hyperbrane 0.1.2 → 0.2.0

package/dist/portal-gateway/portalService.d.ts

@@ -1,50 +1,8 @@
-import { type DockerClient } from "../lib/docker.ts";
-import type { ManagedImage } from "../lib/image.ts";
 import type { Sandbox } from "../sandbox/api.ts";
-import { type Portal } from "./api.ts";
-import type { GatewayStorage } from "./gatewayStorage.ts";
-import type { PortalStorage } from "./portalStorage.ts";
+import type { PortalClient } from "./api.ts";
 /** @sealed */
-export interface PortalService {
-    createPortal(portal: Portal): Promise<Portal>;
-    destroyPortal(portalName: string): Promise<void>;
-    listPortals(): Promise<Portal[]>;
-    /**
-     * Re-wires the ready portals (optionally only those of one gateway or dimension) whose containers
-     * are running and whose link is gone: a container restart takes its network namespace, and the
-     * portal's veth, with it. Portals still wired cost one look at each gateway's interfaces, so this
-     * is cheap enough to run before every command. Failures are logged per portal rather than thrown.
-     */
-    restorePortals(filter?: {
-        gatewayName?: string;
-        dimensionName?: string;
-    }): Promise<void>;
+export interface PortalService extends PortalClient {
 }
-type PortalLink = {
-    dimensionIf: string;
-    gatewayIf: string;
-    dimensionIp: string;
-    gatewayIp: string;
-    metric: number;
-};
-/**
- * Interface names come from the portal name (so a portal can always be found again) and addresses
- * from its claimed subnet. The gateway only intercepts interfaces named "hvg*".
- */
-export declare function portalLink(portalName: string, subnet: number): PortalLink;
-/** The OS trust bundle; the gateways' CAs end up in it. */
-export declare const OS_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
-/**
- * `host` is the machine the docker daemon runs on, rooted at "/" (see createGatewayService).
- * `image` is the gateway image: it carries the wiring script run by the privileged helper.
- */
-export declare function createPortalService(storage: PortalStorage, gateways: GatewayStorage, docker: DockerClient, image: ManagedImage, host: Sandbox): PortalService;
-/** @sealed */
-export interface PortalWatcher {
-    /** Restores every portal, then keeps restoring those of each hyperbrane container that starts. */
-    start(): void;
-    stop(): Promise<void>;
-}
-/** Run one per host: the portals of a container that restarts are gone until something re-wires them. */
-export declare function createPortalWatcher(portals: PortalService, docker: DockerClient): PortalWatcher;
-export {};
+export declare function createPortalService(host: Sandbox, { dataDirectory }?: {
+    dataDirectory?: string;
+}): PortalService;

package/dist/portal-gateway/portalService.js

@@ -1,359 +1,29 @@
-import { createHash } from "node:crypto";
-import { containerName as dimensionContainerName } from "../dimension/service.js";
-import { DockerError } from "../lib/docker.js";
-import { sleep } from "../lib/sleep.js";
-import { GatewayConflictError, GatewayNotFoundError } from "./api.js";
-import { assertValidName, gatewayCaCertificatePath, gatewayContainerName } from "./gatewayService.js";
-const RESTORE_RECHECK_MS = 1_000;
-/** Each portal is a point-to-point /30 out of 10.77.0.0/16. */
-const SUBNET_COUNT = 1 << 14;
-/** A dimension's default routes are ordered by subnet: its portal with the lowest one is preferred. */
-const ROUTE_METRIC_BASE = 100;
-/**
- * Interface names come from the portal name (so a portal can always be found again) and addresses
- * from its claimed subnet. The gateway only intercepts interfaces named "hvg*".
