zidane 8.2.3 → 8.2.5

package/dist/{ws-CURQ2igk.js → ws-CrD-4Mx6.js}

@@ -1,11 +1,11 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.js";
 import { t as HostIdentityError } from "./connection-BaHd3T-D.js";
-import { i as IpcVersionMismatchError } from "./settings-keys-CPdmkTz7.js";
-import { u as hostRefOf } from "./protocol-BIv1Yuvl.js";
+import { i as IpcVersionMismatchError } from "./settings-keys-CnrJgT1T.js";
+import { u as hostRefOf } from "./protocol-Do_i6Ras.js";
 import { t as keepHostConnected } from "./connection-loop-DSCehV3W.js";
-import { n as displayHostUrl } from "./url-D8KZ7Edw.js";
-import { i as probeUnsavedHost, t as createHostRegistry } from "./registry-eourRLY2.js";
-import { a as hostCaBundle, r as connectWsClient, t as HostAuthError } from "./ws-client-BVljYbdb.js";
+import { n as displayHostUrl } from "./url-D4vG7lzO.js";
+import { i as probeUnsavedHost, t as createHostRegistry } from "./registry-DxPP_tAt.js";
+import { a as hostCaBundle, r as connectWsClient, t as HostAuthError } from "./ws-client-Dond8vT3.js";
 //#region src/ipc/hosts/probe.ts
 /** Bound on one probe: the upgrade, the handshake and `daemon.info`. */
 const HOST_PROBE_TIMEOUT_MS = 1e4;
@@ -281,4 +281,4 @@ function startWsSavedHosts(options) {
 //#endregion
 export { MissingHostTokenError as a, createWsHostRegistry as c, ws_exports as i, probeWsHost as l, probeUnsavedWsHost as n, startSavedHosts as o, startWsSavedHosts as r, HOST_PROBE_TIMEOUT_MS as s, classifyWsFailure as t };
 
-//# sourceMappingURL=ws-CURQ2igk.js.map
+//# sourceMappingURL=ws-CrD-4Mx6.js.map

package/dist/{ws-CURQ2igk.js.map → ws-CrD-4Mx6.js.map}

@@ -1 +1 @@
-{"version":3,"file":"ws-CURQ2igk.js","names":[],"sources":["../src/ipc/hosts/probe.ts","../src/ipc/hosts/saved-hosts.ts","../src/ipc/hosts/ws.ts"],"sourcesContent":["/**\n * The host registry's connection (`src/chat/hosts`): a WebSocket probe that\n * says who answers at a URL with a token, and the registry wired to it.\n */\nimport type { HostErrorCode, HostProbeResult, HostRegistry } from '../../chat/hosts'\nimport { createHostRegistry, displayHostUrl } from '../../chat/hosts'\nimport { hostRefOf } from '../protocol'\nimport { IpcVersionMismatchError } from '../transports/client-core'\nimport { hostCaBundle } from '../transports/tls-trust'\nimport { connectWsClient, HostAuthError } from '../transports/ws-client'\n\n/** Bound on one probe: the upgrade, the handshake and `daemon.info`. */\nexport const HOST_PROBE_TIMEOUT_MS = 10_000\n\nconst TLS_FAILURE = /certificate|self[- ]signed|\\btls\\b|\\bssl\\b|UNABLE_TO_VERIFY|CERT_|ERR_TLS/i\n\nfunction classify(err: unknown): { error: HostErrorCode, message: string } {\n  if (err instanceof HostAuthError) {\n    return err.status === 401\n      ? { error: 'auth', message: 'The host refused the token (401). Create a new one on the server: zidane server token create --name <device>.' }\n      : { error: 'auth', message: err.message }\n  }\n  if (err instanceof IpcVersionMismatchError)\n    return { error: 'protocol', message: err.message }\n  const message = err instanceof Error ? err.message : String(err)\n  if (TLS_FAILURE.test(message))\n    return { error: 'tls', message: `TLS failed: ${message}` }\n  return { error: 'unreachable', message }\n}\n\n/**\n * A failed WebSocket says nothing about why. For `wss://`, ask the same\n * address over HTTPS: a certificate or handshake failure there is a TLS\n * problem, anything else stays \"unreachable\".\n */\nasync function tlsFailure(url: string, signal: AbortSignal): Promise<string | null> {\n  if (!url.startsWith('wss:'))\n    return null\n  try {\n    // No token, and no redirect followed: only the TLS handshake with this origin matters.\n    // The same CAs as the socket (Bun takes them per request; Node uses its process default).\n    const ca = typeof (globalThis as { Bun?: unknown }).Bun !== 'undefined' ? hostCaBundle() : null\n    const response = await fetch(`https:${url.slice('wss:'.length)}`, { redirect: 'manual', signal: AbortSignal.any([signal, AbortSignal.timeout(5000)]), ...(ca ? { tls: { ca } } : {}) } as RequestInit)\n    void response.body?.cancel().catch(() => {})\n    return null\n  }\n  catch (err) {\n    const e = err as { code?: unknown, message?: unknown }\n    const detail = `${typeof e.code === 'string' ? e.code : ''} ${typeof e.message === 'string' ? e.message : ''}`\n    return TLS_FAILURE.test(detail) ? `TLS failed: ${String(e.message ?? e.code)}` : null\n  }\n}\n\n/**\n * Connect, read the host's identity and `daemon.info`, disconnect. Never throws.\n * @param target - URL, token and an optional timeout in milliseconds. The timeout defaults to {@link HOST_PROBE_TIMEOUT_MS}.\n * @returns Who answered and how fast, or a classified failure.\n */\nexport async function probeWsHost(target: { url: string, token: string, timeoutMs?: number }): Promise<HostProbeResult> {\n  const started = performance.now()\n  const signal = AbortSignal.timeout(target.timeoutMs ?? HOST_PROBE_TIMEOUT_MS)\n  let client: Awaited<ReturnType<typeof connectWsClient>> | undefined\n  try {\n    client = await connectWsClient({ url: target.url, token: target.token, heartbeatMs: 0, signal })\n    const hostRef = hostRefOf(client.hello)\n    if (!hostRef)\n      return { ok: false, error: 'protocol', message: `${displayHostUrl(target.url)} runs a zidane too old to say which host it is. Upgrade the server.` }\n    const info = await client.request('daemon.info', {})\n    const serverVersion = info.codeVersion ?? info.appVersion\n    return { ok: true, hostRef, ...(serverVersion ? { serverVersion } : {}), latencyMs: Math.round(performance.now() - started) }\n  }\n  catch (err) {\n    if (signal.aborted && !(err instanceof HostAuthError))\n      return { ok: false, error: 'unreachable', message: `No answer from ${displayHostUrl(target.url)} within ${target.timeoutMs ?? HOST_PROBE_TIMEOUT_MS} ms.` }\n    const classified = classify(err)\n    if (classified.error === 'unreachable') {\n      const tls = await tlsFailure(target.url, signal).catch(() => null)\n      if (tls)\n        return { ok: false, error: 'tls', message: tls }\n    }\n    return { ok: false, ...classified }\n  }\n  finally {\n    client?.close()\n  }\n}\n\n/**\n * The registry in `dataDir`, connecting over WebSocket.\n * @param options - Where the registry keeps its data.\n * @returns The host registry.\n */\nexport function createWsHostRegistry(options: { dataDir: string }): HostRegistry {\n  return createHostRegistry({ dataDir: options.dataDir, probe: probeWsHost })\n}\n","/**\n * A client's saved servers, kept in its host directory: one directory entry\n * and one app-lifetime connection (`connection-loop`) per server in the\n * registry, in step with it. Shared by the TUI and the GUI main process,\n * which each supply their directory (`SavedHostsDirectory`) and how to dial.\n *\n * Saving a server that is already saved (same host id: a new token, a new\n * URL) reconfigures its entry IN PLACE and reconnects: the entry is never\n * removed, so the sessions routed to it stay routed. Only a server leaving\n * the registry (removed here or by another window) or `stop()` removes an\n * entry, and the directory decides what that means for an open session.\n *\n * Every connection is checked against the saved entry's id (the server's\n * `hostId` when it was added): another host answering at the URL is closed\n * at once, reported as `identity` and not retried, so nothing it says is\n * recorded under the saved id. Dialers may check first (`expectHostId`).\n *\n * No WebSocket import: the WebSocket wiring is `./ws.ts`.\n */\nimport type { HostEntry, HostProbeResult, HostRegistry, HostTestResult } from '../../chat/hosts'\nimport type { HostSignal } from '../protocol'\nimport type { IpcClient } from '../transports/client-core'\nimport type { HostConnectionLoop, HostConnectionPatch, HostFailureKind } from './connection-loop'\nimport { displayHostUrl, HostIdentityError } from '../../chat/hosts'\nimport { hostRefOf } from '../protocol'\nimport { keepHostConnected } from './connection-loop'\n\n/** The client's host directory, as the saved servers see it. Keys are host ids. */\nexport interface SavedHostsDirectory {\n  /** The saved servers it holds now, with their URL (a `--host` server excluded). */\n  saved: () => { key: string, url: string }[]\n  /** Add the entry, or reconfigure the one under its key in place (status `connecting`). */\n  upsert: (entry: HostEntry, token: string | undefined) => void\n  /** Applies a connection patch, a new name or a server version to the entry. */\n  update: (key: string, patch: HostConnectionPatch & { name?: string, serverVersion?: string }) => void\n  /** The server left the registry, or the saved servers stopped. */\n  remove: (key: string) => void\n}\n\n/** No token is saved for this server (removed by hand, or another window removed it). */\nexport class MissingHostTokenError extends Error {\n  constructor() {\n    super('No token saved for this server: add it again.')\n    this.name = 'MissingHostTokenError'\n  }\n}\n\n/** Options for {@link startSavedHosts}: the registry, the host directory, the connect function and callbacks. */\nexport interface SavedHostsOptions {\n  /** The registry of saved servers. */\n  registry: HostRegistry\n  /** The client's host directory the entries are kept in. */\n  directory: SavedHostsDirectory\n  /** One connect attempt to a saved server, with its token read fresh. */\n  connect: (entry: HostEntry, token: string, options: { signal: AbortSignal, onClose: () => void }) => Promise<IpcClient>\n  /** `auth`: refused for good. A missing token is always `auth`, another host answering always `identity`. */\n  classify?: (err: unknown) => HostFailureKind\n  /** The add form's test of an unsaved URL + token (`probeUnsavedHost`). */\n  probeUnsaved?: (target: { url: string, token: string }) => Promise<HostProbeResult>\n  /** Saved entries the directory already reaches another way (the TUI's `--host` server). */\n  skip?: (entry: HostEntry) => boolean\n  /** Called with every signal of a connected saved server. */\n  onSignal?: (key: string, signal: HostSignal) => void\n  /** Called when a saved server connects, also after a reconnect. */\n  onConnected?: (key: string, client: IpcClient) => void\n  /** Called when a saved server's connection drops. */\n  onDisconnected?: (key: string) => void\n  /**\n   * Lower backoff bound in milliseconds.