workerdeck 0.23.0 → 1.0.0

package/build/{instance-iBl_fOW2.mjs → instance-5sdv2Rrw.mjs}

@@ -8,60 +8,32 @@ import { connect, constants } from "node:http2";
 import { homedir } from "node:os";
 import { pathToFileURL } from "node:url";
 //#region src/apns/client.ts
-/**
-* The environment is per *device token*, not per deployment, and that is the
-* single most expensive thing to get wrong here: a build run from Xcode gets a
-* sandbox token, a TestFlight build gets a production one, and the two
-* namespaces do not overlap. Same key, same phone, different token — cross them
-* and Apple answers `BadDeviceToken`. So the app declares which environment it
-* registered in and the forwarder routes each token to its own host.
-*/
 const HOSTS = {
 	development: "https://api.sandbox.push.apple.com",
 	production: "https://api.push.apple.com"
 };
-/**
-* Apple rejects a provider token older than an hour, and rate-limits refreshing
-* one (`TooManyProviderTokenUpdates`) if you re-sign much more often than every
-* twenty minutes. Forty sits in the middle of that window with room for clock
-* skew at both ends — and re-signing per push, the obvious-looking thing, is
-* exactly what the rate limit exists to punish.
-*/
 const TOKEN_TTL_MS = 2400 * 1e3;
 const REQUEST_TIMEOUT_MS = 1e4;
-/** Per-address budget for a dial. Node defaults this to 250ms, which is under
-* Apple's observed handshake on at least one real path; see the comment at the
-* `connect()` call. Generous rather than tuned — the cost of being slow to give
-* up on an address is a slower dial, and the cost of being quick is a lost
-* notification. */
 const DIAL_ATTEMPT_TIMEOUT_MS = 2e3;
-const base64url = (input) => Buffer.from(input).toString("base64url");
-/**
-* Load and sanity-check the auth key. Done once at startup rather than at the
-* first push, so a mistyped path is a launch error with a clear message instead
-* of a notification that silently never arrives.
-*/
+function base64url(input) {
+	return Buffer.from(input).toString("base64url");
+}
 async function loadApnsKey(keyFile) {
 	let pem;
 	try {
 		pem = await readFile(keyFile, "utf8");
 	} catch (error) {
-		throw new Error(`apns: cannot read the auth key at ${keyFile}: ${error instanceof Error ? error.message : String(error)}`);
+		throw new Error(`apns: cannot read the auth key at ${keyFile}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
 	}
 	let key;
 	try {
 		key = createPrivateKey(pem);
 	} catch (error) {
-		throw new Error(`apns: ${keyFile} is not a private key (${error instanceof Error ? error.message : String(error)})`);
+		throw new Error(`apns: ${keyFile} is not a private key (${error instanceof Error ? error.message : String(error)})`, { cause: error });
 	}
 	if (key.asymmetricKeyType !== "ec") throw new Error(`apns: ${keyFile} is a ${key.asymmetricKeyType ?? "unknown"} key, not EC — an APNs auth key is the .p8 downloaded from Keys in the developer portal, not a certificate`);
 	return key;
 }
-/**
-* A cached provider JWT. The signature is over `{alg:ES256,kid}` + `{iss,iat}`,
-* and JWS wants the raw `r||s` pair — `sign()` produces a DER SEQUENCE unless
-* told otherwise, which Apple rejects with a bare 403 and no explanation.
-*/
 function createProviderToken(key, keyId, teamId) {
 	let cached = null;
 	return {
@@ -89,12 +61,6 @@ function createProviderToken(key, keyId, teamId) {
 		}
 	};
 }
-/**
-* One long-lived HTTP/2 session per environment, reconnected on demand. APNs
-* sends GOAWAY routinely (it rebalances connections), so a dead session is a
-* normal event and not an error worth surfacing — the next push simply dials
-* again.
-*/
 function createSessionPool(hosts) {
 	const sessions = /* @__PURE__ */ new Map();
 	const failures = /* @__PURE__ */ new Map();
@@ -132,21 +98,13 @@ function createSessionPool(hosts) {
 		}
 	};
 }
-/**
-* A stream that never left this machine is destroyed with
-* ERR_HTTP2_STREAM_CANCEL, which buries the real failure in `cause` — and when
-* every connect attempt fails (Happy Eyeballs walks both address families of
-* api.push.apple.com), that cause is an AggregateError whose own message is
-* EMPTY, so the text ends in "(caused by: )" and names nothing. Mine the
-* aggregate so the log says ECONNREFUSED/EHOSTUNREACH instead of nothing.
