linkshell-cli 0.9.0 → 0.10.0

package/dist/gateway/src/accounts.d.ts

@@ -0,0 +1,6 @@
+export interface Account {
+    userId: string;
+    email?: string;
+}
+export type VerifyToken = (token: string) => Promise<Account | undefined>;
+export declare function supabaseVerifier(url: string, anonKey: string): VerifyToken;

package/dist/gateway/src/accounts.js

@@ -0,0 +1,32 @@
+// Account tokens (Supabase JWTs from the iTool login). The gateway only needs
+// to know whose token it is; it never sees passwords.
+export function supabaseVerifier(url, anonKey) {
+    const cache = new Map();
+    return async (token) => {
+        const hit = cache.get(token);
+        if (hit && hit.until > Date.now())
+            return hit.account;
+        try {
+            const response = await fetch(`${url}/auth/v1/user`, {
+                headers: { Authorization: `Bearer ${token}`, apikey: anonKey },
+                signal: AbortSignal.timeout(5000),
+            });
+            if (!response.ok)
+                return undefined;
+            const user = (await response.json());
+            if (!user.id)
+                return undefined;
+            const account = { userId: user.id, email: user.email };
+            cache.set(token, { account, until: Date.now() + 60_000 });
+            if (cache.size > 5000)
+                for (const [key, value] of cache)
+                    if (value.until < Date.now())
+                        cache.delete(key);
+            return account;
+        }
+        catch {
+            return undefined;
+        }
+    };
+}
+//# sourceMappingURL=accounts.js.map

package/dist/gateway/src/accounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../../../../gateway/src/accounts.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,sDAAsD;AAStD,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,OAAe;IAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,EAA+C,CAAC;IACrE,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,eAAe,EAAE;gBAClD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;gBAC9D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;aAClC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,SAAS,CAAC;YACnC,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAoC,CAAC;YACxE,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,SAAS,CAAC;YAC/B,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YACvD,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YAC1D,IAAI,KAAK,CAAC,IAAI,GAAG,IAAI;gBAAE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK;oBAAE,IAAI,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;wBAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzG,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/gateway/src/index.d.ts

@@ -0,0 +1,4 @@
+export { Gateway, type GatewayOptions } from "./relay.js";
+export { GatewayStore } from "./store.js";
+export { supabaseVerifier, type Account, type VerifyToken } from "./accounts.js";
+export { startGateway, type RunningGateway, type StartGatewayOptions } from "./serve.js";

package/dist/gateway/src/index.js

@@ -0,0 +1,5 @@
+export { Gateway } from "./relay.js";
+export { GatewayStore } from "./store.js";
+export { supabaseVerifier } from "./accounts.js";
+export { startGateway } from "./serve.js";
+//# sourceMappingURL=index.js.map

package/dist/gateway/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../gateway/src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAuB,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAkC,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,YAAY,EAAiD,MAAM,YAAY,CAAC"}

package/dist/gateway/src/main.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gateway/src/main.js