\n   * @default 1000\n   */\n  minDelayMs?: number\n  /**\n   * Upper backoff bound in milliseconds.\n   * @default 30000\n   */\n  maxDelayMs?: number\n}\n\n/** Handle returned by {@link startSavedHosts} to list, add, remove, rename, test and retry saved servers. */\nexport interface SavedHostsController {\n  /** The saved hosts, read fresh (other windows share the file). */\n  list: () => HostEntry[]\n  /** Verify, save, connect (in place when already saved). Throws a `HostRegistryError`. */\n  add: (input: { url: string, token: string, name?: string }) => Promise<HostEntry>\n  /** Removes a server from the registry and its entry from the directory. Returns whether it existed. */\n  remove: (id: string) => boolean\n  /** Renames a saved server and returns the updated entry. */\n  rename: (id: string, name: string) => HostEntry\n  /** A saved server (by id), or an unsaved URL + token (the add form's test). */\n  test: (target: string | { id: string } | { url: string, token: string }) => Promise<HostTestResult>\n  /** Reconnect now (after an outage or a token fix). */\n  retry: (id: string) => void\n  /** Reconnect every saved server that is not connected now, its backoff reset (the computer woke up). */\n  retryAll: () => void\n  /** Disconnects every saved server and removes their directory entries. The registry is not changed. */\n  stop: () => void\n}\n\n/**\n * Starts the connections of a client's saved servers and keeps the directory in step with the registry.\n * Each saved server gets a directory entry and a connection loop. A connection whose host id differs from the saved one is closed and reported as `identity`.\n * @param options - Registry, directory and how to dial.\n * @returns A controller over the saved servers.\n */\nexport function startSavedHosts(options: SavedHostsOptions): SavedHostsController {\n  const { registry, directory, skip = () => false } = options\n  const classify = (err: unknown): HostFailureKind => err instanceof MissingHostTokenError ? 'auth' : err instanceof HostIdentityError ? 'identity' : (options.classify?.(err) ?? 'retry')\n\n  /** The saved server, or nobody: a connection from another host is closed before anyone sees it. */\n  const dial = async (entry: HostEntry, token: string, attempt: { signal: AbortSignal, onClose: () => void }): Promise<IpcClient> => {\n    const client = await options.connect(entry, token, attempt)\n    const ref = hostRefOf(client.hello)\n    if (ref?.id === entry.id)\n      return client\n    client.close()\n    throw new HostIdentityError(displayHostUrl(entry.url), ref?.name)\n  }\n  const loops = new Map<string, HostConnectionLoop>()\n\n  const disconnect = (key: string): void => {\n    loops.get(key)?.stop()\n    loops.delete(key)\n  }\n\n  /** (Re)connect `entry` with the token saved now, its directory entry kept or created in place. */\n  const connect = (entry: HostEntry): void => {\n    const key = entry.id\n    disconnect(key)\n    directory.upsert(entry, registry.token(key))\n    loops.set(key, keepHostConnected({\n      connect: (attempt) => {\n        const token = registry.token(key)\n        return token ? dial(entry, token, attempt) : Promise.reject(new MissingHostTokenError())\n      },\n      update: patch => directory.update(key, patch),\n      classify,\n      ...(options.onSignal ? { onSignal: (signal: HostSignal) => options.onSignal!(key, signal) } : {}),\n      ...(options.onConnected ? { onConnected: (client: IpcClient) => options.onConnected!(key, client) } : {}),\n      ...(options.onDisconnected ? { onDisconnected: () => options.onDisconnected!(key) } : {}),\n      ...(options.minDelayMs !== undefined ? { minDelayMs: options.minDelayMs } : {}),\n      ...(options.maxDelayMs !== undefined ? { maxDelayMs: options.maxDelayMs } : {}),\n    }))\n  }\n\n  /** Bring the directory in line with the saved hosts. */\n  const sync = (): void => {\n    const entries = registry.list().filter(entry => !skip(entry))\n    const saved = new Set(entries.map(entry => entry.id))\n    const known = new Map(directory.saved().map(host => [host.key, host.url]))\n    for (const key of known.keys()) {\n      if (!saved.has(key)) {\n        disconnect(key)\n        directory.remove(key)\n      }\n    }\n    for (const entry of entries) {\n      if (known.get(entry.id) !== entry.url)\n        connect(entry)\n      else\n        directory.update(entry.id, { name: entry.name, ...(entry.serverVersion ? { serverVersion: entry.serverVersion } : {}) })\n    }\n  }\n\n  sync()\n  return {\n    list: () => registry.list(),\n    add: async (input) => {\n      const entry = await registry.add(input)\n      // Saved again (a new token or URL): reconnect with them, the entry kept.\n      if (!skip(entry))\n        connect(entry)\n      sync()\n      return entry\n    },\n    remove: (id) => {\n      const removed = registry.remove(id)\n      sync()\n      return removed\n    },\n    rename: (id, name) => {\n      const entry = registry.rename(id, name)\n      sync()\n      return entry\n    },\n    test: async (target) => {\n      if (typeof target === 'object' && !('id' in target)) {\n        if (!options.probeUnsaved)\n          throw new Error('Testing an unsaved host is not available here.')\n        return options.probeUnsaved(target)\n      }\n      const id = typeof target === 'string' ? target : target.id\n      const result = await registry.test(id)\n      if (result.ok) {\n        directory.update(id, { serverName: result.hostRef.name, ...(result.serverVersion ? { serverVersion: result.serverVersion } : {}) })\n        loops.get(id)?.retry()\n      }\n      return result\n    },\n    retry: id => loops.get(id)?.retry(),\n    retryAll: () => {\n      for (const loop of loops.values())\n        loop.retry()\n    },\n    stop: () => {\n      for (const key of [...loops.keys()]) {\n        disconnect(key)\n        directory.remove(key)\n      }\n    },\n  }\n}\n","/**\n * Saved servers over WebSocket: the registry in `dataDir`, the add form's\n * unsaved test, the refusal classification and (by default) the dial, wired\n * for `startSavedHosts`. Loaded behind each client's remote-hosts gate.\n */\nimport type { HostProbeResult } from '../../chat/hosts'\nimport type { HostFailureKind } from './connection-loop'\nimport type { SavedHostsController, SavedHostsOptions } from './saved-hosts'\nimport { HostIdentityError, probeUnsavedHost } from '../../chat/hosts'\nimport { IpcVersionMismatchError } from '../transports/client-core'\nimport { connectWsClient, HostAuthError } from '../transports/ws-client'\nimport { createWsHostRegistry, probeWsHost } from './probe'\nimport { startSavedHosts } from './saved-hosts'\n\n/**\n * A refused token stays refused until the user changes something: no retry\n * loop. Another protocol version stays until one side is upgraded: a slow re-check.\n * @param err - The error a connect attempt failed with.\n * @returns `auth` for a refused token, `identity` for another host answering, `protocol` for a version mismatch, `retry` otherwise.\n */\nexport function classifyWsFailure(err: unknown): HostFailureKind {\n  if (err instanceof HostAuthError)\n    return 'auth'\n  if (err instanceof HostIdentityError)\n    return 'identity'\n  return err instanceof IpcVersionMismatchError ? 'protocol' : 'retry'\n}\n\n/**\n * The add form's \"test\": the registry's own checks and probe over WebSocket, saving nothing.\n * @param target - URL and token to try.\n * @returns The probe result.\n */\nexport function probeUnsavedWsHost(target: { url: string, token: string }): Promise<HostProbeResult> {\n  return probeUnsavedHost(probeWsHost, target)\n}\n\n/**\n * Options for {@link startWsSavedHosts}: {@link SavedHostsOptions} with the registry, dialer and classifier filled in.\n * `dataDir` holds the saved-hosts registry file.\n */\nexport type WsSavedHostsOptions = Omit<SavedHostsOptions, 'registry' | 'connect' | 'classify' | 'probeUnsaved'> & {\n  dataDir: string\n  /** Client version in the server's diagnostics (default dial only). */\n  appVersion?: string\n  /** Dial another way (the TUI goes through its directory entry's transport). Default: `connectWsClient`. */\n  connect?: SavedHostsOptions['connect']\n  registry?: SavedHostsOptions['registry']\n}\n\n/**\n * Keeps the saved servers of a client connected over WebSocket.\n * Uses the registry in `dataDir` unless `registry` is given, and dials with {@link connectWsClient} unless `connect` is given.\n * @param options - Data directory, host directory and callbacks.\n * @returns A controller to list, add, remove, test and retry hosts, and to stop them all.\n */\nexport function startWsSavedHosts(options: WsSavedHostsOptions): SavedHostsController {\n  const { dataDir, appVersion, connect, registry, ...rest } = options\n  return startSavedHosts({\n    ...rest,\n    registry: registry ?? createWsHostRegistry({ dataDir }),\n    classify: classifyWsFailure,\n    probeUnsaved: probeUnsavedWsHost,\n    connect: connect ?? ((entry, token, attempt) => connectWsClient({\n      url: entry.url,\n      token,\n      expectHostId: entry.id,\n      ...