- */
-export function portalLink(portalName, subnet) {
-    const hash = createHash("sha256").update(portalName).digest("hex").slice(0, 8);
-    const base = `10.77.${subnet >> 6}`;
-    const offset = (subnet & 0x3f) << 2;
-    return {
-        dimensionIf: `hvd${hash}`,
-        gatewayIf: `hvg${hash}`,
-        gatewayIp: `${base}.${offset + 1}`,
-        dimensionIp: `${base}.${offset + 2}`,
-        metric: ROUTE_METRIC_BASE + subnet,
-    };
-}
-/** The OS trust bundle; the gateways' CAs end up in it. */
-export const OS_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
-// Run as root in the dimension: installs GATEWAY_CA as the gateway's certificate in the OS trust
-// store, or removes it when empty. Nothing but its gateways' CAs ever signs what a dimension sees
-// (every TCP connection is intercepted), so without the ca-certificates package the bundle can be
-// just those CAs. Node ignores the OS store, so while any gateway is trusted NODE_EXTRA_CA_CERTS
-// points it at the bundle, for login shells (profile.d) and PAM sessions (/etc/environment); a
-// running container's own environment can't be changed. DNS needs no setup: the gateway answers
-// UDP 53 whatever address it was sent to.
-const TRUST_GATEWAY_SCRIPT = `set -eu
-# Portals of one dimension are wired concurrently (e.g. restored together after a restart), and
-# they share the trust store and /etc/environment.
-exec 9>/run/hyperbrane-trust.lock
-flock 9
-bundle=${OS_CA_BUNDLE}
-mkdir -p /usr/local/share/ca-certificates /etc/ssl/certs /etc/profile.d
-cert="/usr/local/share/ca-certificates/hyperbrane-gateway-$GATEWAY.crt"
-if [ -n "$GATEWAY_CA" ]; then printf '%s\\n' "$GATEWAY_CA" > "$cert"; else rm -f "$cert"; fi
-if command -v update-ca-certificates >/dev/null; then
-  update-ca-certificates --fresh >/dev/null
-else
-  cat /usr/local/share/ca-certificates/hyperbrane-gateway-*.crt > "$bundle" 2>/dev/null || : > "$bundle"
-  if command -v openssl >/dev/null; then openssl rehash /etc/ssl/certs; fi
-fi
-{ grep -v '^NODE_EXTRA_CA_CERTS=' /etc/environment 2>/dev/null || true; } > /etc/environment.hyperbrane
-if ls /usr/local/share/ca-certificates/hyperbrane-gateway-*.crt >/dev/null 2>&1; then
-  echo "NODE_EXTRA_CA_CERTS=$bundle" >> /etc/environment.hyperbrane
-  echo "export NODE_EXTRA_CA_CERTS=$bundle" > /etc/profile.d/hyperbrane-gateway.sh
-else
-  rm -f /etc/profile.d/hyperbrane-gateway.sh
-fi
-mv /etc/environment.hyperbrane /etc/environment
-`;
-/**
- * `host` is the machine the docker daemon runs on, rooted at "/" (see createGatewayService).
- * `image` is the gateway image: it carries the wiring script run by the privileged helper.
- */
-export function createPortalService(storage, gateways, docker, image, host) {
-    // Re-running re-wires, so it also repairs a portal whose veth went away.
+import { createDockerClient } from "../lib/docker.js";
+import { gatewayControl } from "./control.js";
+import { assertValidName } from "./gatewayService.js";
+import { createGatewayImage } from "./image.js";
+export function createPortalService(host, { dataDirectory } = {}) {
+    const control = gatewayControl(host, () => createGatewayImage(createDockerClient(host)).ensure(), { dataDirectory });
     async function createPortal(portal) {
         assertValidName("portal", portal.name);
         assertValidName("dimension", portal.dimensionName);
         assertValidName("gateway", portal.gatewayName);
-        const gateway = await gateways.readGateway(portal.gatewayName);
-        if (gateway?.state !== "ready")
-            throw new GatewayNotFoundError(`gateway ${portal.gatewayName} is not ready`);
-        // Checked again when wiring; failing here first leaves no record behind.
