ts").ScriptBundle>;

package/dist/portal-gateway/transportBundle.generated.d.ts

@@ -0,0 +1 @@
+export declare const TRANSPORT_SOURCE: string;

package/dist/portal-gateway/transportBundle.generated.js

@@ -0,0 +1,2 @@
+// Generated by scripts/bundle-worker.ts — do not edit; run `bun run bundle:worker`.
+export const TRANSPORT_SOURCE = "// @bun\n// portal-gateway/transport-worker.ts\nimport { randomBytes as randomBytes2, randomUUID as randomUUID2 } from \"crypto\";\nimport { readdir as readdir2, readFile as readFile3, writeFile as writeFile3 } from \"fs/promises\";\nimport { join as join2 } from \"path\";\n\n// ../node_modules/.bun/jose@6.2.13/node_modules/jose/dist/webapi/lib/buffer_utils.js\nvar encoder = new TextEncoder;\nvar decoder = new TextDecoder;\nvar strictDecoder = new TextDecoder(\"utf-8\", { fatal: true });\nvar UINT32_RANGE = 2 ** 32;\nfunction concat(...buffers) {\n  const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);\n  let i = 0;\n  for (const buffer of buffers)\n    buf.set(buffer, i), i += buffer.length;\n  return buf;\n}\nvar NON_ASCII = /[^\\x00-\\x7f]/;\nfunction encode(string) {\n  if (typeof string == \"string\" && string.length >= 128) {\n    if (NON_ASCII.test(string))\n      throw new TypeError(\"non-ASCII string encountered in encode()\");\n    return encoder.encode(string);\n  }\n  const bytes = new Uint8Array(string.length);\n  for (let i = 0;i < string.length; i++) {\n    const code = string.charCodeAt(i);\n    if (code > 127)\n      throw new TypeError(\"non-ASCII string encountered in encode()\");\n    bytes[i] = code;\n  }\n  return bytes;\n}\nfunction encodeBase64(input, url = false) {\n  if (Uint8Array.prototype.toBase64)\n    return input.toBase64({ alphabet: url ? \"base64url\" : \"base64\", omitPadding: url });\n  const CHUNK_SIZE = 32768, arr = [];\n  for (let i = 0;i < input.length; i += CHUNK_SIZE)\n    arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n  const encoded = btoa(arr.join(\"\"));\n  return url ? encoded.replace(/=/g, \"\").replace(/\\+/g, \"-\").replace(/\\//g, \"_\") : encoded;\n}\nfunction decodeBase64(encoded, url = false) {\n  if (Uint8Array.fromBase64)\n    return Uint8Array.fromBase64(encoded, { alphabet: url ? \"base64url\" : \"base64\" });\n  if (url) {\n    if (encoded.includes(\"+\") || encoded.includes(\"/\"))\n      throw new TypeError(\"Invalid base64url\");\n    encoded = encoded.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  }\n  const binary = atob(encoded), bytes = new Uint8Array(binary.length);\n  for (let i = 0;i < binary.length; i++)\n    bytes[i] = binary.charCodeAt(i);\n  return bytes;\n}\n\n// ../node_modules/.bun/jose@6.2.13/node_modules/jose/dist/webapi/util/errors.js\nclass JOSEError extends Error {\n  static code = \"ERR_JOSE_GENERIC\";\n  code = \"ERR_JOSE_GENERIC\";\n  constructor(message, options) {\n    super(message, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);\n  }\n}\n\nclass JWTClaimValidationFailed extends JOSEError {\n  static code = \"ERR_JWT_CLAIM_VALIDATION_FAILED\";\n  code = \"ERR_JWT_CLAIM_VALIDATION_FAILED\";\n  claim;\n  reason;\n  payload;\n  constructor(message, payload, claim = \"unspecified\", reason = \"unspecified\") {\n    super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;\n  }\n}\n\nclass JWTExpired extends JOSEError {\n  static code = \"ERR_JWT_EXPIRED\";\n  code = \"ERR_JWT_EXPIRED\";\n  claim;\n  reason;\n  payload;\n  constructor(message, payload, claim = \"unspecified\", reason = \"unspecified\") {\n    super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;\n  }\n}\n\nclass JOSEAlgNotAllowed extends JOSEError {\n  static code = \"ERR_JOSE_ALG_NOT_ALLOWED\";\n  code = \"ERR_JOSE_ALG_NOT_ALLOWED\";\n}\n\nclass JOSENotSupported extends JOSEError {\n  static code = \"ERR_JOSE_NOT_SUPPORTED\";\n  code = \"ERR_JOSE_NOT_SUPPORTED\";\n}\nclass JWSInvalid extends JOSEError {\n  static code = \"ERR_JWS_INVALID\";\n  code = \"ERR_JWS_INVALID\";\n}\n\nclass JWTInvalid extends JOSEError {\n  static code = \"ERR_JWT_INVALID\";\n  code = \"ERR_JWT_INVALID\";\n}\nclass JWSSignatureVerificationFailed extends JOSEError {\n  static code = \"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\";\n  code = \"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\";\n  constructor(message = \"signature verification failed\", options) {\n    super(message, options);\n  }\n}\n\n// ../node_modules/.bun/jose@6.2.13/node_modules/jose/dist/webapi/util/base64url.js\nvar invalid = \"The input to be decoded is not correctly encoded.\";\nfunction decode(input) {\n  try {\n    return decodeBase64(typeof input == \"string\" ? input : decoder.decode(input), true);\n  } catch (cause) {\n    throw new TypeError(invalid, { cause });\n  }\n}\nfunction encode2(input) {\n  return encodeBase64(typeof input == \"string\" ? encoder.encode(input) : input, true);\n}\n\n// ../node_modules/.bun/jose@6.2.13/node_modules/jose/dist/webapi/lib/validate.js\nfunction isObject(input) {\n  if (typeof input != \"object\" || input === null || Object.prototype.toString.call(input) !== \"[object Object]\")\n    return false;\n  const prototype = Object.getPrototypeOf(input);\n  return prototype === null || Object.getPrototypeOf(prototype) === null;\n}\nfunction isDisjoint(...headers) {\n  const parameters = /* @__PURE__ */ new Set;\n  for (const header of headers)\n    if (header)\n      for (const parameter of Object.keys(header)) {\n        if (parameters.has(parameter))\n          return false;\n        parameters.add(parameter);\n      }\n  return true;\n}\nfunction assertNotSet(value, name) {\n  if (value !== undefined)\n    throw new TypeError(`${name} can only be called once`);\n}\nfunction decodeBase64url(value, label, ErrorClass) {\n  try {\n    return decode(value);\n  } catch (cause) {\n    throw new ErrorClass(`Failed to base64url decode the ${label}`, { cause });\n  }\n}\nfunction encodeAsciiMember(value, label, ErrorClass) {\n  try {\n    return encode(value);\n  } catch (cause) {\n    throw new ErrorClass(`The ${label} is not a valid base64url string`, { cause });\n  }\n}\nfunction parseJoseHeader(encodedProtectedHeader, ErrorClass, message) {\n  let parsed;\n  try {\n    parsed = JSON.parse(strictDecoder.decode(decode(encodedProtectedHeader)));\n  } catch (cause) {\n    throw new ErrorClass(message, { cause });\n  }\n  if (!isObject(parsed))\n    throw new ErrorClass(message);\n  return parsed;\n}\nvar JWS_RECOGNIZED = { __proto__: null, b64: true };\nfunction validateAlgorithms(option, algorithms) {\n  if (algorithms !== undefined && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != \"string\")))\n    throw new TypeError(`\"${option}\" option must be an array of strings`);\n  return algorithms === undefined ? undefined : new Set(algorithms);\n}\nfunction validateCritDuplicates(Err, protectedHeader) {\n  const { crit } = protectedHeader ?? {};\n  if (Array.isArray(crit) && new Set(crit).size !== crit.length)\n    throw new Err('\"crit\" (Critical) Header Parameter MUST NOT contain duplicate values');\n}\nfunction validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {\n  if (joseHeader.crit !== undefined && protectedHeader?.crit === undefined)\n    throw new Err('\"crit\" (Critical) Header Parameter MUST be integrity protected');\n  if (!protectedHeader || protectedHeader.crit === undefined)\n    return [];\n  if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != \"string\" || input.length === 0))\n    throw new Err('\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present');\n  const recognized = recognizedOption === undefined ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };\n  for (const parameter of protectedHeader.crit) {\n    if (!(parameter in recognized))\n      throw new JOSENotSupported(`Extension Header Parameter \"${parameter}\" is not recognized`);\n    if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === undefined)\n      throw new Err(`Extension Header Parameter \"${parameter}\" is missing`);\n    if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === undefined))\n      throw new Err(`Extension Header Parameter \"${parameter}\" MUST be integrity protected`);\n  }\n  return protectedHeader.crit;\n}\nfunction validateB64(protectedHeader, extensions) {\n  if (extensions.includes(\"b64\")) {\n    const b64 = protectedHeader.b64;\n    if (typeof b64 != \"boolean\")\n      throw new JWSInvalid('The \"b64\" (base64url-encode payload) Header Parameter must be a boolean');\n    return b64;\n  }\n  return true;\n}\nfunction serializeJoseHeader(Err, header) {\n  let serialized, parsed;\n  try {\n    serialized = JSON.stringify(header), parsed = JSON.parse(serialized);\n  } catch (cause) {\n    throw new Err(\"JOSE Header is not valid JSON\", { cause });\n  }\n  if (!isObject(parsed))\n    throw new Err(\"JOSE Header is not a JSON object\");\n  return [parsed, serialized];\n}\n\n// ../node_modules/.bun/jose@6.2.13/node_modules/jose/dist/webapi/lib/key.js\nvar tag = (key) => key[Symbol.toStringTag];\nvar jwkMatchesOp = (entry, key, usage) => {\n  const { alg } = entry;\n  if (key.use !