-*/
-const describeStreamError = (error) => {
+function describeStreamError(error) {
 	const cause = error.cause;
 	if (!(cause instanceof AggregateError)) return error.message;
 	const parts = cause.errors.map((inner) => inner instanceof Error ? inner.message : String(inner)).filter((message) => message !== "");
 	if (parts.length === 0) return error.message;
 	return `${error.message.replace(" (caused by: )", "")} (caused by: ${parts.join("; ")})`;
-};
+}
 function createApnsClient(config, key, options = {}) {
 	const providerToken = createProviderToken(key, config.keyId, config.teamId);
 	const pool = createSessionPool(options.hosts ?? HOSTS);
@@ -191,18 +149,11 @@ function createApnsClient(config, key, options = {}) {
 				retry
 			});
 		};
-		/** Classify a transport-level death. `pending` is true only while the
-		* stream has no id — its HEADERS frame was never handed to nghttp2, so a
-		* retry cannot duplicate anything. REFUSED_STREAM is Apple's explicit
-		* "received but not processed", defined by the RFC as safe to retry. */
 		const transportRetry = () => {
 			if (stream.pending) return "redial";
 			if (stream.rstCode === constants.NGHTTP2_REFUSED_STREAM) return "now";
 			return "never";
 		};
-		/** A stream still pending when its attempt dies marks a connect that is
-		* failing or hanging; without this, every later push (and the retry)
-		* would queue behind the same doomed dial until the OS gave up on it. */
 		const dropDoomedDial = () => {
 			if (stream.pending && session.connecting) pool.discard(request.environment, session);
 		};
@@ -285,18 +236,51 @@ function createApnsClient(config, key, options = {}) {
 	};
 }
 //#endregion
+//#region src/lib/http.ts
+/**
+* Read a request body, bounded. Resolves `null` if the body exceeds `maxBytes` or the socket
+* errors — the caller answers 413 either way; it never resolves twice, and it never buffers
+* past the cap, which is the whole point of not using a body parser here.
+*/
+function readBody(req, maxBytes) {
+	return new Promise((resolve) => {
+		const chunks = [];
+		let size = 0;
+		let settled = false;
+		const finish = (value) => {
+			if (!settled) {
+				settled = true;
+				resolve(value);
+			}
+		};
+		req.on("data", (chunk) => {
+			size += chunk.length;
+			if (size > maxBytes) {
+				finish(null);
+				return;
+			}
+			chunks.push(chunk);
+		});
+		req.on("end", () => finish(Buffer.concat(chunks).toString("utf8")));
+		req.on("error", () => finish(null));
+	});
+}
+/** A JSON answer that is never cached — these routes all carry auth state. */
+function respondJson(res, status, body, headers) {
+	res.writeHead(status, {
+		"content-type": "application/json",
+		"cache-control": "no-store",
+		...headers
+	}).end(JSON.stringify(body));
+}
+//#endregion
 //#region src/apns/devices.ts
 const FILENAME = "apns-devices.json";
-/** Apple's tokens are 64 hex chars today. The upper bound is generous because
-* Apple has reserved the right to grow them; the lower one just rejects junk. */
 const TOKEN_PATTERN = /^[0-9a-fA-F]{32,200}$/;
 const MAX_BODY_BYTES = 4096;
-const isEnvironment = (value) => value === "development" || value === "production";
-/**
-* `dir` null keeps the registry in memory: a restart then forgets every token,
-* which is survivable because the app re-registers on launch, but it does mean
-* an instance with no state dir goes quiet until each phone is next opened.
-*/
+function isEnvironment(value) {
+	return value === "development" || value === "production";
+}
 async function createDeviceRegistry(options) {
 	const path = options.dir === null ? null : join(options.dir, FILENAME);
 	const devices = /* @__PURE__ */ new Map();
@@ -337,45 +321,6 @@ async function createDeviceRegistry(options) {
 		}
 	};
 }
-const respond = (res, status, body) => {
-	res.writeHead(status, {
-		"content-type": "application/json",
-		"cache-control": "no-store"
-	}).end(JSON.stringify(body));
-};
-const readBody = (req) => new Promise((resolve) => {
-	const chunks = [];
-	let size = 0;
-	let settled = false;
-	const finish = (value) => {
-		if (!settled) {
-			settled = true;
-			resolve(value);
-		}
-	};
-	req.on("data", (chunk) => {
-		size += chunk.length;
-		if (size > MAX_BODY_BYTES) {
-			finish(null);
-			return;
-		}
-		chunks.push(chunk);
-	});
-	req.on("end", () => finish(Buffer.concat(chunks).toString("utf8")));
-	req.on("error", () => finish(null));
-});
-/**
-* `POST /apns/devices` to register a token, `DELETE /apns/devices` to drop one.
-* Returns true when it consumed the request.
-*
-* Deliberately outside `/v1`: this is the forwarder's own surface, not part of
-* the protocol `packages/protocol` defines, and a client that finds a 404 here
-* has simply reached a gateway running without push configured.
-*
-* DELETE exists so removing a gateway from the app can stop its pushes. Without
-* it a forgotten server keeps buzzing a phone that no longer has any way to act
-* on what it says.