-        await runningPid(gatewayContainerName(portal.gatewayName), "hyperbrane.gateway", portal.gatewayName);
-        await runningPid(dimensionContainerName(portal.dimensionName), "hyperbrane.dimension", portal.dimensionName);
-        let record = await storage.insertPortal({ ...portal, state: "creating" });
-        if (record.state === "destroying")
-            throw new GatewayConflictError(`portal ${portal.name} is being destroyed`);
-        if (record.dimensionName !== portal.dimensionName || record.gatewayName !== portal.gatewayName) {
-            throw new GatewayConflictError(`portal ${portal.name} already exists with a different spec`);
-        }
-        if (record.subnet === undefined) {
-            const subnet = await storage.claimSubnet(portal.name);
-            if (subnet >= SUBNET_COUNT) {
-                await storage.releaseSubnet(subnet);
-                throw new GatewayConflictError("no portal subnets left");
-            }
-            record = { ...record, subnet };
-            await storage.savePortal(record);
-        }
-        await connect(record);
-        if (record.state !== "ready")
-            await storage.savePortal({ ...record, state: "ready" });
-        return publicPortal(record);
-    }
-    async function connect(record, pids) {
-        const { gateway, dimension } = pids ?? (await runningPids(record));
-        await wire(record.name, portalLink(record.name, record.subnet), dimension, gateway);
-        await trustGateway(dimensionContainerName(record.dimensionName), record.gatewayName, true);
-    }
-    async function runningPids(record) {
-        return {
-            gateway: await runningPid(gatewayContainerName(record.gatewayName), "hyperbrane.gateway", record.gatewayName),
-            dimension: await runningPid(dimensionContainerName(record.dimensionName), "hyperbrane.dimension", record.dimensionName),
-        };
-    }
-    async function runningPid(name, label, owner) {
-        const kind = label.replace("hyperbrane.", "");
-        const container = await docker.inspectContainer(name);
-        if (!container || container.Config?.Labels?.[label] !== owner) {
-            throw new GatewayNotFoundError(`${kind} ${owner} does not exist`);
-        }
-        if (!container.State?.Running || !container.State.Pid) {
-            throw new GatewayConflictError(`${kind} ${owner} is not running`);
-        }
-        return container.State.Pid;
-    }
-    // Moving a veth between two containers' namespaces takes the host's view of both, so it runs in a
-    // throwaway privileged container; neither the dimension nor the gateway gets that power.
-    async function wire(portalName, link, dimensionPid, gatewayPid) {
-        const helper = `hybwire-${crypto.randomUUID().slice(0, 8)}`;
-        await docker.createContainer(helper, {
-            Image: await image.ensure(),
-            Cmd: ["sleep", "infinity"],
-            Labels: { hyperbrane: "true", "hyperbrane.helper": "wire-portal" },
-            HostConfig: {
-                NetworkMode: "host",
-                PidMode: "host",
-                Privileged: true,
-                Binds: ["/run:/hostrun"],
-                Init: true,
-            },
-        });
-        try {
-            await docker.startContainer(helper);
-            const result = await docker.exec(helper, {
-                cmd: ["hyb-wire-portal"],
-                user: "root",
-                env: {
-                    PORTAL: portalName,
-                    DIMENSION_PID: String(dimensionPid),
-                    GATEWAY_PID: String(gatewayPid),
-                    DIMENSION_IF: link.dimensionIf,
-                    GATEWAY_IF: link.gatewayIf,
-                    DIMENSION_IP: link.dimensionIp,
-                    GATEWAY_IP: link.gatewayIp,
-                    ROUTE_METRIC: String(link.metric),
-                },
-            });
-            if (result.exitCode !== 0)
-                throw new Error(`wiring portal ${portalName} failed: ${result.stderr.trim()}`);
-        }
-        finally {
-            await docker.removeContainer(helper);
-        }
+        await control.createPortal(portal);
+        return { name: portal.name, dimensionName: portal.dimensionName, gatewayName: portal.gatewayName };
     }
-    async function trustGateway(dimensionName, gatewayName, trusted) {
-        let ca = "";
-        if (trusted) {
-            const stateDirectory = await gateways.ensureStateDirectory(gatewayName);
-            ca = new TextDecoder().decode(await host.readFile(gatewayCaCertificatePath(stateDirectory))).trim();
-        }
-        const result = await docker.exec(dimensionName, {
-            cmd: ["sh", "-c", TRUST_GATEWAY_SCRIPT],
-            user: "root",
-            env: { GATEWAY: gatewayName, GATEWAY_CA: ca },
-        });
-        if (result.exitCode !== 0) {
-            throw new Error(`updating gateway ${gatewayName} trust in ${dimensionName} failed (exit ${result.exitCode}): ${result.stderr.trim()}`);
-        }
-    }
-    // Deleting the gateway end removes the pair, and the dimension's route through it.