@@ -0,0 +1,57 @@
+import { supabaseVerifier } from "./accounts.js";
+import { packageVersion, startGateway } from "./serve.js";
+import { requirePro, supabaseSubscriptions } from "./subscription.js";
+// The gateway as a process (the Docker image runs this), configured by environment:
+//   PORT                          listen port (8787)
+//   RELAY_DATA_PATH               SQLite file with pairings and keys (./data/relay.db); keep it on a volume
+//   SUPABASE_URL + SUPABASE_ANON_KEY   turn accounts on
+//   AUTH_REQUIRED=true            computers need an active Pro account (with SUPABASE_SERVICE_ROLE_KEY)
+//   TRUSTED_PROXIES               comma-separated proxy addresses whose X-Forwarded-For is believed
+//   WS_CONNECT_RATE_LIMIT_MAX / WS_CONNECT_RATE_LIMIT_WINDOW_MS   connections per address (20 per 60000 ms)
+//   LOG_LEVEL                     debug | info | warn | error (info)
+const LOG_LEVELS = { debug: 0, info: 1, warn: 2, error: 3 };
+const logLevel = (process.env.LOG_LEVEL ?? "info");
+function log(level, message) {
+    if (LOG_LEVELS[level] >= LOG_LEVELS[logLevel])
+        process.stdout.write(`[gateway:${level}] ${message}\n`);
+}
+const port = Number(process.env.PORT ?? 8787);
+const databasePath = process.env.RELAY_DATA_PATH ?? "./data/relay.db";
+const supabase = {
+    url: process.env.SUPABASE_URL ?? "",
+    anonKey: process.env.SUPABASE_ANON_KEY ?? "",
+    serviceRoleKey: process.env.SUPABASE_SERVICE_ROLE_KEY ?? "",
+};
+const version = packageVersion();
+const gateway = await startGateway({
+    port,
+    databasePath,
+    version,
+    log: (message) => log("info", `[relay] ${message}`),
+    verifyToken: supabase.url && supabase.anonKey ? supabaseVerifier(supabase.url, supabase.anonKey) : undefined,
+    admit: process.env.AUTH_REQUIRED === "true"
+        ? requirePro(supabaseSubscriptions(supabase), (message) => log("warn", `[relay] ${message}`))
+        : undefined,
+    trustedProxies: (process.env.TRUSTED_PROXIES ?? "").split(","),
+    wsConnectLimit: {
+        max: Number(process.env.WS_CONNECT_RATE_LIMIT_MAX ?? 20),
+        windowMs: Number(process.env.WS_CONNECT_RATE_LIMIT_WINDOW_MS ?? 60_000),
+    },
+});
+log("info", `LinkShell Gateway v${version}`);
+log("info", `listening on http://0.0.0.0:${gateway.port}`);
+// Said at every start: coming up on an empty file is how every phone gets unpaired.
+log("info", `pairings and keys in ${databasePath}`);
+log("info", `log level: ${logLevel}`);
+function shutdown() {
+    process.stdout.write("[gateway] shutting down...\n");
+    void gateway.close().then(() => {
+        process.stdout.write("[gateway] stopped\n");
+        process.exit(0);
+    });
+    // Connections that won't close don't get to hold the process.
+    setTimeout(() => process.exit(1), 5000).unref();
+}
+process.on("SIGINT", shutdown);
+process.on("SIGTERM", shutdown);
+//# sourceMappingURL=main.js.map

package/dist/gateway/src/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../../../gateway/src/main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAEtE,oFAAoF;AACpF,qDAAqD;AACrD,4GAA4G;AAC5G,wDAAwD;AACxD,wGAAwG;AACxG,oGAAoG;AACpG,4GAA4G;AAC5G,qEAAqE;AAErE,MAAM,UAAU,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAE5D,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM,CAAa,CAAC;AAE/D,SAAS,GAAG,CAAC,KAAe,EAAE,OAAe;IAC3C,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,KAAK,OAAO,IAAI,CAAC,CAAC;AACzG,CAAC;AAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;AAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,iBAAiB,CAAC;AACtE,MAAM,QAAQ,GAAG;IACf,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE;IACnC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE;IAC5C,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,EAAE;CAC5D,CAAC;AACF,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;AAEjC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC;IACjC,IAAI;IACJ,YAAY;IACZ,OAAO;IACP,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,OAAO,EAAE,CAAC;IACnD,WAAW,EAAE,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;IAC5G,KAAK,EACH,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM;QAClC,CAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,OAAO,EAAE,CAAC,CAAC;QAC7F,CAAC,CAAC,SAAS;IACf,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;IAC9D,cAAc,EAAE;QACd,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,EAAE,CAAC;QACxD,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,MAAM,CAAC;KACxE;CACF,CAAC,CAAC;AAEH,GAAG,CAAC,MAAM,EAAE,sBAAsB,OAAO,EAAE,CAAC,CAAC;AAC7C,GAAG,CAAC,MAAM,EAAE,+BAA+B,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3D,oFAAoF;AACpF,GAAG,CAAC,MAAM,EAAE,wBAAwB,YAAY,EAAE,CAAC,CAAC;AACpD,GAAG,CAAC,MAAM,EAAE,cAAc,QAAQ,EAAE,CAAC,CAAC;AAEtC,SAAS,QAAQ;IACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACrD,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,8DAA8D;IAC9D,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;AAClD,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC"}