(appVersion ? { appVersion } : {}),\n      signal: attempt.signal,\n      onClose: attempt.onClose,\n    })),\n  })\n}\n"],"mappings":";;;;;;;;;;AAYA,MAAa,wBAAwB;AAErC,MAAM,cAAc;AAEpB,SAAS,SAAS,KAAyD;CACzE,IAAI,eAAe,eACjB,OAAO,IAAI,WAAW,MAClB;EAAE,OAAO;EAAQ,SAAS;CAAgH,IAC1I;EAAE,OAAO;EAAQ,SAAS,IAAI;CAAQ;CAE5C,IAAI,eAAe,yBACjB,OAAO;EAAE,OAAO;EAAY,SAAS,IAAI;CAAQ;CACnD,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;CAC/D,IAAI,YAAY,KAAK,OAAO,GAC1B,OAAO;EAAE,OAAO;EAAO,SAAS,eAAe;CAAU;CAC3D,OAAO;EAAE,OAAO;EAAe;CAAQ;AACzC;;;;;;AAOA,eAAe,WAAW,KAAa,QAA6C;CAClF,IAAI,CAAC,IAAI,WAAW,MAAM,GACxB,OAAO;CACT,IAAI;EAGF,MAAM,KAAK,OAAQ,WAAiC,QAAQ,cAAc,aAAa,IAAI;EAE3F,CAAK,MADkB,MAAM,SAAS,IAAI,MAAM,CAAa,KAAK;GAAE,UAAU;GAAU,QAAQ,YAAY,IAAI,CAAC,QAAQ,YAAY,QAAQ,GAAI,CAAC,CAAC;GAAG,GAAI,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;EAAG,CAAgB,EAAA,CACvL,MAAM,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC;EAC3C,OAAO;CACT,SACO,KAAK;EACV,MAAM,IAAI;EACV,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO,GAAG,GAAG,OAAO,EAAE,YAAY,WAAW,EAAE,UAAU;EAC1G,OAAO,YAAY,KAAK,MAAM,IAAI,eAAe,OAAO,EAAE,WAAW,EAAE,IAAI,MAAM;CACnF;AACF;;;;;;AAOA,eAAsB,YAAY,QAAsF;CACtH,MAAM,UAAU,YAAY,IAAI;CAChC,MAAM,SAAS,YAAY,QAAQ,OAAO,aAAA,GAAkC;CAC5E,IAAI;CACJ,IAAI;EACF,SAAS,MAAM,gBAAgB;GAAE,KAAK,OAAO;GAAK,OAAO,OAAO;GAAO,aAAa;GAAG;EAAO,CAAC;EAC/F,MAAM,UAAU,UAAU,OAAO,KAAK;EACtC,IAAI,CAAC,SACH,OAAO;GAAE,IAAI;GAAO,OAAO;GAAY,SAAS,GAAG,eAAe,OAAO,GAAG,EAAE;EAAqE;EACrJ,MAAM,OAAO,MAAM,OAAO,QAAQ,eAAe,CAAC,CAAC;EACnD,MAAM,gBAAgB,KAAK,eAAe,KAAK;EAC/C,OAAO;GAAE,IAAI;GAAM;GAAS,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;GAAI,WAAW,KAAK,MAAM,YAAY,IAAI,IAAI,OAAO;EAAE;CAC9H,SACO,KAAK;EACV,IAAI,OAAO,WAAW,EAAE,eAAe,gBACrC,OAAO;GAAE,IAAI;GAAO,OAAO;GAAe,SAAS,kBAAkB,eAAe,OAAO,GAAG,EAAE,UAAU,OAAO,aAAA,IAAmC;EAAM;EAC5J,MAAM,aAAa,SAAS,GAAG;EAC/B,IAAI,WAAW,UAAU,eAAe;GACtC,MAAM,MAAM,MAAM,WAAW,OAAO,KAAK,MAAM,CAAC,CAAC,YAAY,IAAI;GACjE,IAAI,KACF,OAAO;IAAE,IAAI;IAAO,OAAO;IAAO,SAAS;GAAI;EACnD;EACA,OAAO;GAAE,IAAI;GAAO,GAAG;EAAW;CACpC,UACQ;EACN,QAAQ,MAAM;CAChB;AACF;;;;;;AAOA,SAAgB,qBAAqB,SAA4C;CAC/E,OAAO,mBAAmB;EAAE,SAAS,QAAQ;EAAS,OAAO;CAAY,CAAC;AAC5E;;;;ACtDA,IAAa,wBAAb,cAA2C,MAAM;CAC/C,cAAc;EACZ,MAAM,+CAA+C;EACrD,KAAK,OAAO;CACd;AACF;;;;;;;AA4DA,SAAgB,gBAAgB,SAAkD;CAChF,MAAM,EAAE,UAAU,WAAW,aAAa,UAAU;CACpD,MAAM,YAAY,QAAkC,eAAe,wBAAwB,SAAS,eAAe,oBAAoB,aAAc,QAAQ,WAAW,GAAG,KAAK;;CAGhL,MAAM,OAAO,OAAO,OAAkB,OAAe,YAA8E;EACjI,MAAM,SAAS,MAAM,QAAQ,QAAQ,OAAO,OAAO,OAAO;EAC1D,MAAM,MAAM,UAAU,OAAO,KAAK;EAClC,IAAI,KAAK,OAAO,MAAM,IACpB,OAAO;EACT,OAAO,MAAM;EACb,MAAM,IAAI,kBAAkB,eAAe,MAAM,GAAG,GAAG,KAAK,IAAI;CAClE;CACA,MAAM,wBAAQ,IAAI,IAAgC;CAElD,MAAM,cAAc,QAAsB;EACxC,MAAM,IAAI,GAAG,CAAC,EAAE,KAAK;EACrB,MAAM,OAAO,GAAG;CAClB;;CAGA,MAAM,WAAW,UAA2B;EAC1C,MAAM,MAAM,MAAM;EAClB,WAAW,GAAG;EACd,UAAU,OAAO,OAAO,SAAS,MAAM,GAAG,CAAC;EAC3C,MAAM,IAAI,KAAK,kBAAkB;GAC/B,UAAU,YAAY;IACpB,MAAM,QAAQ,SAAS,MAAM,GAAG;IAChC,OAAO,QAAQ,KAAK,OAAO,OAAO,OAAO,IAAI,QAAQ,OAAO,IAAI,sBAAsB,CAAC;GACzF;GACA,SAAQ,UAAS,UAAU,OAAO,KAAK,KAAK;GAC5C;GACA,GAAI,QAAQ,WAAW,EAAE,WAAW,WAAuB,QAAQ,SAAU,KAAK,MAAM,EAAE,IAAI,CAAC;GAC/F,GAAI,QAAQ,cAAc,EAAE,cAAc,WAAsB,QAAQ,YAAa,KAAK,MAAM,EAAE,IAAI,CAAC;GACvG,GAAI,QAAQ,iBAAiB,EAAE,sBAAsB,QAAQ,eAAgB,GAAG,EAAE,IAAI,CAAC;GACvF,GAAI,QAAQ,eAAe,KAAA,IAAY,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;GAC7E,GAAI,QAAQ,eAAe,KAAA,IAAY,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;EAC/E,CAAC,CAAC;CACJ;;CAGA,MAAM,aAAmB;EACvB,MAAM,UAAU,SAAS,KAAK,CAAC,CAAC,QAAO,UAAS,CAAC,KAAK,KAAK,CAAC;EAC5D,MAAM,QAAQ,IAAI,IAAI,QAAQ,KAAI,UAAS,MAAM,EAAE,CAAC;EACpD,MAAM,QAAQ,IAAI,IAAI,UAAU,MAAM,CAAC,CAAC,KAAI,SAAQ,CAAC,KAAK,KAAK,KAAK,GAAG,CAAC,CAAC;EACzE,KAAK,MAAM,OAAO,MAAM,KAAK,GAC3B,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG;GACnB,WAAW,GAAG;GACd,UAAU,OAAO,GAAG;EACtB;EAEF,KAAK,MAAM,SAAS,SAClB,IAAI,MAAM,IAAI,MAAM,EAAE,MAAM,MAAM,KAChC,QAAQ,KAAK;OAEb,UAAU,OAAO,MAAM,IAAI;GAAE,MAAM,MAAM;GAAM,GAAI,MAAM,gBAAgB,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;EAAG,CAAC;CAE7H;CAEA,KAAK;CACL,OAAO;EACL,YAAY,SAAS,KAAK;EAC1B,KAAK,OAAO,UAAU;GACpB,MAAM,QAAQ,MAAM,SAAS,IAAI,KAAK;GAEtC,IAAI,CAAC,KAAK,KAAK,GACb,QAAQ,KAAK;GACf,KAAK;GACL,OAAO;EACT;EACA,SAAS,OAAO;GACd,MAAM,UAAU,SAAS,OAAO,EAAE;GAClC,KAAK;GACL,OAAO;EACT;EACA,SAAS,IAAI,SAAS;GACpB,MAAM,QAAQ,SAAS,OAAO,IAAI,IAAI;GACtC,KAAK;GACL,OAAO;EACT;EACA,MAAM,OAAO,WAAW;GACtB,IAAI,OAAO,WAAW,YAAY,EAAE,QAAQ,SAAS;IACnD,IAAI,CAAC,QAAQ,cACX,MAAM,IAAI,MAAM,gDAAgD;IAClE,OAAO,QAAQ,aAAa,MAAM;GACpC;GACA,MAAM,KAAK,OAAO,WAAW,WAAW,SAAS,OAAO;GACxD,MAAM,SAAS,MAAM,SAAS,KAAK,EAAE;GACrC,IAAI,OAAO,IAAI;IACb,UAAU,OAAO,IAAI;KAAE,YAAY,OAAO,QAAQ;KAAM,GAAI,OAAO,gBAAgB,EAAE,eAAe,OAAO,cAAc,IAAI,CAAC;IAAG,CAAC;IAClI,MAAM,IAAI,EAAE,CAAC,EAAE,MAAM;GACvB;GACA,OAAO;EACT;EACA,QAAO,OAAM,MAAM,IAAI,EAAE,CAAC,EAAE,MAAM;EAClC,gBAAgB;GACd,KAAK,MAAM,QAAQ,MAAM,OAAO,GAC9B,KAAK,MAAM;EACf;EACA,YAAY;GACV,KAAK,MAAM,OAAO,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG;IACnC,WAAW,GAAG;IACd,UAAU,OAAO,GAAG;GACtB;EACF;CACF;AACF;;;;;;;;;;;;;;AC/LA,SAAgB,kBAAkB,KAA+B;CAC/D,IAAI,eAAe,eACjB,OAAO;CACT,IAAI,eAAe,mBACjB,OAAO;CACT,OAAO,eAAe,0BAA0B,aAAa;AAC/D;;;;;;AAOA,SAAgB,mBAAmB,QAAkE;CACnG,OAAO,iBAAiB,aAAa,MAAM;AAC7C;;;;;;;AAqBA,SAAgB,kBAAkB,SAAoD;CACpF,MAAM,EAAE,SAAS,YAAY,SAAS,UAAU,GAAG,SAAS;CAC5D,OAAO,gBAAgB;EACrB,GAAG;EACH,UAAU,YAAY,qBAAqB,EAAE,QAAQ,CAAC;EACtD,UAAU;EACV,cAAc;EACd,SAAS,aAAa,OAAO,OAAO,YAAY,gBAAgB;GAC9D,KAAK,MAAM;GACX;GACA,cAAc,MAAM;GACpB,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;GACnC,QAAQ,QAAQ;GAChB,SAAS,QAAQ;EACnB,CAAC;CACH,CAAC;AACH"}
+{"version":3,"file":"ws-CrD-4Mx6.js","names":[],"sources":["../src/ipc/hosts/probe.ts","../src/ipc/hosts/saved-hosts.ts","../src/ipc/hosts/ws.ts"],"sourcesContent":["/**\n * The host registry's connection (`src/chat/hosts`): a WebSocket probe that\n * says who answers at a URL with a token, and the registry wired to it.\n */\nimport type { HostErrorCode, HostProbeResult, HostRegistry } from '../../chat/hosts'\nimport { createHostRegistry, displayHostUrl } from '../../chat/hosts'\nimport { hostRefOf } from '../protocol'\nimport { IpcVersionMismatchError } from '../transports/client-core'\nimport { hostCaBundle } from '../transports/tls-trust'\nimport { connectWsClient, HostAuthError } from '../transports/ws-client'\n\n/** Bound on one probe: the upgrade, the handshake and `daemon.info`. */\nexport const HOST_PROBE_TIMEOUT_MS = 10_000\n\nconst TLS_FAILURE = /certificate|self[- ]signed|\\btls\\b|\\bssl\\b|UNABLE_TO_VERIFY|CERT_|ERR_TLS/i\n\nfunction classify(err: unknown): { error: HostErrorCode, message: string } {\n  if (err instanceof HostAuthError) {\n    return err.status === 401\n      ? { error: 'auth', message: 'The host refused the token (401). Create a new one on the server: zidane server token create --name <device>.' }\n      : { error: 'auth', message: err.message }\n  }\n  if (err instanceof IpcVersionMismatchError)\n    return { error: 'protocol', message: err.message }\n  const message = err instanceof Error ? err.message : String(err)\n  if (TLS_FAILURE.test(message))\n    return { error: 'tls', message: `TLS failed: ${message}` }\n  return { error: 'unreachable', message }\n}\n\n/**\n * A failed WebSocket says nothing about why. For `wss://`, ask the same\n * address over HTTPS: a certificate or handshake failure there is a TLS\n * problem, anything else stays \"unreachable\".\n */\nasync function tlsFailure(url: string, signal: AbortSignal): Promise<string | null> {\n  if (!url.startsWith('wss:'))\n    return null\n  try {\n    // No token, and no redirect followed: only the TLS handshake with this origin matters.\n    // The same CAs as the socket (Bun takes them per request; Node uses its process default).\n    const ca = typeof (globalThis as { Bun?: unknown }).Bun !== 'undefined' ? hostCaBundle() : null\n    const response = await fetch(`https:${url.slice('wss:'.length)}`, { redirect: 'manual', signal: AbortSignal.any([signal, AbortSignal.timeout(5000)]), ...(ca ? { tls: { ca } } : {}) } as RequestInit)\n    void response.body?.cancel().catch(() => {})\n    return null\n  }\n  catch (err) {\n    const e = err as { code?: unknown, message?: unknown }\n    const detail = `${typeof e.code === 'string' ? e.code : ''} ${typeof e.message === 'string' ? e.message : ''}`\n    return TLS_FAILURE.test(detail) ? `TLS failed: ${String(e.message ?? e.code)}` : null\n  }\n}\n\n/**\n * Connect, read the host's identity and `daemon.info`, disconnect. Never throws.\n * @param target - URL, token and an optional timeout in milliseconds. The timeout defaults to {@link HOST_PROBE_TIMEOUT_MS}.\n * @returns Who answered and how fast, or a classified failure.\n */\nexport async function probeWsHost(target: { url: string, token: string, timeoutMs?: number }): Promise<HostProbeResult> {\n  const started = performance.now()\n  const signal = AbortSignal.timeout(target.timeoutMs ?? HOST_PROBE_TIMEOUT_MS)\n  let client: Awaited<ReturnType<typeof connectWsClient>> | undefined\n  try {\n    client = await connectWsClient({ url: target.url, token: target.token, heartbeatMs: 0, signal })\n    const hostRef = hostRefOf(client.hello)\n    if (!hostRef)\n      return { ok: false, error: 'protocol', message: `${displayHostUrl(target.url)} runs a zidane too old to say which host it is. Upgrade the server.` }\n    const info = await client.request('daemon.info', {})\n    const serverVersion = info.codeVersion ?? info.appVersion\n    return { ok: true, hostRef, ...(serverVersion ? { serverVersion } : {}), latencyMs: Math.round(performance.now() - started) }\n  }\n  catch (err) {\n    if (signal.aborted && !(err instanceof HostAuthError))\n      return { ok: false, error: 'unreachable', message: `No answer from ${displayHostUrl(target.url)} within ${target.timeoutMs ?? HOST_PROBE_TIMEOUT_MS} ms.` }\n    const classified = classify(err)\n    if (classified.error === 'unreachable') {\n      const tls = await tlsFailure(target.url, signal).catch(() => null)\n      if (tls)\n        return { ok: false, error: 'tls', message: tls }\n    }\n    return { ok: false, ...classified }\n  }\n  finally {\n    client?.close()\n  }\n}\n\n/**\n * The registry in `dataDir`, connecting over WebSocket.\n * @param options - Where the registry keeps its data.\n * @returns The host registry.