== undefined) {\n    const expected = usage === \"sign\" || usage === \"verify\" ? \"sig\" : \"enc\";\n    if (key.use !== expected)\n      throw new TypeError(`Invalid key for this operation, its \"use\" must be \"${expected}\" when present`);\n  }\n  if (key.alg !== undefined && key.alg !== alg)\n    throw new TypeError(`Invalid key for this operation, its \"alg\" must be \"${alg}\" when present`);\n  if (Array.isArray(key.key_ops)) {\n    const expectedKeyOp = usage === \"encrypt\" || usage === \"decrypt\" ? entry.ops?.[usage === \"encrypt\" ? 0 : 1] : usage;\n    if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp))\n      throw new TypeError(`Invalid key for this operation, its \"key_ops\" must include \"${expectedKeyOp}\" when present`);\n  }\n};\nasync function prepareKey(entry, key, usage) {\n  const { alg, secret } = entry, requiresPrivateKey = usage === \"decrypt\" || usage === \"sign\";\n  if (secret && key instanceof Uint8Array)\n    return key;\n  let normalized, keyObject;\n  if (isObject(key)) {\n    if (normalized = normalizeJwk(key), typeof normalized.kty != \"string\")\n      throw invalidKeyType(alg, key, secret);\n    if (!(secret ? normalized.kty === \"oct\" && typeof normalized.k == \"string\" : normalized.kty !== \"oct\" && (requiresPrivateKey ? normalized.kty === \"AKP\" && typeof normalized.priv == \"string\" || typeof normalized.d == \"string\" : normalized.d === undefined && normalized.priv === undefined)))\n      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present' : `JSON Web Key for this operation must be a ${requiresPrivateKey ? \"private\" : \"public\"} JWK`);\n    if (jwkMatchesOp(entry, normalized, usage), normalized.kty === \"oct\")\n      return decode(normalized.k);\n    if (!Object.isFrozen(key)) {\n      const { key_ops } = key;\n      Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);\n    }\n  } else {\n    if (!isKeyLike(key))\n      throw invalidKeyType(alg, key, secret);\n    const expectedType = secret ? \"secret\" : requiresPrivateKey ? \"private\" : \"public\";\n    if (key.type !== expectedType && (secret || [\"secret\", \"public\", \"private\"].includes(key.type)))\n      throw new TypeError(`${tag(key)} instances must be of type \"${expectedType}\" for the ${alg} algorithm`);\n    if (isCryptoKey(key))\n      return key;\n    if (keyObject = key, keyObject.type === \"secret\")\n      return keyObject.export();\n  }\n  cache ||= /* @__PURE__ */ new WeakMap;\n  const cacheKey = key;\n  let cached = cache.get(cacheKey);\n  if (cached?.[alg])\n    return cached[alg];\n  if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == \"function\") {\n    const isPublic = keyObject.type === \"public\", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({ crv, asymmetricKeyType: keyObject.asymmetricKeyType }) ?? entry.subtle;\n    return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);\n  }\n  return normalized ??= keyObject.export({ format: \"jwk\" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);\n}\nvar cache;\nvar nist = {\n  __proto__: null,\n  prime256v1: \"P-256\",\n  secp384r1: \"P-384\",\n  secp521r1: \"P-521\"\n};\nvar isCryptoKey = (key) => {\n  if (key?.[Symbol.toStringTag] === \"CryptoKey\")\n    return true;\n  try {\n    return key instanceof CryptoKey;\n  } catch {\n    return false;\n  }\n};\nvar isKeyObject = (key) => key?.[Symbol.toStringTag] === \"KeyObject\";\nvar isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);\nfunction message(msg, actual, ...types) {\n  if (types.length > 2) {\n    const last = types.pop();\n    msg += `one of type ${types.join(\", \")}, or ${last}.`;\n  } else\n    types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;\n  return actual == null ? msg += ` Received ${actual}` : typeof actual == \"function\" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == \"object\" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;\n}\nfunction invalidKeyType(alg, actual, secret) {\n  const types = [\"CryptoKey\", \"KeyObject\", \"JSON Web Key\"];\n  return secret && types.push(\"Uint8Array\"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));\n}\nvar unusable = (name, prop = \"algorithm.name\") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);\nfunction checkUsage(key, usage) {\n  if (usage && !key.usages.includes(usage))\n    throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);\n}\nfunction checkModulusLength(alg, key) {\n  const { modulusLength } = key.algorithm;\n  if (typeof modulusLength != \"number\" || modulusLength < 2048)\n    throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);\n}\nfunction checkCryptoKey(key, expected, usage) {\n  const algorithm = key.algorithm;\n  if (algorithm.name !== expected.name)\n    throw unusable(expected.name);\n  if (expected.hash && algorithm.hash?.name !== expected.hash)\n    throw unusable(expected.hash, \"algorithm.hash\");\n  if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve)\n    throw unusable(expected.namedCurve, \"algorithm.namedCurve\");\n  if (expected.length !== undefined && algorithm.length !== expected.length)\n    throw unusable(expected.length, \"algorithm.length\");\n  checkUsage(key, usage);\n}\nfunction snapshotJwk(jwk) {\n  return { __proto__: null, ...jwk };\n}\nfunction normalizeJwk(jwk) {\n  const normalized = snapshotJwk(jwk);\n  if (normalized.ext !== undefined && typeof normalized.ext != \"boolean\")\n    throw new TypeError('\"ext\" (Extractable) Parameter must be a boolean');\n  if (normalized.key_ops !== undefined) {\n    const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : undefined;\n    if (!keyOps || keyOps.some((operation) => typeof operation != \"string\") || new Set(keyOps).size !== keyOps.length)\n      throw new TypeError('\"key_ops\" (Key Operations) Parameter must be an array of unique strings');\n    normalized.key_ops = keyOps;\n  }\n  return normalized;\n}\nasync function jwkToKey(entry, jwk, extractable) {\n  if (!entry.kty.includes(jwk.kty))\n    throw new JOSENotSupported('Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value');\n  const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = { ...jwk, ext: extractable ?? jwk.ext };\n  return keyData.kty !== \"AKP\" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey(\"jwk\", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);\n}\nasync function rawKey(key, expected, usage, extractable = false) {\n  return key instanceof Uint8Array && (key = await crypto.subtle.importKey(\"raw\", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;\n}\n\n// ../node_modules/.bun/jose@6.2.13/node_modules/jose/dist/webapi/lib/key_descriptor.js\nfunction table(entries) {\n  const out = { __proto__: null };\n  for (const alg in entries)\n    out[alg] = { ...entries[alg], alg };\n  return out;\n}\n\n// ../node_modules/.bun/jose@6.2.13/node_modules/jose/dist/webapi/lib/jws_algorithms.js\nvar sig = [[\"verify\"], [\"sign\"]];\nfunction hmac(bits) {\n  const subtle = { name: \"HMAC\", hash: `SHA-${bits}` };\n  return { kty: [\"oct\"], secret: true, subtle, signing: subtle, usages: sig };\n}\nfunction rsa(bits, saltLength) {\n  const subtle = { name: saltLength ? \"RSA-PSS\" : \"RSASSA-PKCS1-v1_5\", hash: `SHA-${bits}` };\n  return {\n    kty: [\"RSA\"],\n    subtle,\n    signing: saltLength ? { ...subtle, saltLength } : subtle,\n    usages: sig,\n    minRsaBits: 2048\n  };\n}\nfunction ecdsa(crv, bits) {\n  return {\n    kty: [\"EC\"],\n    crv,\n    subtle: { name: \"ECDSA\", namedCurve: crv },\n    signing: { name: \"ECDSA\", hash: `SHA-${bits}` },\n    usages: sig\n  };\n}\nfunction eddsa() {\n  const subtle = { name: \"Ed25519\" };\n  return {\n    kty: [\"OKP\"],\n    crv: \"Ed25519\",\n    subtle,\n    signing: subtle,\n    usages: sig\n  };\n}\nfunction mldsa(parameterSet) {\n  