pinomad 0.2.0 → 0.4.0

package/dist/chunk-837gh8nr.js

@@ -0,0 +1,138 @@
+import {
+  fromBase64Url,
+  generateKeyPair,
+  keyPairFromPrivate,
+  toBase64Url
+} from "./chunk-7gmkgyaz.js";
+
+// apps/host/src/devices.ts
+import { readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { ed25519 } from "@noble/curves/ed25519.js";
+import { defineDoc } from "@earendil-works/pi-durable";
+var DevicesDoc = defineDoc({
+  kind: "pinomad.devices",
+  version: 1,
+  scope: "session",
+  initial: () => ({ devices: [] })
+});
+async function ensureDevices(harness, context) {
+  await harness.commit(async (tx) => void await tx.doc(DevicesDoc), context);
+}
+var RevocationsDoc = defineDoc({
+  kind: "pinomad.revocations",
+  version: 1,
+  scope: "session",
+  initial: () => ({ revoked: [] })
+});
+async function admitDevice(harness, input, context) {
+  return await harness.commit(async (tx) => {
+    const devices = await tx.doc(DevicesDoc);
+    if (devices.devices.some((entry2) => entry2.publicKey === input.publicKey)) {
+      return { outcome: "registered" };
+    }
+    if (input.pair === undefined)
+      return { outcome: "refused" };
+    const offer = input.offers.consume(input.pair.secret);
+    if (offer === undefined)
+      return { outcome: "refused" };
+    const revocations = await tx.doc(RevocationsDoc);
+    if (offer.source === "account") {
+      const binding = await input.serverBinding();
+      if (revocations.revoked.includes(input.publicKey) || binding === undefined || offer.binding !== binding || !input.acceptAccountDevices()) {
+        return { outcome: "refused" };
+      }
+    }
+    const name = input.pair.name.trim().slice(0, 64) || "Unknown device";
+    const entry = { publicKey: input.publicKey, name, pairedAt: Date.now(), source: offer.source };
+    devices.devices.push(entry);
+    if (revocations.revoked.includes(input.publicKey)) {
+      revocations.revoked = revocations.revoked.filter((key) => key !== input.publicKey);
+    }
+    return { outcome: "admitted", entry };
+  }, context);
+}
+async function loadHostKey(dataDir) {
+  const path = join(dataDir, "host-key");
+  try {
+    const text = (await readFile(path, "utf8")).trim();
+    return keyPairFromPrivate(fromBase64Url(text));
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      throw error;
+    const pair = generateKeyPair();
+    try {
+      await writeFile(path, `${toBase64Url(pair.privateKey)}
+`, { flag: "wx", mode: 384 });
+    } catch (race) {
+      if (race.code !== "EEXIST")
+        throw race;
+      return loadHostKey(dataDir);
+    }
+    return pair;
+  }
+}
+async function loadRelayKey(dataDir) {
+  const path = join(dataDir, "relay-key");
+  try {
+    const secretKey = fromBase64Url((await readFile(path, "utf8")).trim());
+    if (secretKey.length !== 32)
+      throw new Error(`bad relay key in ${path}`);
+    return { secretKey, publicKey: ed25519.getPublicKey(secretKey) };
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      throw error;
+    const { secretKey, publicKey } = ed25519.keygen();
+    try {
+      await writeFile(path, `${toBase64Url(secretKey)}
+`, { flag: "wx", mode: 384 });
+    } catch (race) {
+      if (race.code !== "EEXIST")
+        throw race;
+      return loadRelayKey(dataDir);
+    }
+    return { secretKey, publicKey };
+  }
+}
+function pairingOffers(ttlMs = 5 * 60 * 1000) {
+  const live = new Map;
+  const prune = () => {
+    const now = Date.now();
+    for (const [secret, offer] of live)
+      if (offer.expiresAt <= now)
+        live.delete(secret);
+  };
+  const mint = (offer) => {
+    prune();
+    const secret = toBase64Url(randomBytes(16));
+    const expiresAt = Date.now() + ttlMs;
+    live.set(secret, { expiresAt, ...offer });
+    return { secret, expiresAt };
+  };
+  return {
+    create: (source) => mint({ source }),
+    createAccount: (binding) => mint({ source: "account", binding }),
+    consume(secret) {
+      prune();
+      const candidate = Buffer.from(secret);
+      for (const [key, offer] of live) {
+        const offerBytes = Buffer.from(key);
+        if (offerBytes.length !== candidate.length)
+          continue;
+        if (timingSafeEqual(offerBytes, candidate)) {
+          live.delete(key);
+          return offer;
+        }
+      }
+      return;
+    },
+    revokeAccount() {
+      for (const [key, offer] of live)
+        if (offer.source === "account")
+          live.delete(key);
+    }
+  };
+}
+
+export { DevicesDoc, ensureDevices, RevocationsDoc, admitDevice, loadHostKey, loadRelayKey, pairingOffers };