package/dist/gateway/src/rate-limit.d.ts

@@ -0,0 +1,22 @@
+import type { IncomingMessage } from "node:http";
+/** Counts hits per key in fixed windows; over `maxHits` in one window is refused. */
+export declare class RateLimiter {
+    private readonly maxHits;
+    private readonly windowMs;
+    private readonly hits;
+    private readonly pruneTimer;
+    constructor(maxHits: number, windowMs: number);
+    allow(key: string): boolean;
+    private prune;
+    destroy(): void;
+}
+/** A host or a test on this machine: never rate limited. */
+export declare function isLoopback(ip: string): boolean;
+/** The reverse proxies in front of this gateway, from a list of their addresses. */
+export declare function trustedProxySet(addresses: readonly string[]): Set<string>;
+/**
+ * Who is connecting. X-Forwarded-For is believed only when the direct peer is
+ * one of `trustedProxies`: from anyone else the header is the caller's own
+ * claim, and believing it would let them pick their rate-limit key.
+ */
+export declare function clientIp(request: IncomingMessage, trustedProxies: ReadonlySet<string>): string;

package/dist/gateway/src/rate-limit.js

@@ -0,0 +1,66 @@
+/** Counts hits per key in fixed windows; over `maxHits` in one window is refused. */
+export class RateLimiter {
+    maxHits;
+    windowMs;
+    hits = new Map();
+    pruneTimer;
+    constructor(maxHits, windowMs) {
+        this.maxHits = maxHits;
+        this.windowMs = windowMs;
+        // Finished windows are dropped, so the map holds only keys seen lately.
+        this.pruneTimer = setInterval(() => this.prune(), Math.max(windowMs, 60_000));
+        this.pruneTimer.unref();
+    }
+    allow(key) {
+        const now = Date.now();
+        const entry = this.hits.get(key);
+        if (!entry || now >= entry.resetAt) {
+            this.hits.set(key, { count: 1, resetAt: now + this.windowMs });
+            return true;
+        }
+        entry.count++;
+        return entry.count <= this.maxHits;
+    }
+    prune() {
+        const now = Date.now();
+        for (const [key, entry] of this.hits) {
+            if (now >= entry.resetAt)
+                this.hits.delete(key);
+        }
+    }
+    destroy() {
+        clearInterval(this.pruneTimer);
+    }
+}
+/** A host or a test on this machine: never rate limited. */
+export function isLoopback(ip) {
+    const normalized = ip.trim().toLowerCase();
+    return normalized === "127.0.0.1" || normalized === "::1" || normalized === "::ffff:127.0.0.1";
+}
+/** IPv4 addresses arrive IPv6-mapped (::ffff:1.2.3.4) on a dual-stack socket. */
+function normalizeIp(ip) {
+    const trimmed = ip.trim().toLowerCase();
+    return trimmed.startsWith("::ffff:") ? trimmed.slice(7) : trimmed;
+}
+/** The reverse proxies in front of this gateway, from a list of their addresses. */
+export function trustedProxySet(addresses) {
+    return new Set(addresses.map(normalizeIp).filter(Boolean));
+}
+/**
+ * Who is connecting. X-Forwarded-For is believed only when the direct peer is
+ * one of `trustedProxies`: from anyone else the header is the caller's own
+ * claim, and believing it would let them pick their rate-limit key.
+ */
+export function clientIp(request, trustedProxies) {
+    const peer = request.socket.remoteAddress ?? "unknown";
+    if (trustedProxies.has(normalizeIp(peer))) {
+        const forwarded = request.headers["x-forwarded-for"];
+        if (typeof forwarded === "string") {
+            const first = forwarded.split(",")[0]?.trim();
+            if (first)
+                return first;
+        }
+    }
+    return peer;
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/gateway/src/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../../gateway/src/rate-limit.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,MAAM,OAAO,WAAW;IAKH;IACA;IALF,IAAI,GAAG,IAAI,GAAG,EAA8C,CAAC;IAC7D,UAAU,CAAiC;IAE5D,YACmB,OAAe,EACf,QAAgB;QADhB,YAAO,GAAP,OAAO,CAAQ;QACf,aAAQ,GAAR,QAAQ,CAAQ;QAEjC,wEAAwE;QACxE,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,GAAW;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC;IACrC,CAAC;IAEO,KAAK;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,OAAO;QACL,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;CACF;AAED,4DAA4D;AAC5D,MAAM,UAAU,UAAU,CAAC,EAAU;IACnC,MAAM,UAAU,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,kBAAkB,CAAC;AACjG,CAAC;AAED,iFAAiF;AACjF,SAAS,WAAW,CAAC,EAAU;IAC7B,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACpE,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,SAA4B;IAC1D,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAwB,EAAE,cAAmC;IACpF,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;IACvD,IAAI,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACrD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YAC9C,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/gateway/src/relay.d.ts

