termdock 1.4.174 → 1.4.175

package/dist/server/federation/passwordLoginRoutes.js

@@ -0,0 +1,98 @@
+import express from 'express';
+import { PasswordBootstrapServer } from './passwordBootstrap.js';
+import { getLoginBlockMs, getPasswordVerifier, recordLoginFailure, recordLoginSuccess } from '../utils/authProtection.js';
+import { getPublicOrigin } from '../utils/publicSecurity.js';
+import { bootstrapCors } from './bootstrapCors.js';
+export function createPasswordLoginRouter(getRuntime) {
+    const router = express.Router();
+    let bootstrap;
+    let runtime;
+    let computing = 0;
+    const starts = [];
+    const pending = new Map();
+    router.use(bootstrapCors);
+    router.use((_req, res, next) => {
+        const ready = getRuntime();
+        if (!ready) {
+            res.status(503).json({ error: 'Encrypted login is starting' });
+            return;
+        }
+        if (ready !== runtime) {
+            runtime = ready;
+            bootstrap = new PasswordBootstrapServer({ getPasswordHash: getPasswordVerifier, serverIdentity: ready.serviceId });
+            pending.clear();
+        }
+        res.setHeader('Cache-Control', 'no-store');
+        next();
+    });
+    router.get('/parameters', (_req, res) => {
+        try {
+            res.json(bootstrap.parameters());
+        }
+        catch {
+            res.status(503).json({ error: 'Password login unavailable' });
+        }
+    });
+    router.use(express.json({ limit: '8kb' }));
+    router.post('/start', async (req, res) => {
+        const ip = req.socket.remoteAddress ?? 'unknown';
+        const now = Date.now();
+        while (starts.length && starts[0] <= now - 60_000)
+            starts.shift();
+        for (const [id, entry] of pending)
+            if (entry.expiresAt <= now)
+                pending.delete(id);
+        if (getLoginBlockMs(ip) > 0 || starts.length >= 30 || computing >= 2) {
+            res.status(429).json({ error: 'Too many login attempts' });
+            return;
+        }
+        if (typeof req.body?.clientIdentity !== 'string' || typeof req.body?.startLoginRequest !== 'string' ||
+            Object.keys(req.body).some(key => !['clientIdentity', 'startLoginRequest'].includes(key))) {
+            res.status(400).json({ error: 'Invalid login request' });
+            return;
+        }
+        const origin = req.headers.origin ?? getPublicOrigin() ?? `${req.protocol}://${req.headers.host}`;
+        starts.push(now);
+        computing++;
+        recordLoginFailure(ip);
+        try {
+            const result = await bootstrap.start({ ...req.body, origin });
+            pending.set(result.attemptId, { ip, origin, expiresAt: Date.now() + 60_000 });
+            res.json(result);
+        }
+        catch {
+            res.status(401).json({ error: 'Password authentication failed' });
+        }
+        finally {
+            computing--;
+        }
+    });
+    router.post('/finish', async (req, res) => {
+        const ip = req.socket.remoteAddress ?? 'unknown';
+        const origin = req.headers.origin ?? getPublicOrigin() ?? `${req.protocol}://${req.headers.host}`;
+        if (typeof req.body?.attemptId !== 'string' || typeof req.body?.finishLoginRequest !== 'string' ||
+            Object.keys(req.body).some(key => !['attemptId', 'finishLoginRequest'].includes(key))) {
+            res.status(400).json({ error: 'Invalid login request' });
+            return;
+        }
+        const entry = pending.get(req.body.attemptId);
+        if (!entry || entry.ip !== ip || entry.origin !== origin || entry.expiresAt <= Date.now()) {
+            res.status(401).json({ error: 'Password authentication failed' });
+            return;
+        }
+        pending.delete(req.body.attemptId);
+        try {
+            const credential = getPasswordVerifier();
+            const result = await bootstrap.finish(req.body);
+            if (!credential || credential !== getPasswordVerifier())
+                throw new Error('Password changed');
+            runtime.store.grantPassword(result.clientIdentity);
+            recordLoginSuccess(ip);
+            res.json({ ok: true });
+        }
+        catch {
+            res.status(401).json({ error: 'Password authentication failed' });
+        }
+    });
+    return router;
+}

package/dist/server/federation/relay.js

@@ -0,0 +1,346 @@
+import { randomUUID } from 'node:crypto';
+import { EventEmitter } from 'node:events';
+const defaults = { maxFrameBytes: 256 * 1024, maxBufferedBytes: 1024 * 1024,
+    maxStreams: 128, heartbeatMs: 30_000, maxRouteTtlMs: 90_000, connectTimeoutMs: 10_000 };
+const identifier = (v) => typeof v === 'string' && /^[a-zA-Z0-9_.:-]{1,160}$/.test(v);
+function parse(raw, limits) {