package/dist/{chunk-d9q0dz8s.js → chunk-akgxwg8f.js}

@@ -2,10 +2,10 @@ import {
   commandHint,
   hostEntry,
   packagedVersion
-} from "./chunk-rkfdsacq.js";
+} from "./chunk-fgx2sh7d.js";
 import {
   connectRemoteDurable
-} from "./chunk-5h97zxag.js";
+} from "./chunk-374zqx5h.js";
 import {
   DEFAULT_DATA_DIR,
   hostAddress
@@ -66,6 +66,86 @@ function installSpec(argv, inputs) {
 }
 var launchdPlistPath = (home) => join(home, "Library", "LaunchAgents", "pinomad.host.plist");
 var systemdUnitPath = (home) => join(home, ".config", "systemd", "user", "pinomad.service");
+function argValue(args, flag) {
+  let value;
+  for (let i = 0;i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === flag)
+      value = args[i + 1];
+    else if (arg.startsWith(`${flag}=`))
+      value = arg.slice(flag.length + 1);
+  }
+  return value;
+}
+function withoutRelayArgs(args) {
+  const out = [];
+  for (let i = 0;i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === "--relay") {
+      i += 1;
+      continue;
+    }
+    if (arg.startsWith("--relay="))
+      continue;
+    out.push(arg);
+  }
+  return out;
+}
+var unescapeExec = (value) => value.replace(/\\(.)/g, "$1");
+var unspecify = (value) => value.replace(/%%/g, "%").replace(/\$\$/g, "$");
+var xmlUnescape = (value) => value.replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
+function specFromProgram(program, env, home) {
+  const at = program.indexOf("--data-dir");
+  if (program.length < 4 || at < 2 || program[at + 1] === undefined) {
+    throw new Error("service definition has no --data-dir argument boundary");
+  }
+  return {
+    nodePath: program[0],
+    mainPath: program[1],
+    entryArgs: program.slice(2, at),
+    dataDir: program[at + 1],
+    hostArgs: program.slice(at + 2),
+    env: {
+      PATH: env.PATH ?? "",
+      ...env.LANG === undefined ? {} : { LANG: env.LANG },
+      ...env.LC_ALL === undefined ? {} : { LC_ALL: env.LC_ALL }
+    },
+    home
+  };
+}
+function specFromSystemdUnit(text) {
+  const exec = /^ExecStart=(.*)$/m.exec(text)?.[1];
+  if (exec === undefined)
+    throw new Error("service unit has no ExecStart");
+  const program = [...exec.matchAll(/"((?:[^"\\]|\\.)*)"/g)].map((match) => unspecify(unescapeExec(match[1])));
+  const env = {};
+  const envLine = /^Environment=(.*)$/m.exec(text)?.[1] ?? "";
+  for (const match of envLine.matchAll(/"([^"]*)"/g)) {
+    const pair = unspecify(match[1]);
+    const eq = pair.indexOf("=");
+    if (eq > 0)
+      env[pair.slice(0, eq)] = pair.slice(eq + 1);
+  }
+  const workdir = /^WorkingDirectory=(.*)$/m.exec(text)?.[1];
+  if (workdir === undefined)
+    throw new Error("service unit has no WorkingDirectory");
+  return specFromProgram(program, env, unspecify(workdir));