-    // Marked first: a restore already under way re-checks the record after wiring and undoes its work,
-    // and the link is removed after the mark, so whichever runs last, the link is gone.
     async function destroyPortal(portalName) {
         assertValidName("portal", portalName);
-        const record = await storage.readPortal(portalName);
-        if (!record)
-            return;
-        if (record.state !== "destroying")
-            await storage.savePortal({ ...record, state: "destroying" });
-        // A restore under way finishes first (seeing the mark, it undoes what it wired), so nothing it
-        // does lands after this returns; one that starts from now on sees the mark and does nothing.
-        while (restoring.has(portalName))
-            await restoring.get(portalName).catch(() => { });
-        if (record.subnet !== undefined) {
-            await ignoringStopped(() => unwire(record.gatewayName, portalLink(portalName, record.subnet)));
-            await storage.releaseSubnet(record.subnet);
-        }
-        await untrustUnlessShared(record);
-        await storage.removePortal(portalName);
-    }
-    /** Takes the gateway's CA out of the dimension, unless another of its portals goes to that gateway. */
-    async function untrustUnlessShared(record) {
-        const sameGateway = (await storage.listPortals()).some((other) => other.name !== record.name &&
-            other.dimensionName === record.dimensionName &&
-            other.gatewayName === record.gatewayName);
-        if (!sameGateway) {
-            await ignoringStopped(() => trustGateway(dimensionContainerName(record.dimensionName), record.gatewayName, false));
-        }
-    }
-    async function unwire(gatewayName, link) {
-        const result = await docker.exec(gatewayContainerName(gatewayName), {
-            cmd: ["sh", "-c", `ip link del ${link.gatewayIf} 2>/dev/null || true`],
-            user: "root",
-        });
-        if (result.exitCode !== 0)
-            throw new Error(`removing ${link.gatewayIf} failed: ${result.stderr.trim()}`);
-    }
-    async function listPortals() {
-        return (await storage.listPortals()).map(publicPortal);
-    }
-    async function restorePortals({ gatewayName, dimensionName } = {}) {
-        const records = (await storage.listPortals()).filter((record) => record.state === "ready" &&
-            (gatewayName === undefined || record.gatewayName === gatewayName) &&
-            (dimensionName === undefined || record.dimensionName === dimensionName));
-        // A veth pair only ever goes as a whole, so a gateway end still there means the portal is intact.
-        const interfaces = new Map();
-        const gatewayInterfaces = (name) => {
-            if (!interfaces.has(name))
-                interfaces.set(name, listInterfaces(gatewayContainerName(name)));
-            return interfaces.get(name);
-        };
-        await Promise.all(records.map(async (record) => {
-            if ((await gatewayInterfaces(record.gatewayName))?.has(portalLink(record.name, record.subnet).gatewayIf))
-                return;
-            await restoreOnce(record);
-        }));
-    }
-    // One restore of a portal at a time, however many ask (a restart's own and the watcher's): two
-    // wiring the same link at once fail each other, and the retry could land after a destroy. Each
-    // waits for the one before rather than joining it: that one may have given up on a container that
-    // has since restarted, so once it's done the link is looked at again.
-    const restoring = new Map();
-    async function restoreOnce(record) {
-        while (restoring.has(record.name)) {
-            await restoring.get(record.name).catch(() => { });
-            const link = portalLink(record.name, record.subnet);
-            if ((await listInterfaces(gatewayContainerName(record.gatewayName)))?.has(link.gatewayIf))
-                return;
-        }
-        const restored = restore(record).finally(() => restoring.delete(record.name));
-        restoring.set(record.name, restored);
-        return restored;
+        await control.destroyPortal(portalName);
     }
-    async function restore(listed) {
-        // As it is now: one being destroyed is left alone.
-        const record = await storage.readPortal(listed.name);
-        if (record?.state !== "ready")
-            return;
-        let pids;
-        try {
-            pids = await runningPids(record);
-        }
-        catch (error) {
-            // A stopped or removed container gets wired when it starts again, or never.