-*/
 function createDeviceRoute(registry, authenticate) {
 	return async (req, res) => {
 		let pathname;
@@ -390,12 +335,12 @@ function createDeviceRoute(registry, authenticate) {
 			return true;
 		}
 		if (authenticate(req) === null) {
-			respond(res, 401, { error: "unauthorized" });
+			respondJson(res, 401, { error: "unauthorized" });
 			return true;
 		}
-		const raw = await readBody(req);
+		const raw = await readBody(req, MAX_BODY_BYTES);
 		if (raw === null) {
-			respond(res, 413, { error: "body too large" });
+			respondJson(res, 413, { error: "body too large" });
 			res.once("finish", () => req.destroy());
 			return true;
 		}
@@ -403,12 +348,12 @@ function createDeviceRoute(registry, authenticate) {
 		try {
 			body = JSON.parse(raw);
 		} catch {
-			respond(res, 400, { error: "invalid JSON body" });
+			respondJson(res, 400, { error: "invalid JSON body" });
 			return true;
 		}
 		const token = body.token;
 		if (typeof token !== "string" || !TOKEN_PATTERN.test(token)) {
-			respond(res, 400, { error: "token must be a hex APNs device token" });
+			respondJson(res, 400, { error: "token must be a hex APNs device token" });
 			return true;
 		}
 		if (req.method === "DELETE") {
@@ -417,7 +362,7 @@ function createDeviceRoute(registry, authenticate) {
 			return true;
 		}
 		if (!isEnvironment(body.environment)) {
-			respond(res, 400, { error: "environment must be 'development' or 'production'" });
+			respondJson(res, 400, { error: "environment must be 'development' or 'production'" });
 			return true;
 		}
 		const optionalString = (value) => typeof value === "string" && value.length > 0 && value.length <= 200 ? value : void 0;
@@ -428,7 +373,7 @@ function createDeviceRoute(registry, authenticate) {
 			bundleId: optionalString(body.bundleId),
 			platform: optionalString(body.platform)
 		});
-		respond(res, 200, {
+		respondJson(res, 200, {
 			registered: true,
 			environment: body.environment
 		});
@@ -437,42 +382,26 @@ function createDeviceRoute(registry, authenticate) {
 }
 //#endregion
 //#region src/apns/forwarder.ts
-/**
-* Turns the server's session notifications into APNs pushes.
-*
-* The architectural point, restated because it is easy to erode: session
-* webhooks are the primitive and this is one consumer of them. It hooks
-* `notifications.onNotification` in-process — same process as the gateway, so
-* there is no HTTP hop — but nothing about the server knows that, and the same
-* events can just as well drive Slack or a custom relay. Push credentials live
-* here and nowhere in `packages/server`.
-*/
-/** APNs caps a payload at 4 KB. Staying well under leaves room for the alert
-* dictionary to grow without anyone rediscovering the limit the hard way. */
 const MAX_PAYLOAD_BYTES = 3800;
 const BODY_LIMIT = 300;
-/** Category identifiers are wire contract with the app: it registers the
-* Approve/Deny actions under this exact string, and a mismatch means a
-* notification that arrives with no buttons on it. */
 const CATEGORY = {
 	permission: "PERMISSION_REQUEST",
 	event: "SESSION_EVENT"
 };
-const label = (session) => {
+function label(session) {
 	const title = session.title?.trim();
 	if (title !== void 0 && title !== "") return title;
 	const leaf = session.cwd.split("/").filter(Boolean).at(-1);
 	return leaf !== void 0 && leaf !== "" ? leaf : session.id;
-};
-const oneLine = (text, limit = BODY_LIMIT) => {
+}
+function oneLine(text, limit = BODY_LIMIT) {
 	const flat = (text ?? "").replace(/\s+/g, " ").trim();
 	return flat.length <= limit ? flat : `${flat.slice(0, limit - 1)}…`;
-};
-/** A collapse id is capped at 64 bytes and a session id has no such bound, so
-* hash rather than truncate — two sessions sharing a prefix must not collapse
-* into each other. */
-const collapseKey = (sessionId) => createHash("sha256").update(sessionId).digest("base64url").slice(0, 32);
-const titleFor = (notification, name) => {
+}
+function collapseKey(sessionId) {
+	return createHash("sha256").update(sessionId).digest("base64url").slice(0, 32);
+}
+function titleFor(notification, name) {
 	switch (notification.type) {
 		case "permission_requested": return `Approval needed — ${name}`;
 		case "turn_completed": return notification.result?.isError === true ? `Turn failed — ${name}` : name;
@@ -480,8 +409,8 @@ const titleFor = (notification, name) => {
 		case "session_closed": return `Session ended — ${name}`;
 		default: return name;
 	}
-};
-const bodyFor = (notification) => {
+}
+function bodyFor(notification) {
 	const preview = oneLine(notification.preview);
 	if (preview !== "") return preview;
 	switch (notification.type) {
@@ -490,16 +419,7 @@ const bodyFor = (notification) => {
 		case "session_closed": return `Closed by the ${notification.reason ?? "server"}.`;
 		default: return "Something needs your attention.";
 	}
-};
-/**
-* Build the push for one notification.
-*
-* The payload carries routing and nothing else — `sessionId` to deep-link,
-* `requestId` because a lock-screen Approve has nothing to POST to without it,
-* and `hostId` so a client with two gateways knows which one this came from.