+    if (Buffer.byteLength(raw instanceof Array ? Buffer.concat(raw) : raw) > limits.maxFrameBytes)
+        throw new Error('Frame exceeds budget');
+    const f = JSON.parse(raw.toString());
+    if (f.type === 'register') {
+        if (!Array.isArray(f.serviceIds) || f.serviceIds.length > 64 || !f.serviceIds.every(identifier)
+            || !Number.isFinite(f.ttlMs) || f.ttlMs <= 0)
+            throw new Error('Invalid registration');
+    }
+    else if (!identifier(f.streamId) || !['open', 'opened', 'data', 'close'].includes(f.type)
+        || (f.type === 'open' && !identifier(f.serviceId))
+        || (f.type === 'data' && (typeof f.payload !== 'string' || (f.encoding !== undefined && f.encoding !== 'base64'))))
+        throw new Error('Invalid frame');
+    return f;
+}
+function send(ws, frame, limits) {
+    const data = JSON.stringify(frame);
+    if (ws.readyState !== 1)
+        return false;
+    if (Buffer.byteLength(data) > limits.maxFrameBytes || ws.bufferedAmount + Buffer.byteLength(data) > limits.maxBufferedBytes) {
+        ws.close(1013, 'Relay budget exceeded');
+        return false;
+    }
+    ws.send(data);
+    return true;
+}
+function watch(ws, limits, cleanup) {
+    let alive = true;
+    const timer = setInterval(() => {
+        if (!alive || ws.readyState !== 1) {
+            ws.terminate();
+            return;
+        }
+        alive = false;
+        ws.ping();
+    }, limits.heartbeatMs);
+    timer.unref?.();
+    ws.on('pong', () => { alive = true; });
+    ws.once('close', () => { clearInterval(timer); cleanup(); });
+    ws.on('error', () => { ws.terminate(); });
+}
+/** In-process wire used only for explicitly configured direct routes. */
+class MemoryWire extends EventEmitter {
+    readyState = 1;
+    bufferedAmount = 0;
+    peer;
+    send(data) {
+        if (this.readyState !== 1 || this.peer.readyState !== 1)
+            return;
+        const bytes = Buffer.from(data);
+        this.bufferedAmount += bytes.length;
+        queueMicrotask(() => {
+            this.bufferedAmount -= bytes.length;
+            if (this.readyState === 1 && this.peer.readyState === 1)
+                this.peer.emit('message', bytes, false);
+        });
+    }
+    ping() { queueMicrotask(() => { if (this.readyState === 1 && this.peer.readyState === 1)
+        this.emit('pong'); }); }
+    close(code = 1000, reason = '') {
+        if (this.readyState === 3)
+            return;
+        this.readyState = 3;
+        this.emit('close', code, Buffer.from(reason));
+        this.peer.close(code, reason);
+    }
+    terminate() { this.close(1006); }
+}
+function memoryPair() {
+    const left = new MemoryWire();
+    const right = new MemoryWire();
+    left.peer = right;
+    right.peer = left;
+    return [left, right];
+}
+export class RelayRouter {
+    options;
+    limits;
+    peers = new Set();
+    routes = new Map();
+    sweep;
+    directPeers = new WeakMap();
+    stopped = false;
+    constructor(options) {
+        this.options = options;
+        this.limits = { ...defaults, ...options };
+        this.sweep = setInterval(() => {
+            for (const [id, route] of this.routes)
+                if (route.expires <= Date.now() || !this.canRegister(route.peer, id))
+                    this.withdraw(id, route.peer);
+            for (const peer of this.peers)
+                for (const stream of [...peer.streams.values()]) {
+                    if (stream.owner === peer && !this.canRoute(peer, stream.serviceId))
+                        this.closeStream(stream, 'Authorization revoked');
+                }
+        }, Math.min(this.limits.heartbeatMs, 1000));
+        this.sweep.unref?.();
+    }
+    canRegister(peer, serviceId) {
+        return this.directPeers.has(peer) ? this.directPeers.get(peer) === serviceId : this.options.allowRegister(peer.principal, serviceId);
+    }
+    canRoute(peer, serviceId) {
+        return !this.directPeers.has(peer) && this.options.allowRoute(peer.principal, serviceId);
+    }
+    hasRoute(serviceId) {
+        const route = this.routes.get(serviceId);
+        return !this.stopped && !!route && route.expires > Date.now() && route.peer.ws.readyState === 1 && this.canRegister(route.peer, serviceId);
+    }
+    /** Trusted local configuration only. Clients never supply a target URL or factory. */
+    registerDirect(serviceId, connect) {
+        if (this.stopped || !identifier(serviceId) || typeof connect !== 'function' || this.hasRoute(serviceId))
+            throw new Error('Invalid or already registered direct target');
+        const [routerWire, clientWire] = memoryPair();
+        // The private WeakMap marks this peer; its placeholder principal is never
+        // passed to externally supplied authentication/authorization callbacks.