-            if (error instanceof GatewayConflictError || error instanceof GatewayNotFoundError)
-                return;
-            throw error;
-        }
-        for (let attempt = 1;; attempt++) {
-            try {
-                await connect(record, pids);
-                // Destroyed meanwhile: neither the link nor the trust just made may outlive it (see destroyPortal).
-                if ((await storage.readPortal(record.name))?.state !== "ready") {
-                    await ignoringStopped(() => unwire(record.gatewayName, portalLink(record.name, record.subnet)));
-                    await untrustUnlessShared(record);
-                }
-                return;
-            }
-            catch (error) {
-                // A container that stopped or restarted meanwhile (killing what ran in it) is restored by
-                // its own start event. Docker kills a restarting container's processes before its state
-                // changes, so give it a moment before deciding it's still the same container.
-                await sleep(RESTORE_RECHECK_MS);
-                const now = await runningPids(record).catch(() => null);
-                if (now?.gateway !== pids.gateway || now?.dimension !== pids.dimension)
-                    return;
-                if (attempt === 2)
-                    return console.warn(`restoring portal ${record.name} failed:`, error);
-            }
-        }
+    async function restorePortals(filter = {}) {
+        const failed = await control.restorePortals(filter);
+        if (failed)
+            console.warn(failed);
     }
-    /** Null when the container isn't running. */
-    async function listInterfaces(container) {
-        try {
-            const result = await docker.exec(container, { cmd: ["ip", "-br", "link"] });
-            if (result.exitCode !== 0)
-                return null;
-            return new Set(result.stdout.split("\n").map((line) => line.split(/[@\s]/)[0]).filter(Boolean));
-        }
-        catch (error) {
-            if (error instanceof DockerError && (error.status === 404 || error.status === 409))
-                return null;
-            throw error;
-        }
-    }
-    return { createPortal, destroyPortal, listPortals, restorePortals };
-}
-/** Runs `action` unless its container isn't running, in which case there's nothing to undo. */
-async function ignoringStopped(action) {
-    try {
-        await action();
-    }
-    catch (error) {
-        if (!(error instanceof DockerError && (error.status === 404 || error.status === 409)))
-            throw error;
-    }
-}
-function publicPortal({ name, dimensionName, gatewayName }) {
-    return { name, dimensionName, gatewayName };
-}
-const WATCH_RETRY_MS = 1_000;
-/** Run one per host: the portals of a container that restarts are gone until something re-wires them. */
-export function createPortalWatcher(portals, docker) {
-    let controller;
-    let watching;
-    function restore(filter) {
-        portals.restorePortals(filter).catch((error) => console.warn("restoring portals failed:", error));
-    }
-    async function watch(signal) {
-        while (!signal.aborted) {
-            try {
-                const events = docker
-                    .events({ type: ["container"], event: ["start"], label: ["hyperbrane"] }, signal)[Symbol.asyncIterator]();
-                // Subscribe first, then restore: a container starting in between is covered either way.