const subtle = { name: `ML-DSA-${parameterSet}` };\n  return {\n    kty: [\"AKP\"],\n    subtle,\n    signing: subtle,\n    usages: sig\n  };\n}\nvar JWS = table({\n  HS256: hmac(256),\n  HS384: hmac(384),\n  HS512: hmac(512),\n  RS256: rsa(256),\n  RS384: rsa(384),\n  RS512: rsa(512),\n  PS256: rsa(256, 32),\n  PS384: rsa(384, 48),\n  PS512: rsa(512, 64),\n  ES256: ecdsa(\"P-256\", 256),\n  ES384: ecdsa(\"P-384\", 384),\n  ES512: ecdsa(\"P-521\", 512),\n  EdDSA: eddsa(),\n  Ed25519: eddsa(),\n  \"ML-DSA-44\": mldsa(44),\n  \"ML-DSA-65\": mldsa(65),\n  \"ML-DSA-87\": mldsa(87)\n});\nfunction jwsAlgorithm(alg) {\n  const entry = typeof alg == \"string\" ? JWS[alg] : undefined;\n  if (!entry)\n    throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);\n  return entry;\n}\n\n// ../node_modules/.bun/jose@6.2.13/node_modules/jose/dist/webapi/lib/jws_verify.js\nfunction prepareVerify(options) {\n  return [options && validateAlgorithms(\"algorithms\", options.algorithms), options?.crit];\n}\nfunction parseProtectedHeader(encodedProtectedHeader) {\n  return encodedProtectedHeader === undefined ? {} : parseJoseHeader(encodedProtectedHeader, JWSInvalid, \"JWS Protected Header is invalid\");\n}\nfunction encodeCompactUnencodedPayload(payload) {\n  try {\n    return encode(payload);\n  } catch (cause) {\n    throw new JWSInvalid(\"JWS Compact Serialization payload must use only ASCII characters\", {\n      cause\n    });\n  }\n}\nasync function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {\n  const { protected: encodedProtectedHeader, header, payload: inputPayload } = jws, protectedHeader = parsedProtected ?? parseProtectedHeader(encodedProtectedHeader);\n  if (!isDisjoint(protectedHeader, header))\n    throw new JWSInvalid(\"JWS Protected and JWS Unprotected Header Parameter names must be disjoint\");\n  const joseHeader = { ...protectedHeader, ...header }, b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], protectedHeader, joseHeader)), { alg } = joseHeader;\n  if (typeof alg != \"string\" || !alg)\n    throw new JWSInvalid('JWS \"alg\" (Algorithm) Header Parameter missing or invalid');\n  if (shared[0] && !shared[0].has(alg))\n    throw new JOSEAlgNotAllowed('\"alg\" (Algorithm) Header Parameter value not allowed');\n  if (b64) {\n    if (typeof inputPayload != \"string\")\n      throw new JWSInvalid(\"JWS Payload must be a string\");\n  } else if (typeof inputPayload != \"string\" && !(inputPayload instanceof Uint8Array))\n    throw new JWSInvalid(\"JWS Payload must be a string or an Uint8Array instance\");\n  const signingPayload = b64 || typeof inputPayload != \"string\" ? inputPayload : encodeUnencodedPayload(inputPayload);\n  let resolvedKey = false;\n  typeof key == \"function\" && (key = await key(protectedHeader, jws), resolvedKey = true);\n  const entry = jwsAlgorithm(alg), signingInput = concat(encodedProtectedHeader !== undefined ? encode(encodedProtectedHeader) : new Uint8Array, encode(\".\"), typeof signingPayload == \"string\" ? shared[2] ??= encodeAsciiMember(signingPayload, \"payload\", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, \"signature\", JWSInvalid), verificationKey = await prepareKey(entry, key, \"verify\"), cryptoKey = await rawKey(verificationKey, entry.subtle, \"verify\");\n  entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);\n  let verified = false;\n  try {\n    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, signingInput);\n  } catch (cause) {\n    throw new JWSSignatureVerificationFailed(undefined, { cause });\n  }\n  if (!verified)\n    throw new JWSSignatureVerificationFailed;\n  const result = { payload: typeof signingPayload == \"string\" ? decodeBase64url(signingPayload, \"payload\", JWSInvalid) : signingPayload };\n  return encodedProtectedHeader !== undefined && (result.protectedHeader = protectedHeader), header !== undefined && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: verificationKey }, b64] : [result, b64];\n}\nasync function verifyCompact(jws, shared, key) {\n  if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != \"string\")\n    throw new JWSInvalid(\"Compact JWS must be a string or Uint8Array\");\n  const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(\".\");\n  if (length !== 3)\n    throw new JWSInvalid(\"Invalid Compact JWS\");\n  return verifySignature({ payload, protected: protectedHeader, signature }, shared, key, encodeCompactUnencodedPayload);\n}\n\n// ../node_modules/.bun/jose@6.2.13/node_modules/jose/dist/webapi/lib/jwt_claims_set.js\nvar epoch = (date) => Math.floor(date.getTime() / 1000);\nvar multipliers = {\n  s: 1,\n  m: 60,\n  h: 3600,\n  d: 86400,\n  w: 604800,\n  y: 31557600\n};\nvar REGEX = /^(\\+|\\-)? ?(\\d+|\\d+\\.\\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;\nvar checkFailed = \"check_failed\";\nfunction invalidDuration() {\n  throw new TypeError(\"Invalid time period format\");\n}\nfunction secs(str) {\n  typeof str != \"string\" && invalidDuration();\n  const matched = REGEX.exec(str);\n  (!matched || matched[4] && matched[1]) && invalidDuration();\n  const value = parseFloat(matched[2]), durationSeconds = Math.round(value * multipliers[matched[3][0].toLowerCase()]);\n  return Number.isFinite(durationSeconds) || invalidDuration(), matched[1] === \"-\" || matched[4] === \"ago\" ? -durationSeconds : durationSeconds;\n}\nfunction validateInput(label, input) {\n  if (!Number.isFinite(input))\n    throw new TypeError(`Invalid ${label} input`);\n  return input;\n}\nfunction validateStringClaim(claim, value) {\n  if (typeof value != \"string\")\n    throw new TypeError(`\"${claim}\" claim must be a string`);\n}\nfunction validateAudienceClaim(value) {\n  if (typeof value != \"string\" && (!Array.isArray(value) || Array.from(value).some((member) => typeof member != \"string\")))\n    throw new TypeError('\"aud\" claim must be a string or an array of strings');\n}\nfunction numericDate(value, label) {\n  return typeof value == \"number\" ? validateInput(label, value) : value instanceof Date ? validateInput(label, epoch(value)) : epoch(/* @__PURE__ */ new Date) + secs(value);\n}\nvar normalizeTyp = (value) => {\n  const normalized = value.toLowerCase();\n  return value.includes(\"/\") ? normalized : `application/${normalized}`;\n};\nvar checkAudiencePresence = (audPayload, audOption) => typeof audPayload == \"string\" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : false;\nfunction validateNumericDate(claimsSet, claim, required = false) {\n  const value = claimsSet[claim];\n  if (!(value === undefined && !required)) {\n    if (typeof value != \"number\")\n      throw new JWTClaimValidationFailed(`\"${claim}\" claim must be a number`, claimsSet, claim, \"invalid\");\n    return value;\n  }\n}\nfunction unexpectedClaim(claimsSet, claim) {\n  throw new JWTClaimValidationFailed(`unexpected \"${claim}\" claim value`, claimsSet, claim, checkFailed);\n}\nfunction validateClaimsSet(protectedHeader, claimsSetBytes, options = {}) {\n  let claimsSet;\n  try {\n    claimsSet = JSON.parse(strictDecoder.decode(claimsSetBytes));\n  } catch (cause) {\n    throw new JWTInvalid(\"JWT Claims Set must be a top-level JSON object\", { cause });\n  }\n  if (!isObject(claimsSet))\n    throw new JWTInvalid(\"JWT Claims Set must be a top-level JSON object\");\n  const { typ } = options;\n  if (typ !== undefined && (typeof protectedHeader.typ != \"string\" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))\n    throw new JWTClaimValidationFailed('unexpected \"typ\" JWT header value', claimsSet, \"typ\", checkFailed);\n  const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];\n  maxTokenAge !== undefined && presenceCheck.push(\"iat\"), audience !== undefined && presenceCheck.push(\"aud\"), subject !== undefined && presenceCheck.push(\"sub\"), issuer !== undefined && presenceCheck.push(\"iss\");\n  for (const claim of new Set(presenceCheck.reverse()))\n    if (!Object.hasOwn(claimsSet, claim))\n      throw new JWTClaimValidationFailed(`missing required \"${claim}\" claim`, claimsSet, claim, \"missing\");\n  issuer !== undefined && !(Array.isArray(issuer) ? issuer : [issuer]).includes(claimsSet.iss) && unexpectedClaim(claimsSet, \"iss\"), subject !== undefined && claimsSet.sub !== subject && unexpectedClaim(claimsSet, \"sub\"), audience !