-* Everything else the app fetches over REST the moment it opens; a transcript
-* has no business in a 4 KB envelope.
-*/
+}
 function buildPush(notification, hostId) {
 	const permission = notification.type === "permission_requested";
 	const name = label(notification.session);
@@ -542,9 +462,6 @@ async function createApnsForwarder(options) {
 	});
 	const handleRequest = createDeviceRoute(registry, options.authenticate);
 	const fallbackEnvironment = options.config.production === false ? "development" : "production";
-	/** Per-session delivery chain, so a session's pushes arrive in the order the
-	* events happened — which matters precisely because `turn_completed` collapses
-	* and an out-of-order pair would leave the older text on screen. */
 	const chains = /* @__PURE__ */ new Map();
 	const deliver = async (notification) => {
 		const devices = registry.list();
@@ -581,15 +498,13 @@ async function createApnsForwarder(options) {
 }
 //#endregion
 //#region src/auth/auth-key.ts
-/** 48 hex chars — far past `createCliAuth`'s 12-char floor, and header-safe. */
-const generateKey = () => randomBytes(24).toString("hex");
-/** A stored key must be one printable-ASCII line long enough to be a secret:
-* both transports (HTTP header, login form) choke on anything else, and a
-* truncated or garbage file should regenerate, not crash or half-work. */
-const usableStoredKey = (raw) => {
+function generateKey() {
+	return randomBytes(24).toString("hex");
+}
+function usableStoredKey(raw) {
 	const line = raw.split("\n", 1)[0]?.trim() ?? "";
 	return line.length >= 12 && /^[\x21-\x7e]+$/.test(line) ? line : null;
-};
+}
 async function materializeAuthKey(stateDir, options = {}) {
 	const warn = options.warn ?? ((message) => process.stderr.write(`[workerdeck] ${message}\n`));
 	if (stateDir === null) return {
@@ -633,29 +548,9 @@ async function materializeAuthKey(stateDir, options = {}) {
 }
 //#endregion
 //#region src/auth/auth-sessions.ts
-/**
-* Durable browser-login sessions for the turnkey CLI — the other half of
-* `materializeAuthKey`, and here for the same reason: the key survives a
-* restart so clients stay paired, and the login cookie should too. Without
-* this the cookie outlives the table it points into, so a restart signs every
-* browser out while the browser still holds a perfectly valid-looking cookie.
-*
-* What lands on disk is **not credential material**: `createCliAuth` keys its
-* table by `HMAC-SHA256(secret, token)`, so a stolen file yields neither the
-* operator secret nor any cookie value (inverting either needs a preimage of a
-* 256-bit-entropy input). That keying is also what makes key rotation
-* invalidate every outstanding cookie for free — entries written under the old
-* secret simply never match a lookup again, and age out on their own expiry.
-*
-* Writes are whole-file and serialized behind one promise chain (the table is
-* capped at `MAX_SESSIONS`, so "whole file" is a few kilobytes), and go through
-* a temp file + rename so a crash mid-write cannot leave a truncated table.
-* Every failure is a warning, never a throw: losing durability signs the
-* operator out, losing the gateway does much worse.
-*/
 const FORMAT_VERSION = 1;
 const FILE_NAME = "auth-sessions.json";
-const parseSessions = (raw, now) => {
+function parseSessions(raw, now) {
 	let parsed;
 	try {
 		parsed = JSON.parse(raw);
@@ -673,7 +568,7 @@ const parseSessions = (raw, now) => {
 		entries.push([key, { expiresAt }]);
 	}
 	return entries;
-};
+}
 async function createAuthSessionStore(options) {
 	const now = options.now ?? Date.now;
 	const warn = options.warn ?? ((message) => process.stderr.write(`[workerdeck] ${message}\n`));
@@ -728,8 +623,6 @@ const DEFAULT_TTL_MS = 10080 * 60 * 1e3;
 const DEFAULT_THROTTLE_WINDOW_MS = 900 * 1e3;
 const DEFAULT_MAX_FAILURES_PER_IP = 10;
 const DEFAULT_MAX_FAILURES_GLOBAL = 100;
-/** Only successful logins insert, so this cap only fences the secret-holder's
-* own memory use (every login within the ttl is a live entry). Oldest goes. */
 const MAX_SESSIONS = 100;
 const MAX_LOGIN_BODY_BYTES = 4096;
 const SAFE_METHODS = new Set([
@@ -737,7 +630,9 @@ const SAFE_METHODS = new Set([
 	"HEAD",
 	"OPTIONS"
 ]);
-const sha256 = (value) => createHash("sha256").update(value).digest();
+function sha256(value) {
+	return createHash("sha256").update(value).digest();
+}
 function createCliAuth(options = {}) {
 	const { secret } = options;
 	const enabled = secret !== void 0;
@@ -756,27 +651,8 @@ function createCliAuth(options = {}) {
 			throw new Error(`createCliAuth: allowedOrigins entry is not a valid origin: ${JSON.stringify(entry)}`);
 		}
 	}));
-	/** Both the raw secret and session tokens are compared as fixed-length SHA-256
-	* digests via timingSafeEqual / digest-keyed lookup, so no code path compares
-	* secret material byte-by-byte with early exit — and unequal input lengths
-	* leak nothing either. */
 	const secretDigest = secret === void 0 ? void 0 : sha256(secret);
 	const secretMatches = (candidate) => secretDigest !== void 0 && timingSafeEqual(sha256(candidate), secretDigest);
-	/**
-	* Browser sessions are a server-side table, not signed tokens: logout must
-	* actually invalidate, and a stateless HMAC token stays valid until expiry no
-	* matter what the server thinks. This is one long-lived process (multi-node
-	* is a non-goal), so "table" means one Map — optionally mirrored to a
-	* `CliSessionStore` so a restart does not sign every browser out while the
-	* browser still holds a cookie the ttl says is good for a week.