+        const peer = { ws: routerWire, principal: undefined, streams: new Map() };
+        this.directPeers.set(peer, serviceId);
+        this.peers.add(peer);
+        watch(routerWire, this.limits, () => this.remove(peer));
+        routerWire.on('message', raw => {
+            try {
+                this.receive(peer, parse(raw, this.limits));
+            }
+            catch {
+                routerWire.close(1008, 'Invalid direct route');
+            }
+        });
+        this.receive(peer, { type: 'register', serviceIds: [serviceId], ttlMs: this.limits.maxRouteTtlMs });
+        const client = new RelayClient(clientWire, { ...this.limits, targets: new Map([[serviceId, connect]]) });
+        return () => { client.close(); this.remove(peer); routerWire.close(); };
+    }
+    /** Caller awaits attach before completing its application-level ready handshake. */
+    async attach(ws, context) {
+        // Reject early application frames rather than buffering untrusted traffic while authenticating.
+        let early = false;
+        const rejectEarly = () => { early = true; ws.close(1008, 'Authentication pending'); };
+        ws.on('message', rejectEarly);
+        let principal;
+        try {
+            principal = await this.options.authenticate(context);
+        }
+        catch {
+            principal = null;
+        }
+        ws.off('message', rejectEarly);
+        if (principal === null || early || ws.readyState !== 1) {
+            ws.close(1008, 'Relay authentication required');
+            return false;
+        }
+        const peer = { ws, principal, streams: new Map() };
+        this.peers.add(peer);
+        watch(ws, this.limits, () => this.remove(peer));
+        ws.on('message', raw => {
+            try {
+                this.receive(peer, parse(raw, this.limits));
+            }
+            catch {
+                ws.close(1008, 'Invalid relay request');
+            }
+        });
+        return true;
+    }
+    withdraw(serviceId, peer) {
+        if (this.routes.get(serviceId)?.peer === peer)
+            this.routes.delete(serviceId);
+        for (const stream of [...peer.streams.values()])
+            if (stream.serviceId === serviceId && stream.provider === peer)
+                this.closeStream(stream, 'Route unavailable');
+    }
+    remove(peer) {
+        this.peers.delete(peer);
+        for (const [id, route] of this.routes)
+            if (route.peer === peer)
+                this.withdraw(id, peer);
+        for (const stream of [...peer.streams.values()])
+            this.closeStream(stream, 'Relay disconnected');
+    }
+    closeStream(s, reason) {
+        s.owner.streams.delete(s.ownerId);
+        s.provider.streams.delete(s.providerId);
+        send(s.owner.ws, { type: 'close', streamId: s.ownerId, reason }, this.limits);
+        send(s.provider.ws, { type: 'close', streamId: s.providerId, reason }, this.limits);
+    }
+    receive(peer, f) {
+        if (f.type === 'register') {
+            if (!f.serviceIds.every(id => this.canRegister(peer, id)))
+                throw new Error('Registration denied');
+            for (const id of f.serviceIds) {
+                const old = this.routes.get(id);
+                if (old && old.peer !== peer && old.expires > Date.now())
+                    throw new Error('Route already registered');
+            }
+            for (const [id, r] of this.routes)
+                if (r.peer === peer && !f.serviceIds.includes(id))
+                    this.withdraw(id, peer);
+            for (const id of f.serviceIds)
+                this.routes.set(id, { peer, expires: Date.now() + Math.min(f.ttlMs, this.limits.maxRouteTtlMs) });
+            return;
+        }
+        if (f.type === 'open') {
+            const route = this.routes.get(f.serviceId);
+            if (peer.streams.has(f.streamId))
+                throw new Error('Duplicate stream');
+            if (!this.canRoute(peer, f.serviceId) || !route || route.expires <= Date.now() || route.peer === peer) {
+                send(peer.ws, { type: 'close', streamId: f.streamId, reason: 'Route unavailable or denied' }, this.limits);
+                return;
+            }
+            if (peer.streams.size >= this.limits.maxStreams || route.peer.streams.size >= this.limits.maxStreams)
+                throw new Error('Stream budget exceeded');