== undefined && !checkAudiencePresence(claimsSet.aud, typeof audience == \"string\" ? [audience] : audience) && unexpectedClaim(claimsSet, \"aud\");\n  const { clockTolerance } = options;\n  let tolerance = 0;\n  if (typeof clockTolerance == \"string\")\n    tolerance = secs(clockTolerance);\n  else if (clockTolerance !== undefined) {\n    if (typeof clockTolerance != \"number\")\n      throw new TypeError(\"Invalid clockTolerance option type\");\n    tolerance = clockTolerance;\n  }\n  validateInput(\"clockTolerance option\", tolerance);\n  const { currentDate } = options, now = validateInput(\"currentDate option\", epoch(currentDate === undefined ? /* @__PURE__ */ new Date : currentDate)), iat = validateNumericDate(claimsSet, \"iat\", maxTokenAge !== undefined), nbf = validateNumericDate(claimsSet, \"nbf\");\n  if (nbf !== undefined && nbf > now + tolerance)\n    throw new JWTClaimValidationFailed('\"nbf\" claim timestamp check failed', claimsSet, \"nbf\", checkFailed);\n  const exp = validateNumericDate(claimsSet, \"exp\");\n  if (exp !== undefined && exp <= now - tolerance)\n    throw new JWTExpired('\"exp\" claim timestamp check failed', claimsSet, \"exp\", checkFailed);\n  if (maxTokenAge !== undefined) {\n    const age = now - iat, max = validateInput(\"maxTokenAge option\", typeof maxTokenAge == \"number\" ? maxTokenAge : secs(maxTokenAge));\n    if (age - tolerance > max)\n      throw new JWTExpired('\"iat\" claim timestamp check failed (too far in the past)', claimsSet, \"iat\", checkFailed);\n    if (age < -tolerance)\n      throw new JWTClaimValidationFailed('\"iat\" claim timestamp check failed (it should be in the past)', claimsSet, \"iat\", checkFailed);\n  }\n  return claimsSet;\n}\nvar producerClaimsSets;\nfunction producerClaimsSet(producer) {\n  return producerClaimsSets.get(producer);\n}\nfunction jwtClaimsSetBytes(producer) {\n  const claimsSet = producerClaimsSet(producer);\n  for (const claim of [\"iat\", \"nbf\", \"exp\"]) {\n    const value = claimsSet[claim];\n    if (typeof value == \"number\" && !Number.isFinite(value))\n      throw new TypeError(`\"${claim}\" claim must be a finite number`);\n  }\n  return encoder.encode(JSON.stringify(claimsSet));\n}\nclass JWTClaimsBuilder {\n  constructor(claimsSet = {}) {\n    if (!isObject(claimsSet))\n      throw new TypeError(\"JWT Claims Set MUST be an object\");\n    (producerClaimsSets ||= /* @__PURE__ */ new WeakMap).set(this, structuredClone(claimsSet));\n  }\n  setIssuer(value) {\n    return validateStringClaim(\"iss\", value), producerClaimsSet(this).iss = value, this;\n  }\n  setSubject(value) {\n    return validateStringClaim(\"sub\", value), producerClaimsSet(this).sub = value, this;\n  }\n  setAudience(value) {\n    return validateAudienceClaim(value), producerClaimsSet(this).aud = value, this;\n  }\n  setJti(value) {\n    return validateStringClaim(\"jti\", value), producerClaimsSet(this).jti = value, this;\n  }\n  setNotBefore(value) {\n    return producerClaimsSet(this).nbf = numericDate(value, \"setNotBefore\"), this;\n  }\n  setExpirationTime(value) {\n    return producerClaimsSet(this).exp = numericDate(value, \"setExpirationTime\"), this;\n  }\n  setIssuedAt(value) {\n    const claimsSet = producerClaimsSet(this);\n    return value === undefined ? claimsSet.iat = epoch(/* @__PURE__ */ new Date) : typeof value == \"string\" ? claimsSet.iat = validateInput(\"setIssuedAt\", epoch(/* @__PURE__ */ new Date) + secs(value)) : claimsSet.iat = numericDate(value, \"setIssuedAt\"), this;\n  }\n}\n\n// ../node_modules/.bun/jose@6.2.13/node_modules/jose/dist/webapi/jwt/verify.js\nasync function jwtVerify(jwt, key, options) {\n  const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);\n  if (!b64)\n    throw new JWTInvalid(\"JWTs MUST NOT use unencoded payload\");\n  const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);\n  return { ...verified, payload };\n}\n\n// ../node_modules/.bun/jose@6.2.13/node_modules/jose/dist/webapi/lib/jws_sign.js\nasync function createSignature(input, key, rejectUnencoded) {\n  let [payload, protectedHeader, unprotectedHeader, crit] = input, encodedProtectedHeader = \"\";\n  if (protectedHeader !== undefined) {\n    const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);\n    protectedHeader = normalized[0], encodedProtectedHeader = encode2(normalized[1]);\n  }\n  if (unprotectedHeader !== undefined && (unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0]), !protectedHeader && !unprotectedHeader)\n    throw new JWSInvalid(\"either setProtectedHeader or setUnprotectedHeader must be called before #sign()\");\n  if (!isDisjoint(protectedHeader, unprotectedHeader))\n    throw new JWSInvalid(\"JWS Protected and JWS Unprotected Header Parameter names must be disjoint\");\n  const joseHeader = { ...protectedHeader, ...unprotectedHeader };\n  validateCritDuplicates(JWSInvalid, protectedHeader);\n  const b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));\n  b64 || rejectUnencoded?.();\n  const { alg } = joseHeader;\n  if (typeof alg != \"string\" || !alg)\n    throw new JWSInvalid('JWS \"alg\" (Algorithm) Header Parameter missing or invalid');\n  const entry = jwsAlgorithm(alg);\n  let encodedPayload = \"\", signingPayload = payload, signingInput;\n  if (b64) {\n    const encodedPayloadCache = input[4];\n    encodedPayloadCache ? (encodedPayload = encodedPayloadCache[0] ??= encode2(payload), signingPayload = encodedPayloadCache[1] ??= encode(encodedPayload)) : (encodedPayload = encode2(payload), signingInput = encoder.encode(`${encodedProtectedHeader}.${encodedPayload}`));\n  }\n  signingInput ??= concat(encode(encodedProtectedHeader), encode(\".\"), signingPayload);\n  const signingKey = await rawKey(await prepareKey(entry, key, \"sign\"), entry.subtle, \"sign\");\n  entry.minRsaBits && checkModulusLength(entry.alg, signingKey);\n  const jws = {\n    signature: encode2(new Uint8Array(await crypto.subtle.sign(entry.signing, signingKey, signingInput))),\n    payload: encodedPayload\n  };\n  return protectedHeader && (jws.protected = encodedProtectedHeader), unprotectedHeader && (jws.header = unprotectedHeader), [jws, b64];\n}\nasync function createCompactSignature(payload, protectedHeader, crit, key, rejectUnencoded) {\n  const [jws] = await createSignature([payload, protectedHeader, undefined, crit], key, rejectUnencoded);\n  return `${jws.protected}.${jws.payload}.${jws.signature}`;\n}\n\n// ../node_modules/.bun/jose@6.2.13/node_modules/jose/dist/webapi/jwt/sign.js\nvar SignJWT_base = JWTClaimsBuilder;\n\nclass SignJWT extends SignJWT_base {\n  #protectedHeader;\n  setProtectedHeader(protectedHeader) {\n    return assertNotSet(this.#protectedHeader, \"setProtectedHeader\"), this.#protectedHeader = protectedHeader, this;\n  }\n  async sign(key, options) {\n    return createCompactSignature(jwtClaimsSetBytes(this), this.#protectedHeader, options?.crit, key, () => {\n      throw new JWTInvalid(\"JWTs MUST NOT use unencoded payload\");\n    });\n  }\n}\n\n// dimension/paths.ts\nfunction containerName(dimensionName) {\n  return `hyb-${dimensionName}`;\n}\nvar WORKSPACE_PATH = \"/workspace\";\nvar RUN_PATH = \"/run/hyperbrane\";\nvar STATE_PATH = \"/var/lib/hyperbrane\";\nvar CA_BUNDLE_PATH = \"/etc/ssl/certs/ca-certificates.crt\";\nvar TRANSPORT_SOCKET = \".transport.sock\";\nfunction dimensionRunDirectory(dataDirectory, dimensionName) {\n  return `${dataDirectory}/dimension-run/${dimensionName}`;\n}\nfunction dimensionStateDirectory(dataDirectory, dimensionName) {\n  return `${dataDirectory}/dimension-state/${dimensionName}`;\n}\nvar dimensionLayout = {\n  containerName,\n  workspacePath: () => WORKSPACE_PATH,\n  runPath: () => RUN_PATH,\n  statePath: () => STATE_PATH,\n  caBundlePath: () => CA_BUNDLE_PATH,\n  runDirectory: dimensionRunDirectory,\n  stateDirectory: dimensionStateDirectory,\n  transportSocketPath: (dataDirectory, dimensionName) => `${dimensionRunDirectory(dataDirectory, dimensionName)}/${TRANSPORT_SOCKET}`\n};\n\n// dimension/api.ts\nvar MEMORY_UNITS = {\n  \"\": 1,\n  K: 1024,\n  M: 1024 ** 2,\n  G: 1024 ** 3,\n  T: 1024 ** 4\n};\nvar DIMENSION_NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,62}$/;\nfunction isDimensionName(name) {\n  return DIMENSION_NAME.test(name);\n}\n\n// sandbox/providers/local/localService.ts\nimport { spawn } from \"child_process\";\nimport { randomUUID } from \"crypto\";\nimport * as fs from \"fs/promises\";\nimport { connect as netConnect, Socket } from \"net\";\nimport { homedir, userInfo } from \"os\";\nimport { basename, dirname, join, resolve } from \"path\";\n\n// sandbox/api.ts\nclass