\n */\nexport function createWsHostRegistry(options: { dataDir: string }): HostRegistry {\n  return createHostRegistry({ dataDir: options.dataDir, probe: probeWsHost })\n}\n","/**\n * A client's saved servers, kept in its host directory: one directory entry\n * and one app-lifetime connection (`connection-loop`) per server in the\n * registry, in step with it. Shared by the TUI and the GUI main process,\n * which each supply their directory (`SavedHostsDirectory`) and how to dial.\n *\n * Saving a server that is already saved (same host id: a new token, a new\n * URL) reconfigures its entry IN PLACE and reconnects: the entry is never\n * removed, so the sessions routed to it stay routed. Only a server leaving\n * the registry (removed here or by another window) or `stop()` removes an\n * entry, and the directory decides what that means for an open session.\n *\n * Every connection is checked against the saved entry's id (the server's\n * `hostId` when it was added): another host answering at the URL is closed\n * at once, reported as `identity` and not retried, so nothing it says is\n * recorded under the saved id. Dialers may check first (`expectHostId`).\n *\n * No WebSocket import: the WebSocket wiring is `./ws.ts`.\n */\nimport type { HostEntry, HostProbeResult, HostRegistry, HostTestResult } from '../../chat/hosts'\nimport type { HostSignal } from '../protocol'\nimport type { IpcClient } from '../transports/client-core'\nimport type { HostConnectionLoop, HostConnectionPatch, HostFailureKind } from './connection-loop'\nimport { displayHostUrl, HostIdentityError } from '../../chat/hosts'\nimport { hostRefOf } from '../protocol'\nimport { keepHostConnected } from './connection-loop'\n\n/** The client's host directory, as the saved servers see it. Keys are host ids. */\nexport interface SavedHostsDirectory {\n  /** The saved servers it holds now, with their URL (a `--host` server excluded). */\n  saved: () => { key: string, url: string }[]\n  /** Add the entry, or reconfigure the one under its key in place (status `connecting`). */\n  upsert: (entry: HostEntry, token: string | undefined) => void\n  /** Applies a connection patch, a new name or a server version to the entry. */\n  update: (key: string, patch: HostConnectionPatch & { name?: string, serverVersion?: string }) => void\n  /** The server left the registry, or the saved servers stopped. */\n  remove: (key: string) => void\n}\n\n/** No token is saved for this server (removed by hand, or another window removed it). */\nexport class MissingHostTokenError extends Error {\n  constructor() {\n    super('No token saved for this server: add it again.')\n    this.name = 'MissingHostTokenError'\n  }\n}\n\n/** Options for {@link startSavedHosts}: the registry, the host directory, the connect function and callbacks. */\nexport interface SavedHostsOptions {\n  /** The registry of saved servers. */\n  registry: HostRegistry\n  /** The client's host directory the entries are kept in. */\n  directory: SavedHostsDirectory\n  /** One connect attempt to a saved server, with its token read fresh. */\n  connect: (entry: HostEntry, token: string, options: { signal: AbortSignal, onClose: () => void }) => Promise<IpcClient>\n  /** `auth`: refused for good. A missing token is always `auth`, another host answering always `identity`. */\n  classify?: (err: unknown) => HostFailureKind\n  /** The add form's test of an unsaved URL + token (`probeUnsavedHost`). */\n  probeUnsaved?: (target: { url: string, token: string }) => Promise<HostProbeResult>\n  /** Saved entries the directory already reaches another way (the TUI's `--host` server). */\n  skip?: (entry: HostEntry) => boolean\n  /** Called with every signal of a connected saved server. */\n  onSignal?: (key: string, signal: HostSignal) => void\n  /** Called when a saved server connects, also after a reconnect. */\n  onConnected?: (key: string, client: IpcClient) => void\n  /** Called when a saved server's connection drops. */\n  onDisconnected?: (key: string) => void\n  /**\n   * Lower backoff bound in milliseconds.\n   * @default 1000\n   */\n  minDelayMs?: number\n  /**\n   * Upper backoff bound in milliseconds.\n   * @default 30000\n   */\n  maxDelayMs?: number\n}\n\n/** Handle returned by {@link startSavedHosts} to list, add, remove, rename, test and retry saved servers. */\nexport interface SavedHostsController {\n  /** The saved hosts, read fresh (other windows share the file). */\n  list: () => HostEntry[]\n  /** Verify, save, connect (in place when already saved). Throws a `HostRegistryError`. */\n  add: (input: { url: string, token: string, name?: string }) => Promise<HostEntry>\n  /** Removes a server from the registry and its entry from the directory. Returns whether it existed. */\n  remove: (id: string) => boolean\n  /** Renames a saved server and returns the updated entry. */\n  rename: (id: string, name: string) => HostEntry\n  /** A saved server (by id), or an unsaved URL + token (the add form's test). */\n  test: (target: string | { id: string } | { url: string, token: string }) => Promise<HostTestResult>\n  /** Reconnect now (after an outage or a token fix). */\n  retry: (id: string) => void\n  /** Reconnect every saved server that is not connected now, its backoff reset (the computer woke up). */\n  retryAll: () => void\n  /** Disconnects every saved server and removes their directory entries. The registry is not changed. */\n  stop: () => void\n}\n\n/**\n * Starts the connections of a client's saved servers and keeps the directory in step with the registry.\n * Each saved server gets a directory entry and a connection loop. A connection whose host id differs from the saved one is closed and reported as `identity`.\n * @param options - Registry, directory and how to dial.\n * @returns A controller over the saved servers.\n */\nexport function startSavedHosts(options: SavedHostsOptions): SavedHostsController {\n  const { registry, directory, skip = () => false } = options\n  const classify = (err: unknown): HostFailureKind => err instanceof MissingHostTokenError ? 'auth' : err instanceof HostIdentityError ? 'identity' : (options.classify?.(err) ?? 'retry')\n\n  /** The saved server, or nobody: a connection from another host is closed before anyone sees it. */\n  const dial = async (entry: HostEntry, token: string, attempt: { signal: AbortSignal, onClose: () => void }): Promise<IpcClient> => {\n    const client = await options.connect(entry, token, attempt)\n    const ref = hostRefOf(client.hello)\n    if (ref?.id === entry.id)\n      return client\n    client.close()\n    throw new HostIdentityError(displayHostUrl(entry.url), ref?.name)\n  }\n  const loops = new Map<string, HostConnectionLoop>()\n\n  const disconnect = (key: string): void => {\n    loops.get(key)?.stop()\n    loops.delete(key)\n  }\n\n  /** (Re)connect `entry` with the token saved now, its directory entry kept or created in place. */\n  const connect = (entry: HostEntry): void => {\n    const key = entry.id\n    disconnect(key)\n    directory.upsert(entry, registry.token(key))\n    loops.set(key, keepHostConnected({\n      connect: (attempt) => {\n        const token = registry.token(key)\n        return token ? dial(entry, token, attempt) : Promise.reject(new MissingHostTokenError())\n      },\n      update: patch => directory.update(key, patch),\n      classify,\n      ...(options.onSignal ? { onSignal: (signal: HostSignal) => options.onSignal!(key, signal) } : {}),\n      ...(options.onConnected ? { onConnected: (client: IpcClient) => options.onConnected!(key, client) } : {}),\n      ...(options.onDisconnected ? { onDisconnected: () => options.onDisconnected!(key) } : {}),\n      ...(options.minDelayMs !== undefined ? { minDelayMs: options.minDelayMs } : {}),\n      ...(options.maxDelayMs !== undefined ? { maxDelayMs: options.maxDelayMs } : {}),\n    }))\n  }\n\n  /** Bring the directory in line with the saved hosts. */\n  const sync = (): void => {\n    const entries = registry.list().filter(entry => !skip(entry))\n    const saved = new Set(entries.map(entry => entry.id))\n    const known = new Map(directory.saved().map(host => [host.key, host.url]))\n    for (const key of known.keys()) {\n      if (!saved.has(key)) {\n        disconnect(key)\n        directory.remove(key)\n      }\n    }\n    for (const entry of entries) {\n      if (known.get(entry.id) !== entry.url)\n        connect(entry)\n      else\n        directory.update(entry.id, { name: entry.name, ...(entry.serverVersion ? { serverVersion: entry.serverVersion } : {}) })\n    }\n  }\n\n  sync()\n  return {\n    list: () => registry.list(),\n    add: async (input) => {\n      const entry = await registry.add(input)\n      // Saved again (a new token or URL): reconnect with them, the entry kept.\n      if (!skip(entry))\n        connect(entry)\n      sync()\n      return entry\n    },\n    remove: (id) => {\n      const removed = registry.remove(id)\n      sync()\n      return removed\n    },\n    rename: (id, name) => {\n      const entry = registry.rename(id, name)\n      sync()\n      return entry\n    },\n    test: async (target) => {\n      if (typeof target === 'object' && !('id' in target)) {\n        if (!options.probeUnsaved)\n          throw new Error('Testing an unsaved host is not available here.')\n        return options.probeUnsaved(target)\n      }\n      const id = typeof target === 'string' ? target : target.id\n      const result = await registry.test(id)\n      if (result.ok) {\n        directory.update(id, { serverName: result.hostRef.name, ...(result.serverVersion ? { serverVersion: result.serverVersion } : {}) })\n        loops.get(id)?.retry()\n      }\n      return result\n    },\n    retry: id => loops.get(id)?.retry(),\n    retryAll: () => {\n      for (const loop of loops.values())\n        loop.retry()\n    },\n    stop: () => {\n      for (const key of [...loops.keys()]) {\n        disconnect(key)\n        directory.remove(key)\n      }\n    },\n  }\n}\n","/**\n * Saved servers over WebSocket: the registry in `dataDir`, the add form's\n * unsaved test, the refusal classification and (by default) the dial, wired\n * for `startSavedHosts`. Loaded behind each client's remote-hosts gate.