+            const s = { owner: peer, ownerId: f.streamId, provider: route.peer, providerId: randomUUID(), serviceId: f.serviceId };
+            peer.streams.set(s.ownerId, s);
+            route.peer.streams.set(s.providerId, s);
+            if (!send(route.peer.ws, { ...f, streamId: s.providerId }, this.limits))
+                this.closeStream(s, 'Relay disconnected');
+            return;
+        }
+        const s = peer.streams.get(f.streamId);
+        if (!s)
+            return;
+        if (!this.canRoute(s.owner, s.serviceId) || !this.canRegister(s.provider, s.serviceId)) {
+            this.closeStream(s, 'Authorization revoked');
+            return;
+        }
+        if (f.type === 'close') {
+            this.closeStream(s, 'Channel closed');
+            return;
+        }
+        if (f.type === 'opened' && peer !== s.provider)
+            throw new Error('Invalid channel direction');
+        const target = peer === s.owner ? s.provider : s.owner;
+        if (!send(target.ws, { ...f, streamId: peer === s.owner ? s.providerId : s.ownerId }, this.limits))
+            this.closeStream(s, 'Relay congestion');
+    }
+    close() { this.stopped = true; clearInterval(this.sweep); for (const p of [...this.peers]) {
+        this.remove(p);
+        p.ws.close(1001, 'Router stopped');
+    } }
+}
+/** Shared Mac/CLI middle hop. Target factories resolve only after their sockets are open. */
+export class RelayClient {
+    upstream;
+    options;
+    limits;
+    streams = new Map();
+    renewal;
+    stopped = false;
+    constructor(upstream, options) {
+        this.upstream = upstream;
+        this.options = options;
+        this.limits = { ...defaults, ...options };
+        const ttl = Math.min(options.routeTtlMs ?? 60_000, this.limits.maxRouteTtlMs);
+        const register = () => send(upstream, { type: 'register', serviceIds: [...options.targets.keys()], ttlMs: ttl }, this.limits);
+        register();
+        this.renewal = setInterval(register, Math.max(1, Math.floor(ttl / 2)));
+        this.renewal.unref?.();
+        watch(upstream, this.limits, () => this.close());
+        upstream.on('message', raw => { void this.receive(raw).catch(() => upstream.close(1008, 'Invalid relay frame')); });
+    }
+    drop(id, reason) {
+        const target = this.streams.get(id);
+        this.streams.delete(id);
+        target?.close();
+        send(this.upstream, { type: 'close', streamId: id, reason }, this.limits);
+    }
+    async receive(raw) {
+        const f = parse(raw, this.limits);
+        if (f.type === 'register')
+            throw new Error('Unexpected registration');
+        if (f.type === 'open') {
+            const connect = this.options.targets.get(f.serviceId);
+            if (!connect || this.streams.has(f.streamId) || this.streams.size >= this.limits.maxStreams) {
+                this.drop(f.streamId, 'Target unavailable');
+                return;
+            }
+            this.streams.set(f.streamId, null);
+            let timedOut = false;
+            const timer = setTimeout(() => { timedOut = true; this.drop(f.streamId, 'Target timeout'); }, this.limits.connectTimeoutMs);
+            timer.unref?.();
+            let target;
+            try {
+                target = await connect();
+            }
+            catch {
+                clearTimeout(timer);
+                this.drop(f.streamId, 'Target unavailable');
+                return;
+            }
+            clearTimeout(timer);
+            if (timedOut || this.stopped || !this.streams.has(f.streamId)) {
+                target.close();
+                return;
+            }
+            this.streams.set(f.streamId, target);
+            watch(target, this.limits, () => { if (this.streams.get(f.streamId) === target)
+                this.drop(f.streamId, 'Target disconnected'); });
+            target.on('message', (data, isBinary) => {
+                if (Buffer.byteLength(data instanceof Array ? Buffer.concat(data) : data) > this.limits.maxFrameBytes) {
+                    this.drop(f.streamId, 'Unsupported target frame');
+                    return;
+                }
+                const bytes = data instanceof Array ? Buffer.concat(data) : Buffer.from(data);
+                const payload = isBinary ? bytes.toString('base64') : bytes.toString();
+                if (!send(this.upstream, { type: 'data', streamId: f.streamId, payload, ...(isBinary ? { encoding: 'base64' } : {}) }, this.limits))