-                let next = events.next();
-                restore();
-                for (let event = await next; !event.done; event = await next) {
-                    next = events.next();
-                    const labels = event.value.Actor?.Attributes ?? {};
-                    if (labels["hyperbrane.gateway"])
-                        restore({ gatewayName: labels["hyperbrane.gateway"] });
-                    if (labels["hyperbrane.dimension"])
-                        restore({ dimensionName: labels["hyperbrane.dimension"] });
-                }
-            }
-            catch (error) {
-                console.warn("watching docker events failed:", error);
-            }
-            if (!signal.aborted)
-                await sleep(WATCH_RETRY_MS);
-        }
-    }
-    function start() {
-        if (controller)
-            return;
-        controller = new AbortController();
-        watching = watch(controller.signal);
-    }
-    async function stop() {
-        controller?.abort();
-        await watching;
-        controller = undefined;
-        watching = undefined;
-    }
-    return { start, stop };
+    return {
+        createPortal: (portal) => createPortal(portal),
+        destroyPortal: (portalName) => destroyPortal(portalName),
+        listPortals: () => control.listPortals(),
+        restorePortals,
+    };
 }

package/dist/portal-gateway/transport-worker.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/portal-gateway/transport-worker.js

@@ -0,0 +1,205 @@
+import { randomBytes, randomUUID } from "node:crypto";
+import { readdir, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { jwtVerify } from "jose";
+import { dimensionLayout, isDimensionName } from "../dimension/api.js";
+import { createLocalService } from "../sandbox/providers/local/localService.js";
+const TRANSPORT_PROTOCOL = 1;
+const TOKEN_PARAM = "hyb_token";
+const HEARTBEAT_MS = 15_000;
+const connections = new Map();
+async function wired(dimensionName) {
+    const files = await readdir(join(data, "portals")).catch(() => []);
+    for (const file of files.filter((name) => name.endsWith(".json"))) {
+        const portal = await readFile(join(data, "portals", file), "utf8").then((text) => JSON.parse(text), () => null);
+        if (portal?.gatewayName === gateway && portal.dimensionName === dimensionName && portal.state === "ready")
+            return true;
+    }
+    return false;
+}
+async function authorized(url) {
+    const token = url.searchParams.get(TOKEN_PARAM);
+    if (!token)
+        return false;
+    try {
+        await jwtVerify(token, key, { algorithms: ["HS256"], requiredClaims: ["exp"] });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function cors(request, response) {
+    const origin = request.headers.get("origin");
+    if (!origin)
+        return response;
+    response.headers.set("access-control-allow-origin", origin);
+    response.headers.append("vary", "Origin");
+    return response;
+}
+async function preflight(request) {
+    const headers = new Headers({
+        "access-control-allow-methods": "GET, POST, OPTIONS",
+        "access-control-max-age": "600",
+    });
+    const asked = request.headers.get("access-control-request-headers");
+    if (asked)
+        headers.set("access-control-allow-headers", asked);
+    return cors(request, new Response(null, { status: 204, headers }));
+}
+async function answer(handler, request, server) {
+    server.timeout(request, 0);
+    if (!(await authorized(new URL(request.url))))
+        return Response.json({ error: "a valid token is required" }, { status: 401 });
+    try {
+        return await handler(request, server);
+    }
+    catch (error) {
+        const { name, message } = error instanceof Error ? error : new Error(String(error));
+        return Response.json({ name, message }, { status: 500 });
+    }
+}
+function guarded(handler) {
+    return async (request, server) => {
+        const response = await answer(handler, request, server);
+        return response && cors(request, response);
+    };
+}
+function relay(connection, send, end) {
+    connection.onData(send);
+    void connection.closed.then(end);
+}
+const encoder = new TextEncoder();
+function multipartFrames() {
+    const boundary = randomBytes(24).toString("hex");
+    const part = (type, data) => Buffer.concat([encoder.encode(`\r\ncontent-type: ${type}\r\n\r\n`), data, encoder.encode(`\r\n--${boundary}`)]);
+    return {
+        contentType: `multipart/mixed; boundary="${boundary}"`,
+        open: (id) => Buffer.concat([encoder.encode(`--${boundary}`), part("application/json", encoder.encode(JSON.stringify({ connection: id })))]),
+        data: (chunk) => part("application/octet-stream", chunk),
+        heartbeat: part("application/octet-stream", new Uint8Array()),
+        end: encoder.encode("--\r\n"),
+    };
+}
+function lineFrames() {
+    const decoder = new TextDecoder();
+    let pending = "";
+    return {
+        contentType: "text/event-stream",