+}
+function specFromLaunchdPlist(text) {
+  const array = /<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/.exec(text)?.[1];
+  if (array === undefined)
+    throw new Error("plist has no ProgramArguments");
+  const program = [...array.matchAll(/<string>([\s\S]*?)<\/string>/g)].map((match) => xmlUnescape(match[1]));
+  const env = {};
+  const dict = /<key>EnvironmentVariables<\/key>\s*<dict>([\s\S]*?)<\/dict>/.exec(text)?.[1] ?? "";
+  for (const match of dict.matchAll(/<key>([\s\S]*?)<\/key>\s*<string>([\s\S]*?)<\/string>/g)) {
+    env[xmlUnescape(match[1])] = xmlUnescape(match[2]);
+  }
+  const workdir = /<key>WorkingDirectory<\/key>\s*<string>([\s\S]*?)<\/string>/.exec(text)?.[1];
+  if (workdir === undefined)
+    throw new Error("plist has no WorkingDirectory");
+  return specFromProgram(program, env, xmlUnescape(workdir));
+}
 var xmlEscape = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
 function launchdPlist(spec) {
   const program = [spec.nodePath, spec.mainPath, ...spec.entryArgs, "--data-dir", spec.dataDir, ...spec.hostArgs];
@@ -214,6 +294,10 @@ var launchd = {
     process.stdout.write(`${all.slice(-lines).join(`
 `)}
 `);
+  },
+  async read() {
+    const text = await readFile(launchdPlistPath(homedir()), "utf8").then((value) => value, (error) => error.code === "ENOENT" ? undefined : Promise.reject(error));
+    return text === undefined ? undefined : specFromLaunchdPlist(text);
   }
 };
 var systemd = {
@@ -273,6 +357,10 @@ var systemd = {
       stdio: "inherit"
     });
     await new Promise((resolve2) => journal.once("exit", () => resolve2()));
+  },
+  async read() {
+    const text = await readFile(systemdUnitPath(homedir()), "utf8").then((value) => value, (error) => error.code === "ENOENT" ? undefined : Promise.reject(error));
+    return text === undefined ? undefined : specFromSystemdUnit(text);
   }
 };
 function serviceManager(platform = process.platform) {
@@ -339,8 +427,12 @@ async function status(argv) {
     console.log(`host: unreachable (${message(error)})`);
   }
 }
-async function restartService({ force, argv }) {
-  const manager = serviceManager();
+async function restartService({
+  force,
+  argv,
+  manager = serviceManager(),
+  restart
+}) {
   if (!(await manager.state()).installed) {
     console.log(`service not installed (${commandHint("service")} install)`);
     return 1;
@@ -360,7 +452,7 @@ async function restartService({ force, argv }) {
       remote.close();
     } catch {}
   }
-  await manager.restart();
+  await (restart?.() ?? manager.restart());
   if (address === undefined) {
     console.log("restart requested (host address unknown; not polling)");
     return 0;
@@ -427,4 +519,4 @@ async function main(argv) {
 if (false)
   ;
 