+                    this.drop(f.streamId, 'Relay congestion');
+            });
+            send(this.upstream, { type: 'opened', streamId: f.streamId }, this.limits);
+            return;
+        }
+        if (f.type === 'close') {
+            this.drop(f.streamId, 'Channel closed');
+            return;
+        }
+        if (f.type !== 'data')
+            throw new Error('Unexpected frame');
+        const target = this.streams.get(f.streamId);
+        if (!target || target.readyState !== 1) {
+            this.drop(f.streamId, 'Target not ready');
+            return;
+        }
+        if (target.bufferedAmount + Buffer.byteLength(f.payload) > this.limits.maxBufferedBytes) {
+            this.drop(f.streamId, 'Target congestion');
+            return;
+        }
+        if (f.encoding === 'base64') {
+            if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(f.payload))
+                throw new Error('Invalid ciphertext encoding');
+            target.send(Buffer.from(f.payload, 'base64'));
+        }
+        else
+            target.send(f.payload);
+    }
+    close() {
+        if (this.stopped)
+            return;
+        this.stopped = true;
+        clearInterval(this.renewal);
+        for (const id of [...this.streams.keys()])
+            this.drop(id, 'Relay stopped');
+        this.upstream.close(1001, 'Relay stopped');
+    }
+}

package/dist/server/federation/requestContext.js

@@ -0,0 +1,4 @@
+// Object identity is deliberately used instead of a remotely forgeable header.
+const verified = new WeakSet();
+export function markEncryptedRequest(request) { verified.add(request); }
+export function isEncryptedRequest(request) { return verified.has(request); }

package/dist/server/federation/routeAccess.js

@@ -0,0 +1,124 @@
+import { readFileSync, writeFileSync, mkdirSync, renameSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+const validId = (x) => typeof x === 'string' && /^[a-zA-Z0-9_.:-]{1,160}$/.test(x);
+const digest = (s) => createHash('sha256').update(s).digest();
+/** Target directory is re-read on every permission check; invalid config denies all. */
+export class RouteAccess {
+    filePath;
+    now;
+    canRouteSubject;
+    tickets = new Map();
+    constructor(filePath, now = Date.now, canRouteSubject = () => false) {
+        this.filePath = filePath;
+        this.now = now;
+        this.canRouteSubject = canRouteSubject;
+    }
+    registry() {
+        const empty = { relays: [], directTargets: [] };
+        try {
+            const data = JSON.parse(readFileSync(this.filePath, 'utf8'));
+            if (!data || typeof data !== 'object' || Array.isArray(data) || Object.keys(data).some(k => !['relays', 'directTargets'].includes(k))
+                || (data.relays !== undefined && !Array.isArray(data.relays)) || (data.directTargets !== undefined && !Array.isArray(data.directTargets)))
+                return empty;
+            const relays = data.relays ?? [], directTargets = data.directTargets ?? [];
+            if (relays.length > 64 || directTargets.length > 64)
+                return empty;
+            const ids = new Set();
+            for (const r of relays) {
+                if (!r || Object.keys(r).some(k => !['id', 'token', 'targets'].includes(k)) || !validId(r.id) || ids.has(r.id) || typeof r.token !== 'string' || r.token.length < 32 || /[\r\n]/.test(r.token) || !Array.isArray(r.targets) || r.targets.length > 64 || !r.targets.every(validId))
+                    return empty;
+                ids.add(r.id);
+            }
+            const targetIds = new Set();
+            for (const target of directTargets) {
+                if (!target || typeof target !== 'object' || Array.isArray(target) || Object.keys(target).some(key => !['serviceId', 'url', 'caPath'].includes(key))
+                    || !validId(target.serviceId) || targetIds.has(target.serviceId) || typeof target.url !== 'string' || (target.caPath !== undefined && typeof target.caPath !== 'string'))
+                    return empty;
+                const url = new URL(target.url);
+                if (!['https:', 'wss:'].includes(url.protocol) || url.username || url.password || url.search || url.hash || !['/', '/api/federation/secure'].includes(url.pathname))
+                    return empty;
+                targetIds.add(target.serviceId);
+            }