\n */\nimport type { HostProbeResult } from '../../chat/hosts'\nimport type { HostFailureKind } from './connection-loop'\nimport type { SavedHostsController, SavedHostsOptions } from './saved-hosts'\nimport { HostIdentityError, probeUnsavedHost } from '../../chat/hosts'\nimport { IpcVersionMismatchError } from '../transports/client-core'\nimport { connectWsClient, HostAuthError } from '../transports/ws-client'\nimport { createWsHostRegistry, probeWsHost } from './probe'\nimport { startSavedHosts } from './saved-hosts'\n\n/**\n * A refused token stays refused until the user changes something: no retry\n * loop. Another protocol version stays until one side is upgraded: a slow re-check.\n * @param err - The error a connect attempt failed with.\n * @returns `auth` for a refused token, `identity` for another host answering, `protocol` for a version mismatch, `retry` otherwise.\n */\nexport function classifyWsFailure(err: unknown): HostFailureKind {\n  if (err instanceof HostAuthError)\n    return 'auth'\n  if (err instanceof HostIdentityError)\n    return 'identity'\n  return err instanceof IpcVersionMismatchError ? 'protocol' : 'retry'\n}\n\n/**\n * The add form's \"test\": the registry's own checks and probe over WebSocket, saving nothing.\n * @param target - URL and token to try.\n * @returns The probe result.\n */\nexport function probeUnsavedWsHost(target: { url: string, token: string }): Promise<HostProbeResult> {\n  return probeUnsavedHost(probeWsHost, target)\n}\n\n/**\n * Options for {@link startWsSavedHosts}: {@link SavedHostsOptions} with the registry, dialer and classifier filled in.\n * `dataDir` holds the saved-hosts registry file.\n */\nexport type WsSavedHostsOptions = Omit<SavedHostsOptions, 'registry' | 'connect' | 'classify' | 'probeUnsaved'> & {\n  dataDir: string\n  /** Client version in the server's diagnostics (default dial only). */\n  appVersion?: string\n  /** Dial another way (the TUI goes through its directory entry's transport). Default: `connectWsClient`. */\n  connect?: SavedHostsOptions['connect']\n  registry?: SavedHostsOptions['registry']\n}\n\n/**\n * Keeps the saved servers of a client connected over WebSocket.\n * Uses the registry in `dataDir` unless `registry` is given, and dials with {@link connectWsClient} unless `connect` is given.\n * @param options - Data directory, host directory and callbacks.\n * @returns A controller to list, add, remove, test and retry hosts, and to stop them all.\n */\nexport function startWsSavedHosts(options: WsSavedHostsOptions): SavedHostsController {\n  const { dataDir, appVersion, connect, registry, ...rest } = options\n  return startSavedHosts({\n    ...rest,\n    registry: registry ?? createWsHostRegistry({ dataDir }),\n    classify: classifyWsFailure,\n    probeUnsaved: probeUnsavedWsHost,\n    connect: connect ?? ((entry, token, attempt) => connectWsClient({\n      url: entry.url,\n      token,\n      expectHostId: entry.id,\n      ...(appVersion ? { appVersion } : {}),\n      signal: attempt.signal,\n      onClose: attempt.onClose,\n    })),\n  })\n}\n"],"mappings":";;;;;;;;;;AAYA,MAAa,wBAAwB;AAErC,MAAM,cAAc;AAEpB,SAAS,SAAS,KAAyD;CACzE,IAAI,eAAe,eACjB,OAAO,IAAI,WAAW,MAClB;EAAE,OAAO;EAAQ,SAAS;CAAgH,IAC1I;EAAE,OAAO;EAAQ,SAAS,IAAI;CAAQ;CAE5C,IAAI,eAAe,yBACjB,OAAO;EAAE,OAAO;EAAY,SAAS,IAAI;CAAQ;CACnD,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;CAC/D,IAAI,YAAY,KAAK,OAAO,GAC1B,OAAO;EAAE,OAAO;EAAO,SAAS,eAAe;CAAU;CAC3D,OAAO;EAAE,OAAO;EAAe;CAAQ;AACzC;;;;;;AAOA,eAAe,WAAW,KAAa,QAA6C;CAClF,IAAI,CAAC,IAAI,WAAW,MAAM,GACxB,OAAO;CACT,IAAI;EAGF,MAAM,KAAK,OAAQ,WAAiC,QAAQ,cAAc,aAAa,IAAI;EAE3F,CAAK,MADkB,MAAM,SAAS,IAAI,MAAM,CAAa,KAAK;GAAE,UAAU;GAAU,QAAQ,YAAY,IAAI,CAAC,QAAQ,YAAY,QAAQ,GAAI,CAAC,CAAC;GAAG,GAAI,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;EAAG,CAAgB,EAAA,CACvL,MAAM,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC;EAC3C,OAAO;CACT,SACO,KAAK;EACV,MAAM,IAAI;EACV,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO,GAAG,GAAG,OAAO,EAAE,YAAY,WAAW,EAAE,UAAU;EAC1G,OAAO,YAAY,KAAK,MAAM,IAAI,eAAe,OAAO,EAAE,WAAW,EAAE,IAAI,MAAM;CACnF;AACF;;;;;;AAOA,eAAsB,YAAY,QAAsF;CACtH,MAAM,UAAU,YAAY,IAAI;CAChC,MAAM,SAAS,YAAY,QAAQ,OAAO,aAAA,GAAkC;CAC5E,IAAI;CACJ,IAAI;EACF,SAAS,MAAM,gBAAgB;GAAE,KAAK,OAAO;GAAK,OAAO,OAAO;GAAO,aAAa;GAAG;EAAO,CAAC;EAC/F,MAAM,UAAU,UAAU,OAAO,KAAK;EACtC,IAAI,CAAC,SACH,OAAO;GAAE,IAAI;GAAO,OAAO;GAAY,SAAS,GAAG,eAAe,OAAO,GAAG,EAAE;EAAqE;EACrJ,MAAM,OAAO,MAAM,OAAO,QAAQ,eAAe,CAAC,CAAC;EACnD,MAAM,gBAAgB,KAAK,eAAe,KAAK;EAC/C,OAAO;GAAE,IAAI;GAAM;GAAS,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;GAAI,WAAW,KAAK,MAAM,YAAY,IAAI,IAAI,OAAO;EAAE;CAC9H,SACO,KAAK;EACV,IAAI,OAAO,WAAW,EAAE,eAAe,gBACrC,OAAO;GAAE,IAAI;GAAO,OAAO;GAAe,SAAS,kBAAkB,eAAe,OAAO,GAAG,EAAE,UAAU,OAAO,aAAA,IAAmC;EAAM;EAC5J,MAAM,aAAa,SAAS,GAAG;EAC/B,IAAI,WAAW,UAAU,eAAe;GACtC,MAAM,MAAM,MAAM,WAAW,OAAO,KAAK,MAAM,CAAC,CAAC,YAAY,IAAI;GACjE,IAAI,KACF,OAAO;IAAE,IAAI;IAAO,OAAO;IAAO,SAAS;GAAI;EACnD;EACA,OAAO;GAAE,IAAI;GAAO,GAAG;EAAW;CACpC,UACQ;EACN,QAAQ,MAAM;CAChB;AACF;;;;;;AAOA,SAAgB,qBAAqB,SAA4C;CAC/E,OAAO,mBAAmB;EAAE,SAAS,QAAQ;EAAS,OAAO;CAAY,CAAC;AAC5E;;;;ACtDA,IAAa,wBAAb,cAA2C,MAAM;CAC/C,cAAc;EACZ,MAAM,+CAA+C;EACrD,KAAK,OAAO;CACd;AACF;;;;;;;AA4DA,SAAgB,gBAAgB,SAAkD;CAChF,MAAM,EAAE,UAAU,WAAW,aAAa,UAAU;CACpD,MAAM,YAAY,QAAkC,eAAe,wBAAwB,SAAS,eAAe,oBAAoB,aAAc,QAAQ,WAAW,GAAG,KAAK;;CAGhL,MAAM,OAAO,OAAO,OAAkB,OAAe,YAA8E;EACjI,MAAM,SAAS,MAAM,QAAQ,QAAQ,OAAO,OAAO,OAAO;EAC1D,MAAM,MAAM,UAAU,OAAO,KAAK;EAClC,IAAI,KAAK,OAAO,MAAM,IACpB,OAAO;EACT,OAAO,MAAM;EACb,MAAM,IAAI,kBAAkB,eAAe,MAAM,GAAG,GAAG,KAAK,IAAI;CAClE;CACA,MAAM,wBAAQ,IAAI,IAAgC;CAElD,MAAM,cAAc,QAAsB;EACxC,MAAM,IAAI,GAAG,CAAC,EAAE,KAAK;EACrB,MAAM,OAAO,GAAG;CAClB;;CAGA,MAAM,WAAW,UAA2B;EAC1C,MAAM,MAAM,MAAM;EAClB,WAAW,GAAG;EACd,UAAU,OAAO,OAAO,SAAS,MAAM,GAAG,CAAC;EAC3C,MAAM,IAAI,KAAK,kBAAkB;GAC/B,UAAU,YAAY;IACpB,MAAM,QAAQ,SAAS,MAAM,GAAG;IAChC,OAAO,QAAQ,KAAK,OAAO,OAAO,OAAO,IAAI,QAAQ,OAAO,IAAI,sBAAsB,CAAC;GACzF;GACA,SAAQ,UAAS,UAAU,OAAO,KAAK,KAAK;GAC5C;GACA,GAAI,QAAQ,WAAW,EAAE,WAAW,WAAuB,QAAQ,SAAU,KAAK,MAAM,EAAE,IAAI,CAAC;GAC/F,GAAI,QAAQ,cAAc,EAAE,cAAc,WAAsB,QAAQ,YAAa,KAAK,MAAM,EAAE,IAAI,CAAC;GACvG,GAAI,QAAQ,iBAAiB,EAAE,sBAAsB,QAAQ,eAAgB,GAAG,EAAE,IAAI,CAAC;GACvF,GAAI,QAAQ,eAAe,KAAA,IAAY,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;GAC7E,GAAI,QAAQ,eAAe,KAAA,IAAY,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;EAC/E,CAAC,CAAC;CACJ;;CAGA,MAAM,aAAmB;EACvB,MAAM,UAAU,SAAS,KAAK,CAAC,CAAC,QAAO,UAAS,CAAC,KAAK,KAAK,CAAC;EAC5D,MAAM,QAAQ,IAAI,IAAI,QAAQ,KAAI,UAAS,MAAM,EAAE,CAAC;EACpD,MAAM,QAAQ,IAAI,IAAI,UAAU,MAAM,CAAC,CAAC,KAAI,SAAQ,CAAC,KAAK,KAAK,KAAK,GAAG,CAAC,CAAC;EACzE,KAAK,MAAM,OAAO,MAAM,KAAK,GAC3B,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG;GACnB,WAAW,GAAG;GACd,UAAU,OAAO,GAAG;EACtB;EAEF,KAAK,MAAM,SAAS,SAClB,IAAI,MAAM,IAAI,MAAM,EAAE,MAAM,MAAM,KAChC,QAAQ,KAAK;OAEb,UAAU,OAAO,MAAM,IAAI;GAAE,MAAM,MAAM;GAAM,GAAI,MAAM,gBAAgB,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;EAAG,CAAC;CAE7H;CAEA,KAAK;CACL,OAAO;EACL,YAAY,SAAS,KAAK;EAC1B,KAAK,OAAO,UAAU;GACpB,MAAM,QAAQ,MAAM,SAAS,IAAI,KAAK;GAEtC,IAAI,CAAC,KAAK,KAAK,GACb,QAAQ,KAAK;GACf,KAAK;GACL,OAAO;EACT;EACA,SAAS,OAAO;GACd,MAAM,UAAU,SAAS,OAAO,EAAE;GAClC,KAAK;GACL,OAAO;EACT;EACA,SAAS,IAAI,SAAS;GACpB,MAAM,QAAQ,SAAS,OAAO,IAAI,IAAI;GACtC,KAAK;GACL,OAAO;EACT;EACA,MAAM,OAAO,WAAW;GACtB,IAAI,OAAO,WAAW,YAAY,EAAE,QAAQ,SAAS;IACnD,IAAI,CAAC,QAAQ,cACX,MAAM,IAAI,MAAM,gDAAgD;IAClE,OAAO,QAAQ,aAAa,MAAM;GACpC;GACA,MAAM,KAAK,OAAO,WAAW,WAAW,SAAS,OAAO;GACxD,MAAM,SAAS,MAAM,SAAS,KAAK,EAAE;GACrC,IAAI,OAAO,IAAI;IACb,UAAU,OAAO,IAAI;KAAE,YAAY,OAAO,QAAQ;KAAM,GAAI,OAAO,gBAAgB,EAAE,eAAe,OAAO,cAAc,IAAI,CAAC;IAAG,CAAC;IAClI,MAAM,IAAI,EAAE,CAAC,EAAE,MAAM;GACvB;GACA,OAAO;EACT;EACA,QAAO,OAAM,MAAM,IAAI,EAAE,CAAC,EAAE,MAAM;EAClC,gBAAgB;GACd,KAAK,MAAM,QAAQ,MAAM,OAAO,GAC9B,KAAK,MAAM;EACf;EACA,YAAY;GACV,KAAK,MAAM,OAAO,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG;IACnC,WAAW,GAAG;IACd,UAAU,OAAO,GAAG;GACtB;EACF;CACF;AACF;;;;;;;;;;;;;;AC/LA,SAAgB,kBAAkB,KAA+B;CAC/D,IAAI,eAAe,eACjB,OAAO;CACT,IAAI,eAAe,mBACjB,OAAO;CACT,OAAO,eAAe,0BAA0B,aAAa;AAC/D;;;;;;AAOA,SAAgB,mBAAmB,QAAkE;CACnG,OAAO,iBAAiB,aAAa,MAAM;AAC7C;;;;;;;AAqBA,SAAgB,kBAAkB,SAAoD;CACpF,MAAM,EAAE,SAAS,YAAY,SAAS,UAAU,GAAG,SAAS;CAC5D,OAAO,gBAAgB;EACrB,GAAG;EACH,UAAU,YAAY,qBAAqB,EAAE,QAAQ,CAAC;EACtD,UAAU;EACV,cAAc;EACd,SAAS,aAAa,OAAO,OAAO,YAAY,gBAAgB;GAC9D,KAAK,MAAM;GACX;GACA,cAAc,MAAM;GACpB,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;GACnC,QAAQ,QAAQ;GAChB,SAAS,QAAQ;EACnB,CAAC;CACH,CAAC;AACH"}

package/dist/{ws-client-BVljYbdb.js → ws-client-Dond8vT3.js}

@@ -1,9 +1,9 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.js";
 import { a as errorResponse, i as createJsonRpcEndpoint, o as successResponse } from "./json-rpc-G0rBfEar.js";
 import { i as METHOD_NOT_FOUND, t as HostIdentityError } from "./connection-BaHd3T-D.js";
-import { a as createSignalListeners, o as openIpcClient } from "./settings-keys-CPdmkTz7.js";
-import { u as hostRefOf } from "./protocol-BIv1Yuvl.js";
-import { n as displayHostUrl } from "./url-D8KZ7Edw.js";
+import { a as createSignalListeners, o as openIpcClient } from "./settings-keys-CnrJgT1T.js";
+import { u as hostRefOf } from "./protocol-Do_i6Ras.js";
+import { n as displayHostUrl } from "./url-D4vG7lzO.js";
 import tls from "node:tls";
 //#region src/ipc/transports/tls-trust.ts
 /**
@@ -323,4 +323,4 @@ async function connectWsClient(options) {
 //#endregion
 export { hostCaBundle as a, ws_client_exports as i, HostBusyError as n, trustSystemCertificates as o, connectWsClient as r, HostAuthError as t };
 
-//# sourceMappingURL=ws-client-BVljYbdb.js.map
+//# sourceMappingURL=ws-client-Dond8vT3.js.map

package/dist/{ws-client-BVljYbdb.js.map → ws-client-Dond8vT3.js.map}

@@ -1 +1 @@