-export { serviceManager, restartService, main };
+export { installSpec, argValue, withoutRelayArgs, serviceManager, restartService, main };

package/dist/chunk-b3f0ced1.js

@@ -0,0 +1,147 @@
+#!/usr/bin/env node
+import {
+  assertSecureServerOrigin,
+  probeServerAccounts,
+  runServerOperation
+} from "./chunk-5785kwej.js";
+import {
+  writeServerConfig
+} from "./chunk-302y6by9.js";
+import"./chunk-knaw1a9g.js";
+import {
+  argValue,
+  installSpec,
+  restartService,
+  serviceManager,
+  withoutRelayArgs
+} from "./chunk-akgxwg8f.js";
+import {
+  commandHint,
+  hostEntry
+} from "./chunk-fgx2sh7d.js";
+import"./chunk-374zqx5h.js";
+import"./chunk-myjp910s.js";
+import {
+  loadHostKey,
+  loadRelayKey
+} from "./chunk-837gh8nr.js";
+import {
+  relayHostId
+} from "./chunk-7gmkgyaz.js";
+import {
+  DEFAULT_DATA_DIR
+} from "./chunk-cjfmfyjb.js";
+import"./chunk-df32avw6.js";
+
+// apps/host/src/cli/join.ts
+import { mkdir } from "node:fs/promises";
+import { homedir, hostname } from "node:os";
+import { resolve } from "node:path";
+import { parseArgs } from "node:util";
+var message = (error) => error instanceof Error ? error.message : String(error);
+async function joinServer(args, deps) {
+  const origin = args.origin.replace(/\/+$/, "");
+  const dataDir = resolve(args.dataDir);
+  assertSecureServerOrigin(origin);
+  await mkdir(dataDir, { recursive: true });
+  const signingKey = await loadRelayKey(dataDir);
+  const hostKey = await loadHostKey(dataDir);
+  const hostId = relayHostId(signingKey.publicKey);
+  const manager = deps?.manager ?? serviceManager();
+  const installed = await manager.state().then((state) => state.installed, () => false);
+  const previous = installed ? await manager.read() : undefined;
+  if (previous !== undefined && resolve(previous.dataDir) !== dataDir) {
+    throw new Error(`the installed service uses a different data dir (${previous.dataDir}); ` + `join it with --data-dir ${previous.dataDir} or uninstall the service first`);
+  }
+  const probe = await probeServerAccounts(origin, deps?.fetch);
+  if (probe === "unreachable")
+    throw new Error(`cannot reach ${origin} — check the address and that the server is up`);
+  if (probe === "disabled") {
+    throw new Error(`${origin} does not run server accounts — the server is too old or was started without a data dir`);
+  }
+  const reply = await runServerOperation({
+    origin,
+    signingKey,
+    noisePublicKey: hostKey.publicKey,
+    op: "join",
+    joinToken: args.token,
+    name: args.name ?? deps?.hostname ?? hostname()
+  });
+  if (reply.t === "refused") {
+    throw new Error(reply.reason === "expired_token" ? "the join token expired — generate a fresh one" : reply.reason === "invalid_token" ? "the join token is invalid or already spent — generate a fresh one" : `the server refused the join: ${reply.reason}`);
+  }
+  if (reply.t !== "joined")
+    throw new Error(`unexpected answer to join: ${reply.t}`);
+  const username = reply.username;
+  let service;
+  try {
+    await writeServerConfig(dataDir, { origin });
+    const freshSpec = installSpec(["--data-dir", dataDir], {
+      execPath: process.execPath,
+      env: process.env,
+      home: homedir(),
+      cwd: process.cwd(),
+      mainPath: hostEntry.script,
+      entryArgs: hostEntry.args
+    });
+    if (!installed) {
+      await manager.install(freshSpec);
+      service = "installed";
+    } else {
+      const spec = previous === undefined ? freshSpec : { ...previous, hostArgs: withoutRelayArgs(previous.hostArgs) };
+      const port = argValue(spec.hostArgs, "--port");
+      const code = await restartService({
+        force: false,
+        argv: ["--data-dir", dataDir, ...port === undefined ? [] : ["--url", `ws://127.0.0.1:${port}`]],
+        manager,
+        restart: async () => {
+          await manager.install(spec);
+        }
+      });
+      service = code === 0 ? "updated" : "failed";
+    }
+  } catch (error) {
+    throw new Error(`joined ${username} at ${origin}, but local setup failed: ${message(error)}
+` + `generate a fresh join token and run the command again (re-joining the same host is safe)`);
+  }
+  return { hostId, username, origin, service };
+}
+async function main(argv) {
+  const { values, positionals } = parseArgs({
+    args: [...argv],
+    allowPositionals: true,
+    options: { "data-dir": { type: "string" }, name: { type: "string" } }
+  });
+  const [origin, token] = positionals;
+  if (origin === undefined || token === undefined) {
+    console.error(`usage: ${commandHint("join")} <server-origin> <join-token> [--data-dir DIR] [--name NAME]`);
+    process.exit(1);
+  }
+  try {
+    const outcome = await joinServer({
+      origin,
+      token,
+      dataDir: values["data-dir"] ?? DEFAULT_DATA_DIR,
+      ...values.name === undefined ? {} : { name: values.name }
+    });
+    console.log(`host id: ${outcome.hostId}`);
+    console.log(`joined ${outcome.username} at ${outcome.origin}`);
+    if (outcome.service === "installed")
+      console.log("service installed and started");
+    else if (outcome.service === "updated")
+      console.log("service definition updated; host restarted when idle");
+    else {
+      console.error("joined, but the service restart did not finish — check `service status`");
+      process.exitCode = 1;
+    }
+  } catch (error) {
+    console.error(message(error));
+    process.exitCode = 1;
+  }
+}
+if (false)
+  ;
+export {
+  main,
+  joinServer
+};