+            return { relays, directTargets };
+        }
+        catch {
+            return empty;
+        }
+    }
+    relays() { return this.registry().relays; }
+    issueRouteTicket(subjectId, serviceId) {
+        if (!validId(subjectId) || !validId(serviceId) || !this.canRouteSubject(subjectId, serviceId) || !this.hasConfiguredTarget(serviceId))
+            throw new Error('ROUTE_UNAVAILABLE');
+        for (const [key, value] of this.tickets)
+            if (value.expiresAt <= this.now())
+                this.tickets.delete(key);
+        if (this.tickets.size >= 1024)
+            throw new Error('ROUTE_TICKET_LIMIT');
+        const routeToken = randomBytes(32).toString('base64url');
+        const expiresAt = this.now() + 30_000;
+        this.tickets.set(digest(routeToken).toString('hex'), { subjectId, serviceId, expiresAt });
+        return { routeToken, expiresAt };
+    }
+    /** Called once before upgrading. A route ticket is consumed even if expired. */
+    authenticate(authorization, routeToken) {
+        if (authorization && routeToken)
+            return null;
+        if (authorization) {
+            if (!authorization.startsWith('Bearer ') || authorization.length > 4096)
+                return null;
+            const tokenHash = digest(authorization.slice(7));
+            const relay = this.relays().find(r => timingSafeEqual(digest(r.token), tokenHash));
+            return relay ? { kind: 'relay', id: relay.id, tokenHash: tokenHash.toString('hex') } : null;
+        }
+        if (!routeToken || routeToken.length > 512)
+            return null;
+        const key = digest(routeToken).toString('hex');
+        const ticket = this.tickets.get(key);
+        this.tickets.delete(key);
+        if (!ticket || ticket.expiresAt <= this.now() || !this.canRouteSubject(ticket.subjectId, ticket.serviceId) || !this.hasConfiguredTarget(ticket.serviceId))
+            return null;
+        return { kind: 'client', subjectId: ticket.subjectId, serviceId: ticket.serviceId };
+    }
+    allowRegister(principal, serviceId) {
+        return principal.kind === 'relay' && this.relays().some(r => r.id === principal.id && digest(r.token).toString('hex') === principal.tokenHash && r.targets.includes(serviceId));
+    }
+    allowRoute(principal, serviceId) {
+        return principal.kind === 'client' && principal.serviceId === serviceId && this.canRouteSubject(principal.subjectId, serviceId) && this.hasConfiguredTarget(serviceId);
+    }
+    hasConfiguredTarget(serviceId) {
+        if (!validId(serviceId))
+            return false;
+        const registry = this.registry();
+        return registry.relays.some(relay => relay.targets.includes(serviceId)) || registry.directTargets.some(target => target.serviceId === serviceId);
+    }
+    addDirectTarget(target) {
+        const url = new URL(target.url);
+        if (!validId(target.serviceId) || url.protocol !== 'https:' || url.username || url.password || url.search || url.hash || url.pathname !== '/')
+            throw new Error('INVALID_DIRECT_TARGET');
+        let data;
+        try {
+            data = JSON.parse(readFileSync(this.filePath, 'utf8'));
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            data = {};
+        }
+        const registry = this.registry();
+        if (!data || typeof data !== 'object' || Array.isArray(data) || Object.keys(data).some(key => !['relays', 'directTargets'].includes(key))
+            || (data.relays !== undefined && (!Array.isArray(data.relays) || data.relays.length !== registry.relays.length))
+            || (data.directTargets !== undefined && (!Array.isArray(data.directTargets) || data.directTargets.length !== registry.directTargets.length)))
+            throw new Error('INVALID_ROUTE_REGISTRY');
+        if (this.hasConfiguredTarget(target.serviceId))
+            return;
+        if (registry.directTargets.length >= 64)
+            throw new Error('ROUTE_TARGET_LIMIT');
+        data.directTargets = [...registry.directTargets, { serviceId: target.serviceId, url: url.origin }];
+        mkdirSync(dirname(this.filePath), { recursive: true, mode: 0o700 });
+        const temporary = `${this.filePath}.tmp`;
+        writeFileSync(temporary, JSON.stringify(data, null, 2), { mode: 0o600 });
+        renameSync(temporary, this.filePath);
+    }
+    configuredDirectTargets() { return this.registry().directTargets; }
+}