-	*
-	* Keys are `HMAC-SHA256(secret, token)`, which buys three things at once:
-	* recovering a token from a key (or from lookup timing) needs a preimage;
-	* what a store writes to disk is not credential material; and rotating the
-	* operator secret invalidates every outstanding cookie **for free**, since
-	* rows written under the old secret can no longer be looked up and age out on
-	* their own expiry.
-	*/
 	const sessions = /* @__PURE__ */ new Map();
 	const store = options.sessions;
 	const tokenKey = (token) => secret === void 0 ? sha256(token).toString("hex") : createHmac("sha256", secret).update(token).digest("hex");
@@ -797,7 +673,7 @@ function createCliAuth(options = {}) {
 	};
 	const cookieToken = (req) => {
 		const header = req.headers.cookie;
-		if (typeof header !== "string") return void 0;
+		if (typeof header !== "string") return;
 		for (const part of header.split(";")) {
 			const eq = part.indexOf("=");
 			if (eq === -1) continue;
@@ -817,10 +693,8 @@ function createCliAuth(options = {}) {
 		}
 		return true;
 	};
-	/** Last value of a possibly comma-joined forwarded header — the one appended
-	* (or set) by the trusted proxy; every earlier position is client-writable. */
 	const forwardedLast = (value) => {
-		if (value === void 0) return void 0;
+		if (value === void 0) return;
 		const last = (Array.isArray(value) ? value.join(",") : value).split(",").at(-1)?.trim();
 		return last === "" ? void 0 : last;
 	};
@@ -828,8 +702,6 @@ function createCliAuth(options = {}) {
 		if (req.socket.encrypted === true) return true;
 		return trustProxy && forwardedLast(req.headers["x-forwarded-proto"])?.toLowerCase() === "https";
 	};
-	/** The origin this server believes it is being served as, from the request's
-	* own Host (or the proxy's forwarded host) — the only self-knowledge we have. */
 	const expectedOrigin = (req) => {
 		const host = (trustProxy ? forwardedLast(req.headers["x-forwarded-host"]) : void 0) ?? req.headers.host;
 		if (host === void 0 || host === "") return null;
@@ -839,20 +711,6 @@ function createCliAuth(options = {}) {
 			return null;
 		}
 	};
-	/**
-	* The CSRF core. `SameSite=Lax` alone is not enough for two reasons: same
-	* *site* is not same *origin* (another port on localhost — any other local
-	* web app — is same-site, cookies attach), and the WS handshake is exempt
-	* from CORS, so a foreign page that gets the cookie attached can read the
-	* stream. So the Origin header is checked explicitly, against the request's
-	* own origin (full scheme + authority: an http:// page on the same host must
-	* not drive the https:// dashboard) or the operator's allowlist. `Origin:
-	* null` and unparseable values are foreign. Verdicts are tri-state because
-	* absence means different things per call site: every current browser sends
-	* Origin on cross-site POSTs and every WS handshake, so absence means a
-	* non-browser client — which carries no ambient cookie and gets to decide
-	* per-endpoint below.
-	*/
 	const originVerdict = (req) => {
 		const raw = req.headers.origin;
 		if (raw === void 0) return "absent";
@@ -883,20 +741,8 @@ function createCliAuth(options = {}) {
 		const upgrade = req.headers.upgrade;
 		return typeof upgrade === "string" && upgrade.toLowerCase().includes("websocket");
 	};
-	/**
-	* The secret from `?key=` — **accepted on WebSocket upgrades only**.
-	*
-	* A browser cannot put a header on a WS handshake, so a tab attaching to a
-	* gateway that is not its own origin (where the cookie would ride) has no
-	* other way to present the key. That is the whole reason this exists.
-	*
-	* Restricting it to upgrades is what keeps the blast radius at "one attach":
-	* a key in a query string is not a transport we want anywhere else, because
-	* URLs land in proxy access logs and browser history in a way headers do not.
-	* A REST call with `?key=` is therefore *not* authenticated by it.