-{"version":3,"file":"ws-client-BVljYbdb.js","names":["BunWebSocket"],"sources":["../src/ipc/transports/tls-trust.ts","../src/ipc/transports/ws-auth.ts","../src/ipc/transports/ws-client.ts"],"sourcesContent":["/**\n * Which certificate authorities a client trusts for a remote zidane-server:\n * the runtime's own roots plus the operating system's store (the macOS\n * keychain, the Linux CA bundle). A server behind a private CA, an mkcert\n * certificate or a self-signed one the user trusted in the OS then works\n * like a public one. `NODE_EXTRA_CA_CERTS` adds certificates at launch, in\n * both runtimes.\n *\n * Bun's WebSocket and fetch ignore `tls.setDefaultCACertificates`, so Bun\n * clients (the TUI, `zidane machine share`) pass the bundle with each\n * connection (`hostCaBundle`). Node honors it, so the desktop app's main\n * process trusts the store once, when it turns remote hosts on\n * (`trustSystemCertificates`).\n */\nimport tls from 'node:tls'\n\ntype CaKind = 'default' | 'system' | 'extra'\nconst api = tls as unknown as {\n  getCACertificates?: (kind: CaKind) => string[]\n  setDefaultCACertificates?: (certs: readonly string[]) => void\n}\n\nfunction certificates(kind: CaKind): string[] {\n  try {\n    return api.getCACertificates?.(kind) ?? []\n  }\n  catch {\n    return []\n  }\n}\n\nlet bundle: string[] | null | undefined\n\n/**\n * The runtime's roots, the OS store's and `NODE_EXTRA_CA_CERTS`'s, read once.\n * `null` when the OS store adds nothing (or can't be read): the runtime's\n * default then applies as it is.\n */\nexport function hostCaBundle(): string[] | null {\n  if (bundle === undefined) {\n    const system = certificates('system')\n    bundle = system.length === 0 ? null : [...new Set([...certificates('default'), ...system, ...certificates('extra')])]\n  }\n  return bundle\n}\n\n/**\n * Node: every TLS client of this process trusts {@link hostCaBundle} from now\n * on (the desktop app's main process). Whether it applied.\n */\nexport function trustSystemCertificates(): boolean {\n  const ca = hostCaBundle()\n  if (!ca || !api.setDefaultCACertificates || typeof (globalThis as { Bun?: unknown }).Bun !== 'undefined')\n    return false\n  api.setDefaultCACertificates(ca)\n  return true\n}\n","/**\n * How a WebSocket client's token reaches the server, shared by both ends.\n *\n * Preferred: `Authorization: Bearer <token>` (Bun's WebSocket can set it).\n * Fallback for clients that can't set handshake headers (Node's and the\n * browser's WebSocket): a `zidane.bearer.<token>` entry in\n * `Sec-WebSocket-Protocol`, offered next to `zidane`, the subprotocol the\n * server selects. A token sent this way must be a valid subprotocol token\n * (base64url is).\n */\n\n/** The subprotocol clients offer and the server selects. */\nexport const WS_SUBPROTOCOL = 'zidane'\n/** Prefix of the subprotocol entry carrying the bearer token. */\nexport const WS_BEARER_PREFIX = 'zidane.bearer.'\n\nexport type WsTokenCarrier = 'header' | 'subprotocol'\n\n/**\n * What an accepted connection is: a `client` (a window: the whole method\n * table, signals) or a `machine` lending its execution (`docs/MACHINES.md`:\n * only `ipc.hello`, `$/ping`, `machine.register`, never a peer). Default `client`.\n */\nexport type WsConnectionScope = 'client' | 'machine'\n\n/**\n * A server's answer to an upgrade's token. Accepted: `principal` names what\n * authenticated (a token id), so connections can be dropped by it later.\n * Refused: the HTTP status, sent before any JSON-RPC (401 no valid\n * credential, 403 a credential not allowed here).\n */\nexport type WsAuthVerdict\n  = | { ok: true, principal?: string, scope?: WsConnectionScope }\n    | { ok: false, status: 401 | 403, reason?: WsRefusalReason }\n\n/**\n * Why a server refused an upgrade with a 403, as a machine-readable code in\n * {@link WS_REFUSAL_HEADER}. Clients show a fixed text per code (never the\n * response body, which a proxy may fill with anything, the request's own\n * headers included) and ignore codes they don't know.\n */\nexport const WS_REFUSAL_HEADER = 'X-Zidane-Refusal'\nconst WS_REFUSAL_REASONS = ['origin', 'insecure-transport', 'untrusted-proxy', 'scope'] as const\nexport type WsRefusalReason = typeof WS_REFUSAL_REASONS[number]\n\nexport function isWsRefusalReason(value: unknown): value is WsRefusalReason {\n  return typeof value === 'string' && (WS_REFUSAL_REASONS as readonly string[]).includes(value)\n}\n\n/** Subprotocols offered in `Sec-WebSocket-Protocol`. */\nexport function offeredSubprotocols(request: Request): string[] {\n  return (request.headers.get('sec-websocket-protocol') ?? '').split(',').map(p => p.trim()).filter(Boolean)\n}\n\n/** The client's token: `Authorization: Bearer`, else the subprotocol entry. */\nexport function requestToken(request: Request): string | undefined {\n  const auth = request.headers.get('authorization')\n  const bearer = auth && /^Bearer\\s+(\\S+)$/i.exec(auth.trim())\n  if (bearer)\n    return bearer[1]\n  const entry = offeredSubprotocols(request).find(p => p.startsWith(WS_BEARER_PREFIX))\n  return entry ? entry.slice(WS_BEARER_PREFIX.length) : undefined\n}\n","/**\n * `IpcClient` over a WebSocket (a remote `zidane-server`, `./ws-server`):\n * one JSON-RPC message per text frame, the same handshake, deadlines and\n * signal delivery as the unix-socket client (`./client-core`).\n *\n * Uses the runtime's global `WebSocket` (Bun; Node >= 22), so it is safe in\n * the Node-imported `zidane/ipc` barrel. Unlike a local daemon client it\n * never asks the host to drain on a version mismatch (a remote server's\n * lifetime is not a client's to end) and opts out of the dev build fence.\n *\n * Opening is bounded (`openTimeoutMs`) and abortable (`signal`, up to the\n * end of the handshake). A refused upgrade is opaque to a WebSocket (no\n * status, just \"expected 101\", close 1002), so on failure the client asks\n * the same URL over plain HTTP, with the same token, why: a 401 or 403\n * becomes a {@link HostAuthError}, a 429 a {@link HostBusyError}, each with a\n * fixed message (the response body\n * is never read: a proxy may echo the request's headers, the token\n * included, and the message reaches a GUI renderer). That request never\n * follows a redirect: a 3xx is reported as a misconfigured URL, and the\n * token goes nowhere but the URL's own origin.\n *\n * Messages name the URL by scheme, host and path only (`displayHostUrl`).\n *\n * Certificates: the runtime's roots and the OS store (`./tls-trust`). Under\n * Bun the bundle goes with each socket and refusal probe; under Node the\n * process default applies (the desktop app sets it).\n */\nimport type { IpcClient } from './client-core'\nimport type { WsRefusalReason, WsTokenCarrier } from './ws-auth'\nimport { createJsonRpcEndpoint, errorResponse, successResponse } from '../../acp/json-rpc'\nimport { HostIdentityError, METHOD_NOT_FOUND } from '../../chat/hosts/connection'\nimport { displayHostUrl } from '../../chat/hosts/url'\nimport { hostRefOf } from '../protocol'\nimport { createSignalListeners, openIpcClient } from './client-core'\nimport { hostCaBundle } from './tls-trust'\nimport { isWsRefusalReason, WS_BEARER_PREFIX, WS_REFUSAL_HEADER, WS_SUBPROTOCOL } from './ws-auth'\n\n/** Options for {@link connectWsClient}. */\nexport interface WsClientOptions {\n  /** `ws://` or `wss://` URL of the server. */\n  url: string\n  /** Bearer token for the server, see `./ws-auth`. */\n  token?: string\n  /**\n   * How the token travels. Default: the `Authorization` header where the\n   * runtime's WebSocket can set one (Bun), else the subprotocol fallback.\n   */\n  tokenCarrier?: WsTokenCarrier\n  /** Client zidane version, surfaced in the host's diagnostics. */\n  appVersion?: string\n  /**\n   * Certificate authorities (PEM) a `wss://` server's certificate may chain\n   * to. Default: the runtime's roots and the OS store (`hostCaBundle`). Bun\n   * only: under Node the process default applies.\n   */\n  ca?: readonly string[]\n  /** The connection dropped (server exit, network error, a missed deadline or heartbeat). Not called for `close()`. */\n  onClose?: () => void\n  /** `$/ping` interval (`./client-core`). Default {@link WS_HEARTBEAT_MS}; `0` disables. */\n  heartbeatMs?: number\n  /** Bound on the upgrade (not the handshake, which has its own). Default {@link WS_OPEN_TIMEOUT_MS}. */\n  openTimeoutMs?: number\n  /** Abandon the connect (upgrade and handshake): it rejects with the signal's reason. */\n  signal?: AbortSignal\n  /**\n   * The host id a saved host answered with when it was added: a hello with\n   * any other id closes the connection and rejects with a\n   * {@link HostIdentityError} (nothing is read from that host).\n   */\n  expectHostId?: string\n  /**\n   * Answer the host's requests and notifications on this connection: a\n   * machine serving its host (`docs/MACHINES.md`). A throw becomes a\n   * JSON-RPC error (its `code` when it carries one). Default: a client\n   * refuses requests and reads only `ipc.signal`.\n   */\n  serve?: {\n    request: (method: string, params: unknown) => Promise<unknown>\n    notification?: (method: string, params: unknown) => void\n  }\n}\n\n/** Heartbeat interval on both ends of a WebSocket by default. */\nexport const WS_HEARTBEAT_MS = 20_000\n/** How long an upgrade may take by default. */\nconst WS_OPEN_TIMEOUT_MS = 15_000\n\nconst FORBIDDEN: Record<WsRefusalReason, string> = {\n  'origin': 'this client\\'s origin is not allowed by the server (allowedOrigins)',\n  'insecure-transport': 'the server only accepts connections through its HTTPS proxy',\n  'untrusted-proxy': 'the server only accepts connections from its trusted proxies',\n  'scope': 'this token\\'s scope cannot open a client connection',\n}\n\n/**\n * The server refused this client's credential: 401 (no valid token) or 403\n * (not allowed here). `reason` only when the server sent a code clients know.