SandboxNotFoundError extends Error {\n  name = \"SandboxNotFoundError\";\n}\nclass SandboxConnectionRefusedError extends Error {\n  name = \"SandboxConnectionRefusedError\";\n}\n\n// sandbox/storage/descriptors.ts\nfunction makeDescriptor(ctx, id, spec) {\n  return {\n    id,\n    kind: ctx.kind,\n    name: spec.name,\n    ...ctx.sshHost === undefined ? {} : { sshHost: ctx.sshHost },\n    ...ctx.sshUser === undefined ? {} : { sshUser: ctx.sshUser },\n    ...ctx.sshPort === undefined ? {} : { sshPort: ctx.sshPort },\n    ...spec.dataEndpointOptions === undefined ? {} : { dataEndpointOptions: spec.dataEndpointOptions }\n  };\n}\nasync function createDescriptor(ctx, storage, id, spec) {\n  const descriptor = makeDescriptor(ctx, id, spec);\n  await storage.saveDescriptor(descriptor);\n  return [{ ...ctx, id }, descriptor];\n}\nasync function openDescriptor(ctx, storage, id) {\n  return await storage.readDescriptor() ?? storage.insertDescriptor(makeDescriptor(ctx, id, { name: id }));\n}\nasync function getDescriptor(storage, where) {\n  const descriptor = await storage.readDescriptor();\n  if (!descriptor)\n    throw new Error(`${where} has no descriptor: opening it saves one`);\n  return descriptor;\n}\n\n// sandbox/data-endpoints/dataEndpoints.ts\nimport { randomBytes } from \"crypto\";\n\n// lib/sh.ts\nfunction sh(strings, ...values) {\n  if (values.length > 0)\n    throw new Error(\"sh`\\u2026` takes no interpolations: pass inputs as environment variables or arguments\");\n  return scriptText(strings.raw[0]);\n}\nfunction scriptText(raw) {\n  return raw.replace(/\\\\(\\$\\{|`)/g, \"$1\").replace(/^\\n/, \"\");\n}\n\n// sandbox/data-endpoints/dataEndpoints.ts\nvar DEFAULT_TTL_S = 12 * 3600;\nfunction signToken(secret, ttlSeconds) {\n  return new SignJWT().setProtectedHeader({ alg: \"HS256\" }).setExpirationTime(`${ttlSeconds}s`).sign(new TextEncoder().encode(secret));\n}\nasync function listeningPorts(sandbox) {\n  const listed = await sandbox.runCommand([\"sh\", \"-c\", LISTENING_PORTS]);\n  if (listed.exitCode !== 0)\n    throw new Error(`listing the ports in use failed: ${listed.stderr.trim()}`);\n  return listed.stdout.split(`\n`).filter(Boolean).map(Number);\n}\nasync function withLock(sandbox, body) {\n  const lock = `${await sandbox.homeDirectory()}/.local/state/hyperbrane/endpoints.lock`;\n  const taken = await sandbox.runCommand([\"sh\", \"-c\", TAKE_LOCK, \"sh\", lock]);\n  if (taken.exitCode !== 0)\n    throw new Error(`${lock} stayed locked: ${taken.stderr.trim()}`);\n  try {\n    return await body();\n  } finally {\n    await sandbox.runCommand([\"rm\", \"-rf\", lock]);\n  }\n}\nfunction under(base, endpoint) {\n  if (base === undefined || new URL(base).pathname === \"/\")\n    return endpoint;\n  return { ...endpoint, url: `${base.replace(/\\/+$/, \"\")}/${endpoint.name}` };\n}\nfunction createEndpoints(sandbox, storage, ports) {\n  const located = async (endpoints) => {\n    const base = (await storage.readDescriptor())?.dataEndpointOptions?.url;\n    return endpoints.map((endpoint) => under(base, endpoint));\n  };\n  async function openEndpoint(name) {\n    const [endpoint] = await located([await openStored(name)]);\n    return endpoint;\n  }\n  async function openStored(name) {\n    return withLock(sandbox, async () => {\n      const existing = await storage.readEndpoint(name);\n      if (existing)\n        return existing;\n      const { from, to } = await ports.ports();\n      const used = new Set([...(await storage.listEndpoints()).map((endpoint) => endpoint.port), ...await listeningPorts(sandbox)]);\n      let port = from;\n      while (port <= to && used.has(port))\n        port++;\n      if (port > to)\n        throw new Error(`no data endpoint ports are left in ${from}-${to}`);\n      const endpoint = { name, url: await ports.expose(port), port, secret: randomBytes(32).toString(\"base64url\") };\n      await storage.saveEndpoint(endpoint);\n      return endpoint;\n    });\n  }\n  async function closeEndpoint(name) {\n    await withLock(sandbox, async () => {\n      const endpoint = await storage.readEndpoint(name);\n      if (!endpoint)\n        return;\n      await ports.conceal(endpoint.port);\n      await storage.removeEndpoint(name);\n    });\n  }\n  async function credentials(name, {\n    ttlSeconds = DEFAULT_TTL_S\n  } = {}) {\n    const endpoint = await storage.readEndpoint(name);\n    if (!endpoint)\n      throw new SandboxNotFoundError(`there is no data endpoint ${name}`);\n    return { token: await signToken(endpoint.secret, ttlSeconds), ...await ports.credentials?.(endpoint, ttlSeconds) };\n  }\n  return {\n    openEndpoint,\n    closeEndpoint,\n    listEndpoints: async () => located(await storage.listEndpoints()),\n    credentials\n  };\n}\nvar LISTENING_PORTS = sh`\nawk 'FNR > 1 && $4 == \"0A\" { n = split($2, local, \":\"); print local[n] }' /proc/net/tcp /proc/net/tcp6 2> /dev/null | while read -r hex; do\n  printf '%d\\n' \"0x$hex\"\ndone\n`;\nvar TAKE_LOCK = sh`\nmkdir -p \"$(dirname \"$1\")\"\nwaited=0\nuntil mkdir \"$1\" 2> /dev/null; do\n  if [ -n \"$(find \"$1\" -maxdepth 0 -mmin +2 2> /dev/null)\" ]; then\n    rm -rf \"$1\"\n    continue\n  fi\n  [ \"$waited\" -lt 1200 ] || exit 1\n  sleep 0.1\n  waited=$((waited + 1))\ndone\n`;\n\n// sandbox/data-endpoints/firewalledPorts.ts\nfunction firewalledPorts(sandbox, storage) {\n  const options = async () => (await storage.readDescriptor())?.dataEndpointOptions;\n  async function firewall(rule) {\n    const result = await sandbox.runCommand([\"sudo\", \"-n\", \"ufw\", ...rule]);\n    if (result.exitCode !== 0)\n      throw new Error(`ufw ${rule.join(\" \")} failed: ${result.stderr.trim()}`);\n  }\n  return {\n    async ports() {\n      const ports = (await options())?.ports;\n      if (!ports)\n        throw new Error(\"this machine has no data endpoints: it's created with dataEndpointOptions.ports\");\n      return ports;\n    },\n    async expose(port) {\n      const found = await options();\n      if (found?.needsFirewall)\n        await firewall([\"allow\", `${port}/tcp`]);\n      const url = new URL(found?.url ?? \"http://127.0.0.1\");\n      url.port = String(port);\n      return url.toString().replace(/\\/$/, \"\");\n    },\n    async conceal(port) {\n      if ((await options())?.needsFirewall)\n        await firewall([\"delete\", \"allow\", `${port}/tcp`]);\n    }\n  };\n}\n\n// sandbox/lib/httpOverStream.ts\nimport { request as httpRequest } from \"http\";\nimport { Readable } from \"stream\";\nfunction httpOver(url, connection, { method = \"GET\", headers = {}, body, signal, timeout }) {\n  return new Promise((resolve, reject) => {\n    const target = new URL(url);\n    const request = httpRequest({ createConnection: connection, path: `${target.pathname}${target.search}`, method, headers: { host: target.host, ...headers }, signal }, (response) => {\n      const responseHeaders = new Headers;\n      for (let i = 0;i + 1 < response.rawHeaders.length; i += 2)\n        responseHeaders.append(response.rawHeaders[i], response.rawHeaders[i + 1]);\n      const status = response.statusCode ?? 502;\n      const nullBody = status === 204 || status === 304 || method === \"HEAD\";\n      if (nullBody)\n        response.resume();\n      resolve(new Response(nullBody ? null : Readable.toWeb(response), { status, headers: responseHeaders }));\n    });\n    request.once(\"error\", reject);\n    if (typeof timeout === \"number\")\n      request.setTimeout(timeout, () => request.destroy(new Error(`fetch ${url}: no data for ${timeout}ms`)));\n    request.end(body === undefined ? undefined : typeof body === \"string\" ? body : Buffer.from(body));\n  });\n}\n\n// lib/jsonDirectory.ts\nvar EXTENSION = \".json\";\nvar NAME_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,62}$/;\n\nclass InvalidNameError extends Error {\n  name = \"InvalidNameError\";\n}\nfunction checkName(name) {\n  if (!NAME_PATTERN.test(name)) {\n    throw new InvalidNameError(`Invalid name \"${name}\": use letters, digits, \"_\", \".