-	*/
 	const querySecret = (req) => {
-		if (!isUpgradeRequest(req)) return void 0;
+		if (!isUpgradeRequest(req)) return;
 		const key = new URL(req.url ?? "/", "http://internal").searchParams.get("key");
 		return key !== null && key !== "" ? key : void 0;
 	};
@@ -918,16 +764,6 @@ function createCliAuth(options = {}) {
 			canManageProfiles: true
 		};
 	};
-	/**
-	* Login throttle: the secret is the only factor and the endpoint is reachable
-	* by anyone who can reach the port, so guessing must be rate-limited. Failed
-	* attempts count per client IP inside a fixed window, with a global cap
-	* behind it so rotating IPs (trivial over IPv6) buys an attacker nothing.
-	* Only wrong secrets count — malformed requests and foreign-Origin posts are
-	* refused earlier precisely so a hostile page cannot burn a victim IP's
-	* budget cross-site. The global cap also bounds this map's size: expired
-	* entries are swept once it grows past a nominal size.
-	*/
 	const failures = /* @__PURE__ */ new Map();
 	const globalFailures = {
 		count: 0,
@@ -970,13 +806,6 @@ function createCliAuth(options = {}) {
 		"Max-Age=0",
 		...cookieAttributes(req)
 	].join("; ");
-	const respondJson = (res, status, body, headers) => {
-		res.writeHead(status, {
-			"content-type": "application/json",
-			"cache-control": "no-store",
-			...headers
-		}).end(JSON.stringify(body));
-	};
 	const respondRedirect = (res, location, headers) => {
 		res.writeHead(303, {
 			location,
@@ -984,31 +813,7 @@ function createCliAuth(options = {}) {
 			...headers
 		}).end();
 	};
-	/** JSON responses when the client asks for them, 303 redirects otherwise —
-	* so a dependency-free `<form method="post">` login page works without JS,
-	* and a fetch()-based one gets real status codes. */
 	const wantsJson = (req) => (req.headers.accept ?? "").includes("application/json");
-	const readBody = (req, maxBytes) => new Promise((resolve) => {
-		const chunks = [];
-		let size = 0;
-		let settled = false;
-		const finish = (value) => {
-			if (!settled) {
-				settled = true;
-				resolve(value);
-			}
-		};
-		req.on("data", (chunk) => {
-			size += chunk.length;
-			if (size > maxBytes) {
-				finish(null);
-				return;
-			}
-			chunks.push(chunk);
-		});
-		req.on("end", () => finish(Buffer.concat(chunks).toString("utf8")));
-		req.on("error", () => finish(null));
-	});
 	const handleLogin = async (req, res) => {
 		const json = wantsJson(req);
 		if (!enabled) {
@@ -1135,17 +940,6 @@ function createCliAuth(options = {}) {
 }
 //#endregion
 //#region src/config.ts
-/**
-* The config surface has to be JavaScript, not JSON: the two options a real
-* deployment always needs — `authenticate` and `buildRunnerConfig` — are
-* functions. So the file default-exports `WorkerServerOptions` (optionally as a
-* function, sync or async, for config that has to await something), and flags
-* and env cover the cases that fit on a command line.
-*
-* Precedence, narrowest wins: flags > env > config file > defaults. A config
-* file that sets `authenticate` itself opts out of the built-in shared-secret
-* auth entirely — see `resolveInstanceConfig`.
-*/
 const CONFIG_BASENAMES = [
 	"workerdeck.config.mjs",
 	"workerdeck.config.js",
@@ -1157,11 +951,6 @@ function parsePort(raw, source) {
 	if (!Number.isInteger(port) || port < 0 || port > 65535) throw new ConfigError(`${source}: not a valid port: ${raw}`);
 	return port;
 }
-/**
-* Hand-rolled rather than a dependency: the CLI's whole value is that `npx
-* workerdeck` pulls down a small tree, and an arg parser is a hundred lines
-* of it.
-*/
 function parseArgs(argv) {
 	const flags = {
 		profiles: [],
@@ -1271,12 +1060,6 @@ function parseArgs(argv) {
 	}
 	return flags;
 }
-/**
-* Explicit `--config` must exist — a typo that silently starts a default
-* instance is worse than a failure. An implicit one is looked up in cwd only:
-* walking parent directories would make what a given command does depend on
-* where it was run from.
-*/
 async function loadConfigFile(explicit, cwd = process.cwd()) {
 	let path = null;
 	if (explicit) {
@@ -1311,18 +1094,9 @@ const LOOPBACK = new Set([
 function isLoopback(host) {
 	return LOOPBACK.has(host);
 }
-/**
-* Durable parking is on by default because this is a long-lived instance: a
-* turnkey tool that silently drops parked work on every restart is the wrong
-* default. The store writes whole transcripts in plaintext, so it goes beside
-* the config file (or under the home directory) rather than anywhere temporary,
-* and one directory serves exactly one instance — the store is single-process
-* by design, which the single-port model already implies.