+        open: (id) => encoder.encode(`event: open\ndata: ${JSON.stringify({ connection: id })}\n\n`),
+        data(chunk) {
+            const lines = (pending + decoder.decode(chunk, { stream: true })).split("\n");
+            pending = lines.pop();
+            return encoder.encode(lines.map((line) => `data: ${line.replace(/\r$/, "")}\n\n`).join(""));
+        },
+        heartbeat: encoder.encode(": ping\n\n"),
+        end: encoder.encode("event: close\ndata: {}\n\n"),
+    };
+}
+function stream(connection, frames) {
+    const id = randomUUID();
+    let heartbeat;
+    let open = true;
+    const finish = () => {
+        open = false;
+        clearInterval(heartbeat);
+        connections.delete(id);
+        connection.close();
+    };
+    connections.set(id, connection);
+    const body = new ReadableStream({
+        start(controller) {
+            const send = (bytes) => {
+                if (open && bytes.length > 0)
+                    controller.enqueue(bytes);
+            };
+            send(frames.open(id));
+            heartbeat = setInterval(() => send(frames.heartbeat), HEARTBEAT_MS);
+            relay(connection, (data) => send(frames.data(data)), () => {
+                if (!open)
+                    return;
+                send(frames.end);
+                finish();
+                controller.close();
+            });
+        },
+        cancel: finish,
+    });
+    return new Response(body, { headers: { "content-type": frames.contentType, "cache-control": "no-cache, no-transform", "x-accel-buffering": "no" } });
+}
+async function write(request) {
+    const connection = connections.get(request.params.id);
+    if (!connection)
+        return Response.json({ error: "no such connection" }, { status: 404 });
+    connection.write(new Uint8Array(await request.arrayBuffer()));
+    return new Response(null, { status: 204 });
+}
+async function connect(request, server) {
+    const params = new URL(request.url).searchParams;
+    const dimensionName = params.get("dimension") ?? "";
+    const agentName = params.get("agent");
+    if (!isDimensionName(dimensionName) || (agentName !== null && !isDimensionName(agentName))) {
+        return Response.json({ error: "dimension and agent are names" }, { status: 400 });
+    }
+    if (!(await wired(dimensionName)))
+        return Response.json({ error: `dimension ${dimensionName} has no portal to gateway ${gateway}` }, { status: 403 });
+    const socket = agentName === null ? dimensionLayout.transportSocketPath(data, dimensionName) : join(dimensionLayout.runDirectory(data, dimensionName), `${agentName}.sock`);
+    const connection = await machine.connect(socket).catch((error) => error);
+    if (connection instanceof Error)
+        return Response.json({ error: connection.message }, { status: 502 });
+    if (request.headers.get("upgrade")?.toLowerCase() !== "websocket")
+        return stream(connection, agentName === null ? multipartFrames() : lineFrames());
+    if (server.upgrade(request, { data: connection }))
+        return undefined;
+    connection.close();
+    return Response.json({ error: "the websocket upgrade failed" }, { status: 400 });
+}
+function serve(port) {
+    return Bun.serve({
+        port,
+        hostname: "0.0.0.0",
+        routes: {
+            "/connect": {
+                GET: guarded(connect),
+                OPTIONS: preflight,
+            },
+            "/connect/:id": {
+                POST: guarded(write),
+                OPTIONS: preflight,
+            },
+        },
+        websocket: {
+            open(socket) {
+                relay(socket.data, (data) => socket.send(data), () => socket.close());
+            },
+            message(socket, message) {
+                socket.data.write(typeof message === "string" ? Buffer.from(message) : message);
+            },
+            close(socket) {
+                socket.data.close();
+            },
+        },
+    });
+}
+function required(name) {
+    const value = process.env[name];
+    if (!value)
+        throw new Error(`${name} is not set`);
+    return value;
+}
+process.umask(0o077);
+const dir = required("HYB_TRANSPORT_DIR");
+const build = required("HYB_TRANSPORT_BUILD");
+const port = Number(required("HYB_TRANSPORT_PORT"));
+const gateway = required("HYB_GATEWAY");
+const data = required("HYB_DATA");
+const key = new TextEncoder().encode(await readFile(join(dir, "secret"), "utf8"));
+const machine = createLocalService({ kind: "local" });
+const server = serve(port);
+for (const signal of ["SIGTERM", "SIGINT"]) {
+    process.once(signal, () => {
+        server.stop(true);
+        process.exit(0);
+    });
+}
+await writeFile(join(dir, "ready"), `${process.pid} ${build} ${TRANSPORT_PROTOCOL}\n`);

package/dist/portal-gateway/transportBundle.d.ts

@@ -0,0 +1,2 @@
+export declare const transportEntry: () => string;
+export declare const transportBundle: () => Promise<import("../lib/scriptBundle.ts").ScriptBundle>;

package/dist/portal-gateway/transportBundle.generated.d.ts

@@ -0,0 +1 @@
+export declare const TRANSPORT_SOURCE: string;