\" and \"-\", up to 63 characters`);\n  }\n  return name;\n}\nfunction createJsonDirectory(sandbox, dir) {\n  async function pathFor(name) {\n    return `${await dir()}/${checkName(name)}${EXTENSION}`;\n  }\n  function serialize(record) {\n    return JSON.stringify(record, null, 2) + `\n`;\n  }\n  async function readPath(path) {\n    try {\n      return JSON.parse(new TextDecoder().decode(await sandbox.readFile(path)));\n    } catch (error) {\n      if (error instanceof SandboxNotFoundError)\n        return null;\n      throw error;\n    }\n  }\n  async function read(name) {\n    return readPath(await pathFor(name));\n  }\n  async function insert(name, record) {\n    const path = await pathFor(name);\n    if (await sandbox.writeFileExclusive(path, serialize(record)))\n      return record;\n    return await readPath(path) ?? insert(name, record);\n  }\n  async function save(name, record) {\n    await sandbox.writeFile(await pathFor(name), serialize(record));\n  }\n  async function remove(name) {\n    await sandbox.removeFile(await pathFor(name));\n  }\n  async function entries() {\n    const path = await dir();\n    const all = await sandbox.runCommand([\"sh\", \"-c\", LIST_SCRIPT, \"sh\", path], { env: { MISSING: String(MISSING), EXTENSION } }).catch(() => null);\n    if (all?.exitCode === MISSING)\n      return [];\n    if (all?.exitCode === 0) {\n      return all.stdout.split(RECORD_END).filter((text) => text.trim()).flatMap((text) => {\n        const newline = text.indexOf(`\n`);\n        try {\n          return [[text.slice(0, newline).slice(0, -EXTENSION.length), JSON.parse(text.slice(newline + 1))]];\n        } catch {\n          return [];\n        }\n      });\n    }\n    let files;\n    try {\n      files = await sandbox.listDirectory(path);\n    } catch (error) {\n      if (error instanceof SandboxNotFoundError)\n        return [];\n      throw error;\n    }\n    const records = await Promise.all(files.filter((file) => file.endsWith(EXTENSION)).map(async (file) => [file.slice(0, -EXTENSION.length), await readPath(`${path}/${file}`)]));\n    return records.filter((entry) => entry[1] !== null);\n  }\n  async function list() {\n    return (await entries()).map(([, record]) => record);\n  }\n  return { read, insert, save, remove, list, entries };\n}\nvar MISSING = 44;\nvar RECORD_END = `\n\\x1E\n`;\nvar LIST_SCRIPT = sh`\ncd \"$1\" 2>/dev/null || exit \"$MISSING\"\nfor file in *\"$EXTENSION\"; do\n  [ -f \"$file\" ] || continue\n  printf '%s\\n' \"$file\"\n  cat \"$file\"\n  printf '\\n\\036\\n'\ndone\n`;\n\n// sandbox/storage/sandboxStorage.ts\nvar DESCRIPTOR = \"sandbox\";\nfunction createSandboxStorage(sandbox) {\n  const stateDirectory = async () => `${await sandbox.homeDirectory()}/.local/state/hyperbrane`;\n  const endpointsDirectory = async () => `${await stateDirectory()}/endpoints`;\n  const descriptors = createJsonDirectory(sandbox, stateDirectory);\n  const endpoints = createJsonDirectory(sandbox, endpointsDirectory);\n  async function readDescriptor() {\n    return descriptors.read(DESCRIPTOR);\n  }\n  async function insertDescriptor(descriptor) {\n    return descriptors.insert(DESCRIPTOR, descriptor);\n  }\n  async function saveDescriptor(descriptor) {\n    await descriptors.save(DESCRIPTOR, descriptor);\n  }\n  async function readEndpoint(name) {\n    return endpoints.read(name);\n  }\n  async function saveEndpoint(endpoint) {\n    const directory = await endpointsDirectory();\n    const made = await sandbox.runCommand([\"sh\", \"-c\", 'mkdir -p \"$1\" && chmod 700 \"$1\"', \"sh\", directory]);\n    if (made.exitCode !== 0)\n      throw new Error(`making ${directory} private failed: ${made.stderr.trim()}`);\n    await endpoints.save(endpoint.name, endpoint);\n  }\n  async function removeEndpoint(name) {\n    await endpoints.remove(name);\n  }\n  async function listEndpoints() {\n    return endpoints.list();\n  }\n  return {\n    readDescriptor,\n    insertDescriptor,\n    saveDescriptor,\n    readEndpoint,\n    saveEndpoint,\n    removeEndpoint,\n    listEndpoints\n  };\n}\n\n// sandbox/providers/local/localService.ts\nfunction hostPath(path) {\n  return resolve(\"/\", path);\n}\nasync function notFoundAs(path, operation) {\n  try {\n    return await operation;\n  } catch (error) {\n    if (error.code === \"ENOENT\")\n      throw new SandboxNotFoundError(`Not found: \"${path}\"`);\n    throw error;\n  }\n}\nasync function writeTemp(full, data, mode = 438) {\n  await fs.mkdir(dirname(full), { recursive: true });\n  const tmp = join(dirname(full), `.${basename(full)}.${randomUUID()}.tmp`);\n  await fs.writeFile(tmp, data, { mode });\n  return tmp;\n}\nasync function readFile2(path) {\n  return new Uint8Array(await notFoundAs(path, fs.readFile(hostPath(path))));\n}\nasync function readFileRange(path, start, end) {\n  const file = await notFoundAs(path, fs.open(hostPath(path), \"r\"));\n  try {\n    const buffer = new Uint8Array(Math.max(0, end - start));\n    let filled = 0;\n    while (filled < buffer.length) {\n      const { bytesRead } = await file.read(buffer, filled, buffer.length - filled, start + filled);\n      if (bytesRead === 0)\n        break;\n      filled += bytesRead;\n    }\n    return buffer.subarray(0, filled);\n  } finally {\n    await file.close();\n  }\n}\nasync function writeFile2(path, data) {\n  const full = hostPath(path);\n  await fs.rename(await writeTemp(full, data), full);\n}\nasync function writeFileExclusive(path, data) {\n  const full = hostPath(path);\n  const tmp = await writeTemp(full, data);\n  try {\n    await fs.link(tmp, full);\n    return true;\n  } catch (error) {\n    if (error.code === \"EEXIST\")\n      return false;\n    throw error;\n  } finally {\n    await fs.unlink(tmp);\n  }\n}\nasync function removeFile(path) {\n  await fs.rm(hostPath(path), { force: true });\n}\nasync function createDirectory(path) {\n  await fs.mkdir(hostPath(path), { recursive: true });\n}\nasync function removeDirectory(path) {\n  await fs.rm(hostPath(path), { recursive: true, force: true });\n}\nasync function listDirectory(path) {\n  return notFoundAs(path, fs.readdir(hostPath(path)));\n}\nasync function stat2(path) {\n  const stats = await notFoundAs(path, fs.stat(hostPath(path)));\n  const type = stats.isFile() ? \"file\" : stats.isDirectory() ? \"directory\" : \"other\";\n  return { type, uid: stats.uid, gid: stats.gid, size: stats.size };\n}\nasync function homeDirectory() {\n  return process.env.HOME || homedir();\n}\nfunction runCommand(cmd, { cwd, env = {}, stdin } = {}) {\n  return new Promise((resolve, reject) => {\n    const [command, ...args] = cmd;\n    if (!command)\n      return reject(new Error(\"no command to run\"));\n    const child = spawn(command, args, {\n      cwd: hostPath(cwd ?? \".\"),\n      env: { ...process.env, ...env },\n      stdio: [stdin === undefined ? \"ignore\" : \"pipe\", \"pipe\", \"pipe\"]\n    });\n    const stdout = [];\n    const stderr = [];\n    child.stdout.on(\"data\", (chunk) => stdout.push(chunk));\n    child.stderr.on(\"data\", (chunk) => stderr.push(chunk));\n    child.once(\"error\", reject);\n    child.once(\"close\", (code) => resolve({ exitCode: code ?? -1, stdout: Buffer.concat(stdout).toString(), stderr: Buffer.concat(stderr).toString() }));\n    if (stdin !== undefined)\n      child.stdin.end(stdin);\n  });\n}\nasync function state() {\n  return \"running\";\n}\nasync function start() {}\nasync function destroy() {}\nfunction hasExpiration() {\n  return false;\n}\nasync function getExpiration() {\n  return null;\n}\nasync function setExpiration() {\n  return null;\n}\nfunction hasShell(ctx) {\n  return ctx.sshKey !== undefined;\n}\nasync function sshEndpoint(ctx) {\n  if (ctx.sshKey === undefined)\n    throw new Error(\"this machine has no shell: its context has no SSH key (sshKey)\");\n  return {\n    host: ctx.sshHost ?? \"127.0.0.1\",\n    port: ctx.sshPort ?? 