-*/
 function defaultStateDir(configPath) {
 	return configPath ? join(dirname(configPath), ".workerdeck") : join(homedir(), ".workerdeck");
 }
-/** Hostname out of a Host header, minus the port and any IPv6 brackets. */
 function hostnameOf(hostHeader) {
 	try {
 		return new URL(`http://${hostHeader}`).hostname.replace(/^\[|\]$/g, "").toLowerCase();
@@ -1330,20 +1104,10 @@ function hostnameOf(hostHeader) {
 		return "";
 	}
 }
-/** 127.0.0.0/8, ::1, and the names that mean them. */
 function isLoopbackHostname(hostname) {
 	if (LOOPBACK.has(hostname)) return true;
 	return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(hostname);
 }
-/**
-* An `insecureHosts` entry names a host, never an endpoint: it is compared
-* against the bind host and against Host headers, and both are portless by the
-* time they are compared. An entry carrying a port would therefore never match
-* anything — a gate that looks armed and is not — so it is rejected loudly, as
-* is anything that does not parse as a host name or address. Bare IPv6 is
-* bracketed before parsing (WHATWG URL requires that), and the result is
-* lowercased to match `hostnameOf`'s normal form.
-*/
 function normalizeInsecureHost(raw) {
 	const entry = raw.trim();
 	const looksLikeNamePort = /^[^:]+:\d+$/.test(entry);
@@ -1364,8 +1128,6 @@ function resolveInstanceConfig(flags, loaded, env = process.env, cwd = process.c
 	const authKey = flags.authKey || env.WORKERDECK_AUTH_KEY || loaded.options.auth?.secret || void 0;
 	const hostAuthenticates = typeof loaded.options.authenticate === "function";
 	const insecureHosts = new Set([...flags.insecureHosts, ...loaded.options.insecureHosts ?? []].map(normalizeInsecureHost));
-	/** The bind host in the same normal form the entries were put in. It never
-	* carries a port — that is a separate flag — so only brackets and case vary. */
 	const bindHost = host.trim().replace(/^\[|\]$/g, "").toLowerCase();
 	const generateAuthKey = !authKey && !hostAuthenticates && !loaded.options.allowUnauthenticated && !isLoopback(host) && !flags.insecure && !insecureHosts.has(bindHost);
 	const stateDir = flags.parking === false || loaded.options.stateDir === null ? null : flags.stateDir ?? env.WORKERDECK_STATE_DIR ?? loaded.options.stateDir ?? defaultStateDir(loaded.path);
@@ -1424,16 +1186,9 @@ function resolveInstanceConfig(flags, loaded, env = process.env, cwd = process.c
 		options
 	};
 }
-/**
-* A relative `keyFile` resolves against the config file's own directory, not the
-* cwd — the same convention `defaultStateDir` uses, and the one that makes a
-* deployment directory self-contained. Missing required fields throw here rather
-* than at the first push, since a half-configured forwarder is a notification
-* that silently never arrives.
-*/
 function resolveApns(loaded) {
 	const apns = loaded.options.apns;
-	if (!apns) return void 0;
+	if (!apns) return;
 	for (const field of [
 		"keyFile",
 		"keyId",
@@ -1448,13 +1203,15 @@ function resolveApns(loaded) {
 }
 //#endregion
 //#region src/auth/login-page.ts
-const escapeHtml = (value) => value.replace(/[&<>"']/g, (c) => ({
-	"&": "&amp;",
-	"<": "&lt;",
-	">": "&gt;",
-	"\"": "&quot;",
-	"'": "&#39;"
-})[c] ?? c);
+function escapeHtml(value) {
+	return value.replace(/[&<>"']/g, (c) => ({
+		"&": "&amp;",
+		"<": "&lt;",
+		">": "&gt;",
+		"\"": "&quot;",
+		"'": "&#39;"
+	})[c] ?? c);
+}
 function renderLoginPage(options) {
 	const { action, field, error, redirectTo, redirectField } = options;
 	const hidden = redirectField && redirectTo ? `<input type="hidden" name="${escapeHtml(redirectField)}" value="${escapeHtml(redirectTo)}">` : "";
@@ -1521,12 +1278,6 @@ function renderLoginPage(options) {
 }
 //#endregion
 //#region src/lib/static.ts
-/**
-* Static file serving for the bundled dashboard. Deliberately policy-free: what
-* counts as a document, and whether an unauthenticated visitor gets the app or a
-* login page, is decided by the caller (see `instance.ts`). This module only
-* answers "is there such a file, and what headers does it want".
-*/
 const CONTENT_TYPES = {
 	".html": "text/html; charset=utf-8",
 	".js": "text/javascript; charset=utf-8",
@@ -1552,18 +1303,11 @@ function contentTypeFor(pathname) {
 	if (dot < 0) return "application/octet-stream";
 	return CONTENT_TYPES[pathname.slice(dot).toLowerCase()] ?? "application/octet-stream";
 }
-/** A request for a file rather than an app route: anything with a known extension. */
 function looksLikeAsset(pathname) {
 	const dot = pathname.lastIndexOf(".");
 	if (dot < 0) return false;
 	return pathname.slice(dot).toLowerCase() in CONTENT_TYPES;
 }
-/**
-* Resolve `pathname` inside `root`, or null if it escapes. Vite emits every
-* asset under a content-hashed name, so the only paths that ever reach here are
-* ones the app itself generated — but this server is reachable by anything that
-* can open a socket, and `..` in a URL is the oldest trick there is.