@@ -0,0 +1,84 @@
+import { type IncomingMessage } from "node:http";
+import type { Duplex } from "node:stream";
+import { type PeerRole } from "@linkshell/wire";
+import type { VerifyToken } from "./accounts.js";
+import { GatewayStore } from "./store.js";
+export interface GatewayOptions {
+    port: number;
+    host?: string;
+    databasePath: string;
+    /** Validates account tokens; without it, accounts are off and only pairing works. */
+    verifyToken?: VerifyToken;
+    log?: (message: string) => void;
+    /** Called with every frame the gateway routes, for tests that check it only sees ciphertext. */
+    onRouted?: (frame: string) => void;
+    pairingTtlMs?: number;
+    heartbeatMs?: number;
+    /**
+     * Final say on a connecting peer, after its key (and token, if any) checked
+     * out: return a message to refuse it. The official gateway uses this to
+     * require a subscription for computers.
+     */
+    admit?: (peer: {
+        role: PeerRole;
+        userId?: string;
+    }) => Promise<string | undefined>;
+    /**
+     * How much may wait to be written to one peer before the gateway stops
+     * reading from whoever is sending to it (default 4 MB), and how long a peer
+     * may stay that far behind before it is dropped (default 60 s).
+     */
+    maxBufferedBytes?: number;
+    stalledPeerMs?: number;
+}
+/**
+ * Gateway v2: authenticates peers by key, routes their end-to-end encrypted
+ * frames to peers they may reach (paired, or same account), and brokers
+ * pairing. It has no way to read what it routes.
+ */
+export declare class Gateway {
+    private readonly options;
+    readonly store: GatewayStore;
+    private server?;
+    private readonly peers;
+    private readonly offers;
+    private readonly decisions;
+    private readonly claimTimes;
+    private heartbeat?;
+    /** Sockets that answered the last ping. */
+    private readonly alive;
+    private stopped;
+    private readonly log;
+    constructor(options: GatewayOptions);
+    private readonly wss;
+    /** Runs on its own port. */
+    start(): Promise<number>;
+    /**
+     * Runs inside another HTTP server, which passes it upgrades for
+     * `RELAY_PATH` through `handleUpgrade`.
+     */
+    attach(): void;
+    handleUpgrade(request: IncomingMessage, socket: Duplex, head: Buffer): void;
+    get connected(): number;
+    /** Bytes accepted from senders and not yet written to their receivers. */
+    get bufferedBytes(): number;
+    /** Drops connections that didn't answer the previous ping, pings the rest. */
+    private sweep;
+    stop(): Promise<void>;
+    private accept;
+    private authenticate;
+    private route;
+    /**
+     * Backpressure. What a peer can't take yet would otherwise pile up here, in
+     * memory every user of this gateway shares: stop reading the sender instead,
+     * so the data waits on its side until the receiver catches up.
+     */
+    private holdWhileBehind;
+    private event;
+    /** Tells everyone who can reach `record` that it came or went. */
+    private announce;
+    private machineEntry;
+    private deviceEntry;
+    private handle;
+    private claim;
+}