22,\n    user: ctx.sshUser ?? userInfo().username,\n    privateKey: ctx.sshKey\n  };\n}\nasync function fetch(url, { unix, ...init } = {}) {\n  if (unix === undefined || \"Bun\" in globalThis)\n    return globalThis.fetch(url, { ...init, unix: unix === undefined ? undefined : hostPath(unix) });\n  return httpOver(url, () => netConnect(hostPath(unix)), init);\n}\nfunction connect(path) {\n  return new Promise((resolve, reject) => {\n    const socket = new Socket;\n    let markClosed;\n    const closed = new Promise((done) => markClosed = done);\n    const listeners = [];\n    socket.on(\"data\", (chunk) => {\n      for (const listener of listeners)\n        listener(new Uint8Array(chunk));\n    });\n    socket.once(\"close\", () => markClosed());\n    socket.once(\"end\", () => markClosed());\n    socket.on(\"error\", (error) => {\n      markClosed();\n      const message = `connecting to ${path} failed: ${error.message}`;\n      reject(error.code === \"ENOENT\" || error.code === \"ECONNREFUSED\" ? new SandboxConnectionRefusedError(message) : new Error(message));\n    });\n    socket.once(\"connect\", () => resolve({\n      write: (data) => void socket.write(data),\n      onData: (listener) => void listeners.push(listener),\n      closed,\n      close: () => socket.end()\n    }));\n    socket.connect({ path: hostPath(path) });\n  });\n}\nfunction createLocalService(ctx) {\n  const fileOps = {\n    readFile: readFile2,\n    readFileRange,\n    writeFile: writeFile2,\n    writeFileExclusive,\n    removeFile,\n    createDirectory,\n    removeDirectory,\n    listDirectory,\n    stat: stat2,\n    homeDirectory\n  };\n  const cmdOps = {\n    runCommand\n  };\n  const netOps = {\n    fetch,\n    connect\n  };\n  const machine = { ...fileOps, ...cmdOps, ...netOps };\n  const storage = createSandboxStorage(machine);\n  const lifecycleOps = {\n    create: (spec) => createDescriptor(ctx, storage, ctx.id ?? spec.name, spec),\n    open: () => openDescriptor(ctx, storage, ctx.id ?? \"this machine\"),\n    get: () => getDescriptor(storage, \"this machine\"),\n    state,\n    start,\n    destroy\n  };\n  const dataOps = createEndpoints(machine, storage, firewalledPorts(machine, storage));\n  const expirationOps = {\n    hasExpiration,\n    getExpiration,\n    setExpiration\n  };\n  const shellOps = {\n    hasShell: () => hasShell(ctx),\n    sshEndpoint: () => sshEndpoint(ctx)\n  };\n  return {\n    ...fileOps,\n    ...lifecycleOps,\n    ...cmdOps,\n    ...dataOps,\n    ...expirationOps,\n    ...shellOps,\n    ...netOps\n  };\n}\n\n// portal-gateway/transport-worker.ts\nvar TRANSPORT_PROTOCOL = 1;\nvar TOKEN_PARAM = \"hyb_token\";\nvar HEARTBEAT_MS = 15000;\nvar connections = new Map;\nasync function wired(dimensionName) {\n  const files = await readdir2(join2(data, \"portals\")).catch(() => []);\n  for (const file of files.filter((name) => name.endsWith(\".json\"))) {\n    const portal = await readFile3(join2(data, \"portals\", file), \"utf8\").then((text) => JSON.parse(text), () => null);\n    if (portal?.gatewayName === gateway && portal.dimensionName === dimensionName && portal.state === \"ready\")\n      return true;\n  }\n  return false;\n}\nasync function authorized(url) {\n  const token = url.searchParams.get(TOKEN_PARAM);\n  if (!token)\n    return false;\n  try {\n    await jwtVerify(token, key, { algorithms: [\"HS256\"], requiredClaims: [\"exp\"] });\n    return true;\n  } catch {\n    return false;\n  }\n}\nfunction cors(request, response) {\n  const origin = request.headers.get(\"origin\");\n  if (!origin)\n    return response;\n  response.headers.set(\"access-control-allow-origin\", origin);\n  response.headers.append(\"vary\", \"Origin\");\n  return response;\n}\nasync function preflight(request) {\n  const headers = new Headers({\n    \"access-control-allow-methods\": \"GET, POST, OPTIONS\",\n    \"access-control-max-age\": \"600\"\n  });\n  const asked = request.headers.get(\"access-control-request-headers\");\n  if (asked)\n    headers.set(\"access-control-allow-headers\", asked);\n  return cors(request, new Response(null, { status: 204, headers }));\n}\nasync function answer(handler, request, server) {\n  server.timeout(request, 0);\n  if (!await authorized(new URL(request.url)))\n    return Response.json({ error: \"a valid token is required\" }, { status: 401 });\n  try {\n    return await handler(request, server);\n  } catch (error) {\n    const { name, message } = error instanceof Error ? error : new Error(String(error));\n    return Response.json({ name, message }, { status: 500 });\n  }\n}\nfunction guarded(handler) {\n  return async (request, server) => {\n    const response = await answer(handler, request, server);\n    return response && cors(request, response);\n  };\n}\nfunction relay(connection, send, end) {\n  connection.onData(send);\n  connection.closed.then(end);\n}\nvar encoder2 = new TextEncoder;\nfunction multipartFrames() {\n  const boundary = randomBytes2(24).toString(\"hex\");\n  const part = (type, data) => Buffer.concat([encoder2.encode(`\\r\ncontent-type: ${type}\\r\n\\r\n`), data, encoder2.encode(`\\r\n--${boundary}`)]);\n  return {\n    contentType: `multipart/mixed; boundary=\"${boundary}\"`,\n    open: (id) => Buffer.concat([encoder2.encode(`--${boundary}`), part(\"application/json\", encoder2.encode(JSON.stringify({ connection: id })))]),\n    data: (chunk) => part(\"application/octet-stream\", chunk),\n    heartbeat: part(\"application/octet-stream\", new Uint8Array),\n    end: encoder2.encode(`--\\r\n`)\n  };\n}\nfunction lineFrames() {\n  const decoder = new TextDecoder;\n  let pending = \"\";\n  return {\n    contentType: \"text/event-stream\",\n    open: (id) => encoder2.encode(`event: open\ndata: ${JSON.stringify({ connection: id })}\n\n`),\n    data(chunk) {\n      const lines = (pending + decoder.decode(chunk, { stream: true })).split(`\n`);\n      pending = lines.pop();\n      return encoder2.encode(lines.map((line) => `data: ${line.replace(/\\r$/, \"\")}\n\n`).join(\"\"));\n    },\n    heartbeat: encoder2.encode(`: ping\n\n`),\n    end: encoder2.encode(`event: close\ndata: {}\n\n`)\n  };\n}\nfunction stream(connection, frames) {\n  const id = randomUUID2();\n  let heartbeat;\n  let open = true;\n  const finish = () => {\n    open = false;\n    clearInterval(heartbeat);\n    connections.delete(id);\n    connection.close();\n  };\n  connections.set(id, connection);\n  const body = new ReadableStream({\n    start(controller) {\n      const send = (bytes) => {\n        if (open && bytes.length > 0)\n          controller.enqueue(bytes);\n      };\n      send(frames.open(id));\n      heartbeat = setInterval(() => send(frames.heartbeat), HEARTBEAT_MS);\n      relay(connection, (data) => send(frames.data(data)), () => {\n        if (!open)\n          return;\n        send(frames.end);\n        finish();\n        controller.close();\n      });\n    },\n    cancel: finish\n  });\n  return new Response(body, { headers: { \"content-type\": frames.contentType, \"cache-control\": \"no-cache, no-transform\", \"x-accel-buffering\": \"no\" } });\n}\nasync function write(request) {\n  const connection = connections.get(request.params.id);\n  if (!connection)\n    return Response.json({ error: \"no such connection\" }, { status: 404 });\n  connection.write(new Uint8Array(await request.arrayBuffer()));\n  return new Response(null, { status: 204 });\n}\nasync function connect2(request, server) {\n  const params = new URL(request.url).searchParams;\n  const dimensionName = params.get(\"dimension\") ?? \"\";\n  const agentName = params.get(\"agent\");\n  if (!isDimensionName(dimensionName) || agentName !== null && !isDimensionName(agentName)) {\n    return Response.json({ error: \"dimension and agent are names\" }, { status: 400 });\n  }\n  if (!await wired(dimensionName))\n    return Response.json({ error: `dimension ${dimensionName} has no portal to gateway ${gateway}` }, { status: 403 });\n  const socket = agentName === null ? dimensionLayout.transportSocketPath(data, dimensionName) : join2(dimensionLayout.runDirectory(data, dimensionName), `${agentName}.sock`);\n  const connection = await machine.connect(socket).catch((error) => error);\n  if (connection instanceof Error)\n    return Response.json({ error: connection.message }, { status: 502 });\n  if (request.headers.get(\"upgrade\")?.toLowerCase() !== \"websocket\")\n    return stream(connection, agentName === null ? multipartFrames() : lineFrames());\n  if (server.upgrade(request, { data: connection }))\n    return;\n  connection.close();\n  return Response.json({ error: \"the websocket upgrade failed\" }, { status: 400 });\n}\nfunction serve(port) {\n  return Bun.serve({\n    port,\n    hostname: \"0.0.0.0\",\n    routes: {\n      \"/connect\": {\n        GET: guarded(connect2),\n        OPTIONS: preflight\n      },\n      \"/connect/:id\": {\n        POST: guarded(write),\n        OPTIONS: preflight\n      }\n    },\n    websocket: {\n      open(socket) {\n        relay(socket.data, (data) => socket.send(data), () => socket.close());\n      },\n      message(socket, message) {\n        socket.data.write(typeof message === \"string\" ? Buffer.from(message) : message);\n      },\n      close(socket) {\n        socket.data.close();\n      }\n    }\n  });\n}\nfunction required(name) {\n  const value = process.env[name];\n  if (!value)\n    throw new Error(`${name} is not set`);\n  return value;\n}\nprocess.umask(63);\nvar dir = required(\"HYB_TRANSPORT_DIR\");\nvar build = required(\"HYB_TRANSPORT_BUILD\");\nvar port = Number(required(\"HYB_TRANSPORT_PORT\"));\nvar gateway = required(\"HYB_GATEWAY\");\nvar data = required(\"HYB_DATA\");\nvar key = new TextEncoder().encode(await readFile3(join2(dir, \"secret\"), \"utf8\"));\nvar machine = createLocalService({ kind: \"local\" });\nvar server = serve(port);\nfor (const signal of [\"SIGTERM\", \"SIGINT\"]) {\n  process.once(signal, () => {\n    server.stop(true);\n    process.exit(0);\n  });\n}\nawait writeFile3(join2(dir, \"ready\"), `${process.pid} ${build} ${TRANSPORT_PROTOCOL}\n`);\n";