\n */\nexport class HostAuthError extends Error {\n  /** The server URL, scheme, host and path only. */\n  readonly url: string\n  /**\n   * @param url - The server URL.\n   * @param status - HTTP status of the refusal.\n   * @param reason - Refusal code the server sent, when any.\n   */\n  constructor(url: string, readonly status: 401 | 403, readonly reason?: WsRefusalReason) {\n    const shown = displayHostUrl(url)\n    super(`WebSocket connection to ${shown} failed: ${status === 401\n      ? 'token refused (401): the server does not know this token, or it was revoked. Create a new one on the server (zidane server token create --name <device>) and use it here'\n      : `forbidden (403): ${reason ? FORBIDDEN[reason] : 'refused by the server or a proxy in front of it (origin, token scope or proxy rules)'}`}.`)\n    this.name = 'HostAuthError'\n    this.url = shown\n  }\n}\n\n/** The server turned the upgrade down with a 429: too many open connections (per token, per address) or upgrades (per address). Transient. */\nexport class HostBusyError extends Error {\n  /** @param url - The server URL. */\n  constructor(url: string) {\n    super(`WebSocket connection to ${displayHostUrl(url)} failed: too many connections or connection attempts (429). The server caps open connections per token and per address: close other windows that use this token, or wait a few seconds.`)\n    this.name = 'HostBusyError'\n  }\n}\n\n/** The URL answered with a redirect: not followed (the token would go along). */\nexport class HostRedirectError extends Error {\n  constructor(url: string, status: number) {\n    super(`WebSocket connection to ${displayHostUrl(url)} failed: the server redirects (${status}); not following it with the token. Check the URL (scheme, host, path) or the proxy in front of the server.`)\n    this.name = 'HostRedirectError'\n  }\n}\n\n/** Bun's WebSocket and fetch take handshake headers and TLS options; the WHATWG ones (Node, browsers) do not. */\nconst isBun = (): boolean => typeof (globalThis as { Bun?: unknown }).Bun !== 'undefined'\n\n/** Under Bun, the CAs to pass along for a `wss:` / `https:` URL; `null`: the runtime's default. */\nfunction bunCa(options: WsClientOptions): readonly string[] | null {\n  return isBun() && /^(?:wss|https):/i.test(options.url) ? options.ca ?? hostCaBundle() : null\n}\n\nfunction createSocket(options: WsClientOptions): WebSocket {\n  const protocols = [WS_SUBPROTOCOL]\n  const carrier = options.tokenCarrier ?? (isBun() ? 'header' : 'subprotocol')\n  if (options.token && carrier === 'subprotocol')\n    protocols.push(`${WS_BEARER_PREFIX}${options.token}`)\n  const headers = options.token && carrier === 'header' ? { Authorization: `Bearer ${options.token}` } : null\n  const ca = bunCa(options)\n  if (headers || ca) {\n    // Bun's constructor extension: `{ headers, protocols, tls }` in place of the protocol list.\n    const BunWebSocket = WebSocket as unknown as new (url: string, init: { headers?: Record<string, string>, protocols: string[], tls?: { ca: readonly string[] } }) => WebSocket\n    return new BunWebSocket(options.url, { ...(headers ? { headers } : {}), protocols, ...(ca ? { tls: { ca } } : {}) })\n  }\n  return new WebSocket(options.url, protocols)\n}\n\n/** The upgrade took longer than `openTimeoutMs`: nothing answered, so there is no refusal to ask about. */\nclass WsOpenTimeoutError extends Error {\n  constructor(url: string, timeoutMs: number) {\n    super(`WebSocket connection to ${displayHostUrl(url)} timed out after ${timeoutMs} ms.`)\n    this.name = 'WsOpenTimeoutError'\n  }\n}\n\nfunction abortError(signal: AbortSignal): Error {\n  return signal.reason instanceof Error ? signal.reason : new DOMException('The connect was aborted.', 'AbortError')\n}\n\n/** Resolves on `open`; rejects on failure, timeout or abort (closing the socket). */\nfunction opened(ws: WebSocket, url: string, timeoutMs: number, signal: AbortSignal | undefined): Promise<void> {\n  return new Promise((resolve, reject) => {\n    const done = new AbortController()\n    let timer: ReturnType<typeof setTimeout> | undefined\n    const settle = (err?: Error): void => {\n      if (done.signal.aborted)\n        return\n      done.abort()\n      clearTimeout(timer)\n      if (!err)\n        return resolve()\n      ws.close()\n      reject(err)\n    }\n    const fail = (detail: string) => () => settle(new Error(`WebSocket connection to ${displayHostUrl(url)} failed${detail}.`))\n    ws.addEventListener('open', () => settle(), { signal: done.signal })\n    ws.addEventListener('error', fail(''), { signal: done.signal })\n    ws.addEventListener('close', event => fail(` (close ${event.code}${event.reason ? `: ${event.reason}` : ''})`)(), { signal: done.signal })\n    signal?.addEventListener('abort', () => settle(abortError(signal)), { signal: done.signal })\n    timer = setTimeout(() => settle(new WsOpenTimeoutError(url, timeoutMs)), timeoutMs)\n  })\n}\n\n/** Why an upgrade failed, asked over plain HTTP: a {@link HostAuthError} for 401 / 403, a {@link HostBusyError} for 429, a {@link HostRedirectError} for 3xx, else `null`. */\nasync function refusal(options: WsClientOptions): Promise<Error | null> {\n  try {\n    const url = new URL(options.url)\n    url.protocol = url.protocol === 'wss:' ? 'https:' : 'http:'\n    const timeout = AbortSignal.timeout(5000)\n    const ca = bunCa(options)\n    const response = await fetch(url, {\n      headers: options.token ? { Authorization: `Bearer ${options.token}` } : {},\n      redirect: 'manual',\n      signal: options.signal ? AbortSignal.any([options.signal, timeout]) : timeout,\n      // Bun's fetch extension, as for the socket.\n      ...(ca ? { tls: { ca } } : {}),\n    } as RequestInit)\n    void response.body?.cancel().catch(() => {})\n    if (response.type === 'opaqueredirect' || (response.status >= 300 && response.status < 400))\n      return new HostRedirectError(options.url, response.status)\n    if (response.status === 429)\n      return new HostBusyError(options.url)\n    if (response.status !== 401 && response.status !== 403)\n      return null\n    const reason = response.headers.get(WS_REFUSAL_HEADER)\n    return new HostAuthError(options.url, response.status, response.status === 403 && isWsRefusalReason(reason) ? reason : undefined)\n  }\n  catch {\n    return null\n  }\n}\n\n/** Close a connection whose host is not the one expected, and say so. */\nfunction checkIdentity(client: IpcClient, options: WsClientOptions): IpcClient {\n  if (options.expectHostId === undefined)\n    return client\n  const ref = hostRefOf(client.hello)\n  if (ref?.id === options.expectHostId)\n    return client\n  client.close()\n  throw new HostIdentityError(displayHostUrl(options.url), ref?.name)\n}\n\n/**\n * Connects to a remote zidane server over WebSocket and completes the `ipc.hello` handshake.\n * A refused upgrade rejects with {@link HostAuthError} for a 401 or 403, and {@link HostBusyError} for a 429. A hello from another host than `expectHostId` rejects with `HostIdentityError`. A version mismatch rejects with {@link IpcVersionMismatchError} and leaves the server running.\n * @param options - Server URL, token and connection settings.\n * @returns A typed client.\n * @example\n * ```ts\n * import { connectWsClient } from 'zidane/ipc/remote'\n *\n * const client = await connectWsClient({\n *   url: 'wss://zidane.example.com/',\n *   token: process.env.ZIDANE_HOST_TOKEN,\n * })\n * const sessions = await client.request('sessions.list', {})\n * console.log(sessions.length)\n * client.close()\n * ```\n */\nexport async function connectWsClient(options: WsClientOptions): Promise<IpcClient> {\n  const { signal } = options\n  signal?.throwIfAborted()\n  const ws = createSocket(options)\n  ws.binaryType = 'arraybuffer'\n  try {\n    await opened(ws, options.url, options.openTimeoutMs ?? WS_OPEN_TIMEOUT_MS, signal)\n  }\n  catch (err) {\n    if (signal?.aborted || err instanceof WsOpenTimeoutError)\n      throw err\n    throw (await refusal(options)) ?? err\n  }\n\n  const signals = createSignalListeners()\n  let closed = false\n\n  const rpc = createJsonRpcEndpoint({\n    send: (json) => {\n      try {\n        ws.send(json)\n      }\n      catch {\n        // A closing socket: the close handler fails what is pending.\n      }\n    },\n    // The host never sends requests to clients, only notifications; a machine serves them.\n    onRequest: async (message) => {\n      const serve = options.serve\n      if (!serve)\n        return errorResponse(message.id, METHOD_NOT_FOUND, 'Clients do not accept requests.')\n      try {\n        return successResponse(message.id, (await serve.request(message.method, message.params)) ?? null)\n      }\n      catch (err) {\n        const code = (err as { code?: unknown }).code\n        return errorResponse(message.id, typeof code === 'number' ? code : -32000, err instanceof Error ? err.message : String(err))\n      }\n    },\n    onNotification: (message) => {\n      if (message.method === 'ipc.signal' || !options.serve?.notification)\n        return signals.onNotification(message)\n      options.serve.notification(message.method, (message as { params?: unknown }).params)\n    },\n  })\n\n  const decoder = new TextDecoder()\n  ws.addEventListener('message', (event: MessageEvent) => {\n    if (closed)\n      return\n    rpc.receive(typeof event.data === 'string' ? event.data : decoder.decode(event.data as ArrayBuffer))\n  })\n\n  /** The host went away (or the connection was given up): fail what is pending, tell the owner. */\n  const lost = (): void => {\n    if (closed)\n      return\n    closed = true\n    rpc.close()\n    options.onClose?.()\n  }\n  ws.addEventListener('close', lost)\n  ws.addEventListener('error', () => {\n    // 'close' follows.\n  })\n\n  const close = (): void => {\n    if (closed)\n      return\n    closed = true\n    rpc.close()\n    ws.close(1000)\n  }\n\n  // Aborted mid-handshake: the close fails the pending hello, and the connect rejects with the signal's reason.