package/dist/{chunk-q26n39mf.js → chunk-d4y99pfy.js}

@@ -1,7 +1,7 @@
 import {
   connectRemoteDurable
-} from "./chunk-5h97zxag.js";
-import"./chunk-h35fermn.js";
+} from "./chunk-374zqx5h.js";
+import"./chunk-myjp910s.js";
 import {
   hostAddress
 } from "./chunk-cjfmfyjb.js";

package/dist/{chunk-rkfdsacq.js → chunk-fgx2sh7d.js}

@@ -1,6 +1,6 @@
 // apps/host/src/distribution.ts
 import { fileURLToPath } from "node:url";
-var packagedVersion = "0.2.0";
+var packagedVersion = "0.4.0";
 var webRoot = fileURLToPath(new URL(packagedVersion === undefined ? "../../web/dist" : "../web/", import.meta.url));
 var hostEntry = packagedVersion === undefined ? { script: fileURLToPath(new URL("./main.ts", import.meta.url)), args: [] } : { script: fileURLToPath(new URL("./pinomad.js", import.meta.url)), args: ["host"] };
 var commandHint = (name) => packagedVersion === undefined ? `bun run ${name}` : `pinomad ${name}`;

package/dist/chunk-knaw1a9g.js

@@ -0,0 +1,182 @@
+import {
+  RELAY_CLOSE,
+  decodeRelayToHost,
+  encodeRelayFrame,
+  relayHostId,
+  signRelayChallenge,
+  signRelayChallengeV2,
+  toBase64Url
+} from "./chunk-7gmkgyaz.js";
+
+// apps/host/src/relay-link.ts
+import { WebSocket } from "ws";
+function relayWsBase(origin) {
+  const normalized = origin.replace(/\/+$/, "");
+  if (normalized.startsWith("https://"))
+    return `wss://${normalized.slice("https://".length)}`;
+  if (normalized.startsWith("http://"))
+    return `ws://${normalized.slice("http://".length)}`;
+  throw new Error(`relay origin must be an http(s) URL: ${origin}`);
+}
+var REJECTION_REASONS = {
+  [RELAY_CLOSE.badSignature]: () => `the relay rejected this host's registration signature — a version mismatch?`,
+  [RELAY_CLOSE.hostNotAllowed]: (hostId) => `the server does not allow this host; join it to an account (\`pinomad join\`) or add --allow-host ${hostId} to the server's arguments`,
+  [RELAY_CLOSE.replaced]: () => `the relay replaced this control connection — another process registered the same hostId`
+};
+function startRelayLink(options) {
+  const origin = options.origin.replace(/\/+$/, "");
+  const wsBase = relayWsBase(origin);
+  const hostId = relayHostId(options.signingKey.publicKey);
+  const minDelay = options.reconnectDelayMs?.min ?? 1000;
+  const maxDelay = options.reconnectDelayMs?.max ?? 30000;
+  const maxPendingAccepts = options.maxPendingAccepts ?? 16;
+  let state = { status: "connecting" };
+  let stopped = false;
+  let control;
+  let delay = minDelay;
+  let retryTimer;
+  let pendingAccepts = 0;
+  function setState(next) {
+    const changed = state.status !== next.status || state.status === "rejected" && next.status === "rejected" && state.reason !== next.reason;
+    state = next;
+    if (changed)
+      options.onStateChange?.(next);
+  }
+  const watched = new Set;
+  const ponged = new WeakMap;
+  const pingIntervalMs = options.pingIntervalMs ?? 30000;
+  const pingTimer = setInterval(() => {
+    for (const socket of watched) {
+      if (socket.readyState !== WebSocket.OPEN)
+        continue;
+      if (ponged.get(socket) === true) {
+        ponged.set(socket, false);
+        socket.ping();
+      } else {
+        socket.terminate();
+      }
+    }
+  }, pingIntervalMs);
+  function watch(socket) {
+    watched.add(socket);
+    ponged.set(socket, true);
+    socket.on("pong", () => ponged.set(socket, true));
+    socket.once("close", () => watched.delete(socket));
+    socket.on("error", () => socket.terminate());
+  }
+  function connectControl() {
+    if (stopped)
+      return;
+    const socket = new WebSocket(`${wsBase}/host`, { handshakeTimeout: pingIntervalMs });
+    control = socket;