package/dist/portal-gateway/transportBundle.js

@@ -0,0 +1,4 @@
+import { join } from "node:path";
+import { scriptBundle } from "../lib/scriptBundle.js";
+export const transportEntry = () => join(import.meta.dirname, "transport-worker.ts");
+export const transportBundle = scriptBundle(transportEntry, async () => (await import("./transportBundle.generated.js")).TRANSPORT_SOURCE);

package/dist/portal-gateway/upstream.d.ts

@@ -1,137 +1,70 @@
-/**
- * An upstream: a service a gateway holds a credential for, described as data (adapted from v2's
- * UpstreamDef). SDK clients define upstreams in TypeScript with `defineUpstream`; the definition
- * is plain JSON, sent to the gateway and applied there by generic code that knows nothing about
- * any particular upstream.
- *
- * The secret never reaches a dimension. Dimensions hold fakes, shaped like the real tokens so their
- * clients accept them, and the gateway replaces them in transit. Clients sign in from dimensions as
- * they normally would: the first sign-in goes to the upstream and the gateway keeps the tokens; once
- * it holds them, it completes every later sign-in itself (see OAuthMode.tokenUrl and `answers`).
- *
- * Credentials are scoped to the gateway: one per upstream, used for every dimension with a portal
- * to it. Switching accounts means deleting the gateway's credential, so the next sign-in goes to
- * the upstream again.
- */
 export type UpstreamDefinition = {
     name: string;
-    /** At least one. The gateway swaps the fakes of every mode that has a credential. */
     modes: {
         oauth?: OAuthMode;
         apiKey?: ApiKeyMode;
+        forced?: ForcedMode;
     };
 };
+export type UpstreamForce = {
+    target?: string;
+    path?: string;
+    query?: Record<string, string>;
+    headers?: Record<string, string>;
+};
 type ModeBase = {
-    /**
-     * Requests to these hosts get the credential. Matched on host alone: v1 also matched the
-     * user-agent, and a client changing its user-agent silently stopped getting its token.
-     */
     hosts: string[];
-    /** Where the credential goes on a matching request, replacing any fake the client sent. */
     present: {
         header: string;
         scheme?: "Bearer";
     } | {
         query: string;
     };
-    /** What to force onto every matching request, whatever the client sent. */
-    force?: {
-        /** Retarget the request, e.g. "https://api.internal:8443". */
-        target?: string;
-        /** Prefix prepended to the request path, so dimensions needn't know where the API is mounted. */
-        path?: string;
-        /** Query params the client doesn't get to choose. */
-        query?: Record<string, string>;
-        /** Headers the client never sees the values of. */
-        headers?: Record<string, string>;
-    };
+    force?: UpstreamForce;
+};
+export type ForcedMode = {
+    hosts: string[];
+    force: UpstreamForce;
 };
 export type OAuthMode = ModeBase & {
-    /**
-     * The token endpoint. Until the gateway holds a credential, requests go through and the response
-     * is kept as the credential, reaching the dimension with fakes in place of the tokens. From then
-     * on the gateway answers them itself from that credential: a sign-in (whatever code it carries)
-     * and a refresh made with a fake refresh token. A client's refresh goes upstream, replayed with the
-     * real refresh token (its encoding, client id, scope, User-Agent: nothing about refreshing needs
-     * declaring); refresh tokens rotate and every dimension shares the credential, so refreshes are
-     * made one at a time and those arriving together share the result. Every client holds the same
-     * fakes, so all of them get the new tokens. A sign-in to an expired credential refreshes it first;
-     * one the gateway can't refresh (no client has refreshed yet, or upstream refuses) counts as none,
-     * and the sign-in goes to the upstream again.
-     */
     tokenUrl: string;
-    /** What the fakes look like, per token in the token response. */
     fakes: {
         access: FakeShape;
         refresh: FakeShape;
         id?: FakeShape;
     };
-    /** Other secrets the token endpoint returns, dropped before the response reaches the dimension. */
     strip?: {
         fields?: string[];
         headers?: string[];
     };
-    /**
-     * Other sign-in steps the gateway answers itself once it holds a credential, so the client's
-     * sign-in completes without a browser: e.g. the endpoint a device flow polls until approved.
-     */
     answers?: {
         url: string;
         status?: number;
         json: unknown;
     }[];
 };
-/**
- * The gateway holds any number of named keys for the upstream and gives each its own fake. A request
- * goes out with the real key its fake maps to, so a dimension can use different keys side by side
- * (one per process, per config entry, ...). A value that isn't one of the fakes is left as it is.
- */
 export type ApiKeyMode = ModeBase & {
     fake: FakeShape;
 };
-/**
- * `prefix`: the fake is the prefix plus random characters, as long as the real value (clients check
- * both; claude blanks a credentials file whose token it doesn't recognise).
- * `jwt`: the fake carries the real token's header and claims with a signature that can't verify,
- * for clients that read claims (codex decides when to refresh from `exp`). It's re-issued whenever
- * the real token changes, so its claims keep tracking the real ones.
- */
 export type FakeShape = {
     prefix: string;
 } | {
     jwt: true;
 };
-/**
- * What the gateway keeps for an upstream, in its state directory, one file per writer:
- * credentials/<upstream>.oauth.json (the gateway, as it captures and refreshes tokens) and
- * credentials/<upstream>.api-keys.json (the service).
- */
 export type OAuthCredential = {
     access: string;
     refresh?: string;
     id?: string;
-    /** Epoch ms. */
     expiresAt?: number;
     refreshExpiresAt?: number;
     scopes?: string[];
-    /** Epoch ms of the last sign-in or refresh. */
     lastRefresh: number;
-    /**
-     * Issued once and kept across refreshes and sign-ins, so every dimension's copy stays valid. A
-     * prefix fake is recognised by its value; a JWT fake by its signature, since its header and
-     * claims follow the real token's, so a stale copy still maps to the current token.
-     */
     fakes: {
         access: StoredFake;
         refresh?: StoredFake;
         id?: StoredFake;
     };
-    /** The last token response minus stripped fields; the gateway answers sign-ins and refreshes from it. */
     response: Record<string, unknown>;
-    /**
-     * The last refresh request a client made, minus its refresh token: the gateway replays it with the
-     * real one, so upstream sees the CLI's own request (User-Agent null when the client sent none).
-     */
     refreshRequest?: {
         contentType: string;
         userAgent: string | null;
@@ -144,14 +77,11 @@ export type StoredFake = {
     jwtSignature: string;
 };
 export type ApiKeyCredential = {
-    /** Key name -> key. */
     keys: Record<string, ApiKey>;
 };
-/** `fake` is issued once and kept, so a dimension's configuration stays valid when the key changes. */
 export type ApiKey = {
     key: string;
     fake: string;
 };
-/** Declares an upstream; checks the shape at compile time and returns it unchanged. */
 export declare function defineUpstream(definition: UpstreamDefinition): UpstreamDefinition;
 export {};

package/dist/portal-gateway/upstream.js

@@ -1,4 +1,3 @@
-/** Declares an upstream; checks the shape at compile time and returns it unchanged. */
 export function defineUpstream(definition) {
     return definition;
 }