-*/
 function resolveWithinRoot(root, pathname) {
 	let decoded;
 	try {
@@ -1589,12 +1333,6 @@ function sendHtml(req, res, status, html, cache) {
 	});
 	res.end(req.method === "HEAD" ? void 0 : body);
 }
-/**
-* Stream a file out of `root`. `immutable` is the caller's call, because it is a
-* promise about the URL, not the file: Vite's hashed assets can be cached
-* forever, but index.html must be revalidated every time or a deployed update
-* never reaches a browser that already has the old one.
-*/
 async function serveFile(req, res, filePath, options = {}) {
 	if (req.method !== "GET" && req.method !== "HEAD") return "method-not-allowed";
 	let size;
@@ -1628,27 +1366,10 @@ async function serveFile(req, res, filePath, options = {}) {
 }
 //#endregion
 //#region src/lib/instance.ts
-/**
-* The dashboard comes from `@workerdeck/web`, which ships it prebuilt and
-* exports the path to it. Depending on the package rather than vendoring a copy
-* means one dashboard, versioned in lockstep with everything else.
-*
-* In a checkout that directory only exists once the app has been built — dev
-* never builds — so the miss is worth a real message rather than a stack trace
-* from the static host.
-*/
 function resolveWebRoot() {
 	if (existsSync(join(dashboardDir, "index.html"))) return dashboardDir;
 	throw new Error(`no dashboard build at ${dashboardDir}\n  in a checkout: pnpm --filter @workerdeck/web run build`);
 }
-/**
-* The Host-header gate for an unauthenticated instance. `allowedHosts` is null
-* whenever auth is on, and then this is the identity function — with a
-* credential in play a rebound origin holds no cookie and fails `authenticate`
-* anyway. Loopback *names* are what's checked, not the socket: the attacker in
-* this scenario controls DNS, so the connection genuinely arrives on 127.0.0.1;
-* what they cannot control is the name the victim's browser writes into Host.
-*/
 function createHostGuard(allowedHosts) {
 	if (allowedHosts === null) return () => true;
 	return (req) => {
@@ -1659,8 +1380,6 @@ function createHostGuard(allowedHosts) {
 		return isLoopbackHostname(hostname) || allowedHosts.has(hostname);
 	};
 }
-/** The request path, or null when the target is malformed enough that `URL`
-* refuses it — a caller matching a fixed route wants a miss, not a throw. */
 function pathnameOf(req) {
 	try {
 		return new URL(req.url ?? "/", "http://internal").pathname;
@@ -1668,27 +1387,6 @@ function pathnameOf(req) {
 		return null;
 	}
 }
-/**
-* Everything outside `/v1`. Order matters: the auth endpoints first (they are
-* how a browser gets a session in the first place), then assets, which stay
-* ungated — they are the app's own code, hold no secrets, and gating them would
-* only mean the login page could not be styled by the app it gates. Documents
-* come last, and that is the single place the auth decision is made.
-*
-* The APNs device route sits between auth and assets: it does its own
-* authentication (header only — it is never called by a browser), and it must
-* not fall through to the SPA's catch-all, which would answer a failed
-* registration with a 200 and an HTML document.
-*
-* That last rule holds whether or not a forwarder is configured, which is why
-* the path is claimed unconditionally below. With no `apns` config the route
-* does not exist, and an unclaimed `/apns/devices` reaches the catch-all, where
-* a registration POST draws a 405 (`GET, HEAD`) rather than the documented 404.
-* A client cannot tell that from a broken gateway: the iOS app reads only 404
-* as `unsupported`, so it throws instead, never marks the host synced, and
-* retries on every foreground with a visible error — for what is the normal
-* state of every gateway that never wanted push.
-*/
 function createFallback(auth, webRoot, hostAllowed, apnsRoute) {
 	return async (req, res) => {
 		if (!hostAllowed(req)) {
@@ -1824,6 +1522,7 @@ async function startInstance(config, options = {}) {
 		url,
 		port,
 		closed,
+		drain: (drainOptions) => server.drain(drainOptions),
 		close: async () => {
 			await server.close();
 			await sessions?.flush?.();
@@ -1835,4 +1534,4 @@ async function startInstance(config, options = {}) {
 //#endregion
 export { createApnsForwarder as _, ConfigError as a, createApnsClient as b, isLoopback as c, parseArgs as d, resolveInstanceConfig as f, buildPush as g, materializeAuthKey as h, renderLoginPage as i, isLoopbackHostname as l, createAuthSessionStore as m, resolveWebRoot as n, defaultStateDir as o, createCliAuth as p, startInstance as r, hostnameOf as s, createHostGuard as t, loadConfigFile as u, createDeviceRegistry as v, loadApnsKey as x, createDeviceRoute as y };
 
-//# sourceMappingURL=instance-iBl_fOW2.mjs.map
+//# sourceMappingURL=instance-5sdv2Rrw.mjs.map