+    watch(socket);
+    socket.on("message", (data, isBinary) => onControlMessage(socket, data, isBinary));
+    socket.once("close", onControlClosed);
+  }
+  function reconnect(at) {
+    if (stopped || retryTimer !== undefined)
+      return;
+    retryTimer = setTimeout(() => {
+      retryTimer = undefined;
+      connectControl();
+    }, at);
+  }
+  function onControlMessage(socket, data, isBinary) {
+    let frame;
+    try {
+      if (isBinary)
+        throw new Error("binary control frame");
+      frame = decodeRelayToHost(data.toString());
+    } catch {
+      socket.close();
+      return;
+    }
+    switch (frame.t) {
+      case "challenge": {
+        const noisePublicKey = toBase64Url(options.noisePublicKey);
+        const challenge = { relayOrigin: origin, hostId, nonce: frame.nonce };
+        socket.send(encodeRelayFrame({
+          t: "register",
+          hostId,
+          signature: signRelayChallenge(options.signingKey.secretKey, challenge),
+          signatureV2: signRelayChallengeV2(options.signingKey.secretKey, { ...challenge, noisePublicKey }),
+          noisePublicKey,
+          ...options.accountOffer === undefined ? {} : { features: ["pairing"] }
+        }));
+        break;
+      }
+      case "registered":
+        delay = minDelay;
+        setState({ status: "registered" });
+        break;
+      case "pairing-request": {
+        const accountOffer = options.accountOffer;
+        const refused = (reason) => {
+          socket.send(encodeRelayFrame({ t: "pairing-refused", requestId: frame.requestId, reason }));
+        };
+        if (accountOffer === undefined) {
+          refused("unavailable");
+          break;
+        }
+        accountOffer().then((result) => {
+          if (socket !== control || socket.readyState !== WebSocket.OPEN)
+            return;
+          socket.send(encodeRelayFrame(result.ok ? { t: "pairing", requestId: frame.requestId, secret: result.secret, expiresAt: result.expiresAt } : { t: "pairing-refused", requestId: frame.requestId, reason: result.reason }));
+        }, () => {
+          if (socket === control && socket.readyState === WebSocket.OPEN)
+            refused("error");
+        });
+        break;
+      }
+      case "incoming": {
+        if (pendingAccepts >= maxPendingAccepts)
+          break;
+        pendingAccepts += 1;
+        const data2 = new WebSocket(`${wsBase}/accept/${frame.connId}`, { handshakeTimeout: pingIntervalMs });
+        watch(data2);
+        const release = () => {
+          pendingAccepts -= 1;
+          clearTimeout(ageOut);
+          data2.off("close", release);
+        };
+        const ageOut = setTimeout(release, 1e4);
+        data2.once("close", release);
+        options.accept(data2);
+        break;
+      }
+    }
+  }
+  function onControlClosed(code) {
+    control = undefined;
+    if (stopped)
+      return;
+    const rejection = REJECTION_REASONS[code];
+    if (rejection !== undefined) {
+      const reason = `relay ${origin}: ${rejection(hostId)} (${code})`;
+      setState({ status: "rejected", reason });
+      delay = maxDelay;
+      reconnect(maxDelay);
+      return;
+    }
+    setState({ status: "connecting" });
+    reconnect(delay);
+    delay = Math.min(maxDelay, delay * 2);
+  }
+  connectControl();
+  return {
+    hostId,
+    origin,
+    state: () => state,
+    close() {
+      stopped = true;
+      if (retryTimer !== undefined)
+        clearTimeout(retryTimer);
+      clearInterval(pingTimer);
+      for (const socket of watched)
+        socket.terminate();
+      return Promise.resolve();
+    }
+  };
+}
+
+export { relayWsBase, startRelayLink };