\n  const onAbort = (): void => close()\n  signal?.addEventListener('abort', onAbort, { once: true })\n  try {\n    return checkIdentity(await openIpcClient(\n      {\n        rpc,\n        close,\n        abort: () => {\n          lost()\n          ws.close(1000)\n        },\n        where: displayHostUrl(options.url),\n      },\n      signals.listeners,\n      {\n        ...(options.appVersion ? { appVersion: options.appVersion } : {}),\n        drain: 'never',\n        buildFence: false,\n        heartbeatMs: options.heartbeatMs ?? WS_HEARTBEAT_MS,\n      },\n    ), options)\n  }\n  catch (err) {\n    throw signal?.aborted ? abortError(signal) : err\n  }\n  finally {\n    signal?.removeEventListener('abort', onAbort)\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAiBA,MAAM,MAAM;AAKZ,SAAS,aAAa,MAAwB;CAC5C,IAAI;EACF,OAAO,IAAI,oBAAoB,IAAI,KAAK,CAAC;CAC3C,QACM;EACJ,OAAO,CAAC;CACV;AACF;AAEA,IAAI;;;;;;AAOJ,SAAgB,eAAgC;CAC9C,IAAI,WAAW,KAAA,GAAW;EACxB,MAAM,SAAS,aAAa,QAAQ;EACpC,SAAS,OAAO,WAAW,IAAI,OAAO,CAAC,mBAAG,IAAI,IAAI;GAAC,GAAG,aAAa,SAAS;GAAG,GAAG;GAAQ,GAAG,aAAa,OAAO;EAAC,CAAC,CAAC;CACtH;CACA,OAAO;AACT;;;;;AAMA,SAAgB,0BAAmC;CACjD,MAAM,KAAK,aAAa;CACxB,IAAI,CAAC,MAAM,CAAC,IAAI,4BAA4B,OAAQ,WAAiC,QAAQ,aAC3F,OAAO;CACT,IAAI,yBAAyB,EAAE;CAC/B,OAAO;AACT;;;;;;;;;;;;;;AC5CA,MAAa,iBAAiB;;AAE9B,MAAa,mBAAmB;;;;;;;AA2BhC,MAAa,oBAAoB;AACjC,MAAM,qBAAqB;CAAC;CAAU;CAAsB;CAAmB;AAAO;AAGtF,SAAgB,kBAAkB,OAA0C;CAC1E,OAAO,OAAO,UAAU,YAAa,mBAAyC,SAAS,KAAK;AAC9F;;;;;;;;;;;ACoCA,MAAa,kBAAkB;;AAE/B,MAAM,qBAAqB;AAE3B,MAAM,YAA6C;CACjD,UAAU;CACV,sBAAsB;CACtB,mBAAmB;CACnB,SAAS;AACX;;;;;AAMA,IAAa,gBAAb,cAAmC,MAAM;CAQL;CAA4B;;CAN9D;;;;;;CAMA,YAAY,KAAa,QAA4B,QAAmC;EACtF,MAAM,QAAQ,eAAe,GAAG;EAChC,MAAM,2BAA2B,MAAM,WAAW,WAAW,MACzD,6KACA,oBAAoB,SAAS,UAAU,UAAU,yFAAyF,EAAE;EAJhH,KAAA,SAAA;EAA4B,KAAA,SAAA;EAK5D,KAAK,OAAO;EACZ,KAAK,MAAM;CACb;AACF;;AAGA,IAAa,gBAAb,cAAmC,MAAM;;CAEvC,YAAY,KAAa;EACvB,MAAM,2BAA2B,eAAe,GAAG,EAAE,wLAAwL;EAC7O,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,oBAAb,cAAuC,MAAM;CAC3C,YAAY,KAAa,QAAgB;EACvC,MAAM,2BAA2B,eAAe,GAAG,EAAE,iCAAiC,OAAO,4GAA4G;EACzM,KAAK,OAAO;CACd;AACF;;AAGA,MAAM,cAAuB,OAAQ,WAAiC,QAAQ;;AAG9E,SAAS,MAAM,SAAoD;CACjE,OAAO,MAAM,KAAK,mBAAmB,KAAK,QAAQ,GAAG,IAAI,QAAQ,MAAM,aAAa,IAAI;AAC1F;AAEA,SAAS,aAAa,SAAqC;CACzD,MAAM,YAAY,CAAC,cAAc;CACjC,MAAM,UAAU,QAAQ,iBAAiB,MAAM,IAAI,WAAW;CAC9D,IAAI,QAAQ,SAAS,YAAY,eAC/B,UAAU,KAAK,GAAG,mBAAmB,QAAQ,OAAO;CACtD,MAAM,UAAU,QAAQ,SAAS,YAAY,WAAW,EAAE,eAAe,UAAU,QAAQ,QAAQ,IAAI;CACvG,MAAM,KAAK,MAAM,OAAO;CACxB,IAAI,WAAW,IAGb,OAAO,IAAIA,UAAa,QAAQ,KAAK;EAAE,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAAI;EAAW,GAAI,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;CAAG,CAAC;CAErH,OAAO,IAAI,UAAU,QAAQ,KAAK,SAAS;AAC7C;;AAGA,IAAM,qBAAN,cAAiC,MAAM;CACrC,YAAY,KAAa,WAAmB;EAC1C,MAAM,2BAA2B,eAAe,GAAG,EAAE,mBAAmB,UAAU,KAAK;EACvF,KAAK,OAAO;CACd;AACF;AAEA,SAAS,WAAW,QAA4B;CAC9C,OAAO,OAAO,kBAAkB,QAAQ,OAAO,SAAS,IAAI,aAAa,4BAA4B,YAAY;AACnH;;AAGA,SAAS,OAAO,IAAe,KAAa,WAAmB,QAAgD;CAC7G,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,OAAO,IAAI,gBAAgB;EACjC,IAAI;EACJ,MAAM,UAAU,QAAsB;GACpC,IAAI,KAAK,OAAO,SACd;GACF,KAAK,MAAM;GACX,aAAa,KAAK;GAClB,IAAI,CAAC,KACH,OAAO,QAAQ;GACjB,GAAG,MAAM;GACT,OAAO,GAAG;EACZ;EACA,MAAM,QAAQ,iBAAyB,uBAAO,IAAI,MAAM,2BAA2B,eAAe,GAAG,EAAE,SAAS,OAAO,EAAE,CAAC;EAC1H,GAAG,iBAAiB,cAAc,OAAO,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC;EACnE,GAAG,iBAAiB,SAAS,KAAK,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC;EAC9D,GAAG,iBAAiB,UAAS,UAAS,KAAK,WAAW,MAAM,OAAO,MAAM,SAAS,KAAK,MAAM,WAAW,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC;EACzI,QAAQ,iBAAiB,eAAe,OAAO,WAAW,MAAM,CAAC,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC;EAC3F,QAAQ,iBAAiB,OAAO,IAAI,mBAAmB,KAAK,SAAS,CAAC,GAAG,SAAS;CACpF,CAAC;AACH;;AAGA,eAAe,QAAQ,SAAiD;CACtE,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;EAC/B,IAAI,WAAW,IAAI,aAAa,SAAS,WAAW;EACpD,MAAM,UAAU,YAAY,QAAQ,GAAI;EACxC,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,WAAW,MAAM,MAAM,KAAK;GAChC,SAAS,QAAQ,QAAQ,EAAE,eAAe,UAAU,QAAQ,QAAQ,IAAI,CAAC;GACzE,UAAU;GACV,QAAQ,QAAQ,SAAS,YAAY,IAAI,CAAC,QAAQ,QAAQ,OAAO,CAAC,IAAI;GAEtE,GAAI,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;EAC9B,CAAgB;EAChB,SAAc,MAAM,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC;EAC3C,IAAI,SAAS,SAAS,oBAAqB,SAAS,UAAU,OAAO,SAAS,SAAS,KACrF,OAAO,IAAI,kBAAkB,QAAQ,KAAK,SAAS,MAAM;EAC3D,IAAI,SAAS,WAAW,KACtB,OAAO,IAAI,cAAc,QAAQ,GAAG;EACtC,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,OAAO;EACT,MAAM,SAAS,SAAS,QAAQ,IAAI,iBAAiB;EACrD,OAAO,IAAI,cAAc,QAAQ,KAAK,SAAS,QAAQ,SAAS,WAAW,OAAO,kBAAkB,MAAM,IAAI,SAAS,KAAA,CAAS;CAClI,QACM;EACJ,OAAO;CACT;AACF;;AAGA,SAAS,cAAc,QAAmB,SAAqC;CAC7E,IAAI,QAAQ,iBAAiB,KAAA,GAC3B,OAAO;CACT,MAAM,MAAM,UAAU,OAAO,KAAK;CAClC,IAAI,KAAK,OAAO,QAAQ,cACtB,OAAO;CACT,OAAO,MAAM;CACb,MAAM,IAAI,kBAAkB,eAAe,QAAQ,GAAG,GAAG,KAAK,IAAI;AACpE;;;;;;;;;;;;;;;;;;;AAoBA,eAAsB,gBAAgB,SAA8C;CAClF,MAAM,EAAE,WAAW;CACnB,QAAQ,eAAe;CACvB,MAAM,KAAK,aAAa,OAAO;CAC/B,GAAG,aAAa;CAChB,IAAI;EACF,MAAM,OAAO,IAAI,QAAQ,KAAK,QAAQ,iBAAiB,oBAAoB,MAAM;CACnF,SACO,KAAK;EACV,IAAI,QAAQ,WAAW,eAAe,oBACpC,MAAM;EACR,MAAO,MAAM,QAAQ,OAAO,KAAM;CACpC;CAEA,MAAM,UAAU,sBAAsB;CACtC,IAAI,SAAS;CAEb,MAAM,MAAM,sBAAsB;EAChC,OAAO,SAAS;GACd,IAAI;IACF,GAAG,KAAK,IAAI;GACd,QACM,CAEN;EACF;EAEA,WAAW,OAAO,YAAY;GAC5B,MAAM,QAAQ,QAAQ;GACtB,IAAI,CAAC,OACH,OAAO,cAAc,QAAQ,IAAI,kBAAkB,iCAAiC;GACtF,IAAI;IACF,OAAO,gBAAgB,QAAQ,IAAK,MAAM,MAAM,QAAQ,QAAQ,QAAQ,QAAQ,MAAM,KAAM,IAAI;GAClG,SACO,KAAK;IACV,MAAM,OAAQ,IAA2B;IACzC,OAAO,cAAc,QAAQ,IAAI,OAAO,SAAS,WAAW,OAAO,OAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;GAC7H;EACF;EACA,iBAAiB,YAAY;GAC3B,IAAI,QAAQ,WAAW,gBAAgB,CAAC,QAAQ,OAAO,cACrD,OAAO,QAAQ,eAAe,OAAO;GACvC,QAAQ,MAAM,aAAa,QAAQ,QAAS,QAAiC,MAAM;EACrF;CACF,CAAC;CAED,MAAM,UAAU,IAAI,YAAY;CAChC,GAAG,iBAAiB,YAAY,UAAwB;EACtD,IAAI,QACF;EACF,IAAI,QAAQ,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO,QAAQ,OAAO,MAAM,IAAmB,CAAC;CACrG,CAAC;;CAGD,MAAM,aAAmB;EACvB,IAAI,QACF;EACF,SAAS;EACT,IAAI,MAAM;EACV,QAAQ,UAAU;CACpB;CACA,GAAG,iBAAiB,SAAS,IAAI;CACjC,GAAG,iBAAiB,eAAe,CAEnC,CAAC;CAED,MAAM,cAAoB;EACxB,IAAI,QACF;EACF,SAAS;EACT,IAAI,MAAM;EACV,GAAG,MAAM,GAAI;CACf;CAGA,MAAM,gBAAsB,MAAM;CAClC,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;CACzD,IAAI;EACF,OAAO,cAAc,MAAM,cACzB;GACE;GACA;GACA,aAAa;IACX,KAAK;IACL,GAAG,MAAM,GAAI;GACf;GACA,OAAO,eAAe,QAAQ,GAAG;EACnC,GACA,QAAQ,WACR;GACE,GAAI,QAAQ,aAAa,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;GAC/D,OAAO;GACP,YAAY;GACZ,aAAa,QAAQ,eAAA;EACvB,CACF,GAAG,OAAO;CACZ,SACO,KAAK;EACV,MAAM,QAAQ,UAAU,WAAW,MAAM,IAAI;CAC/C,UACQ;EACN,QAAQ,oBAAoB,SAAS,OAAO;CAC9C;AACF"}
+{"version":3,"file":"ws-client-Dond8vT3.js","names":["BunWebSocket"],"sources":["../src/ipc/transports/tls-trust.ts","../src/ipc/transports/ws-auth.ts","../src/ipc/transports/ws-client.ts"],"sourcesContent":["/**\n * Which certificate authorities a client trusts for a remote zidane-server:\n * the runtime's own roots plus the operating system's store (the macOS\n * keychain, the Linux CA bundle). A server behind a private CA, an mkcert\n * certificate or a self-signed one the user trusted in the OS then works\n * like a public one. `NODE_EXTRA_CA_CERTS` adds certificates at launch, in\n * both runtimes.\n *\n * Bun's WebSocket and fetch ignore `tls.setDefaultCACertificates`, so Bun\n * clients (the TUI, `zidane machine share`) pass the bundle with each\n * connection (`hostCaBundle`). Node honors it, so the desktop app's main\n * process trusts the store once, when it turns remote hosts on\n * (`trustSystemCertificates`).\n */\nimport tls from 'node:tls'\n\ntype CaKind = 'default' | 'system' | 'extra'\nconst api = tls as unknown as {\n  getCACertificates?: (kind: CaKind) => string[]\n  setDefaultCACertificates?: (certs: readonly string[]) => void\n}\n\nfunction certificates(kind: CaKind): string[] {\n  try {\n    return api.getCACertificates?.(kind) ?? []\n  }\n  catch {\n    return []\n  }\n}\n\nlet bundle: string[] | null | undefined\n\n/**\n * The runtime's roots, the OS store's and `NODE_EXTRA_CA_CERTS`'s, read once.\n * `null` when the OS store adds nothing (or can't be read): the runtime's\n * default then applies as it is.\n */\nexport function hostCaBundle(): string[] | null {\n  if (bundle === undefined) {\n    const system = certificates('system')\n    bundle = system.length === 0 ? null : [...new Set([...certificates('default'), ...system, ...certificates('extra')])]\n  }\n  return bundle\n}\n\n/**\n * Node: every TLS client of this process trusts {@link hostCaBundle} from now\n * on (the desktop app's main process). Whether it applied.\n */\nexport function trustSystemCertificates(): boolean {\n  const ca = hostCaBundle()\n  if (!ca || !api.setDefaultCACertificates || typeof (globalThis as { Bun?: unknown }).Bun !== 'undefined')\n    return false\n  api.setDefaultCACertificates(ca)\n  return true\n}\n","/**\n * How a WebSocket client's token reaches the server, shared by both ends.\n *\n * Preferred: `Authorization: Bearer <token>` (Bun's WebSocket can set it).\n * Fallback for clients that can't set handshake headers (Node's and the\n * browser's WebSocket): a `zidane.bearer.<token>` entry in\n * `Sec-WebSocket-Protocol`, offered next to `zidane`, the subprotocol the\n * server selects. A token sent this way must be a valid subprotocol token\n * (base64url is).\n */\n\n/** The subprotocol clients offer and the server selects. */\nexport const WS_SUBPROTOCOL = 'zidane'\n/** Prefix of the subprotocol entry carrying the bearer token. */\nexport const WS_BEARER_PREFIX = 'zidane.bearer.'\n\nexport type WsTokenCarrier = 'header' | 'subprotocol'\n\n/**\n * What an accepted connection is: a `client` (a window: the whole method\n * table, signals) or a `machine` lending its execution (`docs/MACHINES.md`:\n * only `ipc.hello`, `$/ping`, `machine.register`, never a peer). Default `client`.\n */\nexport type WsConnectionScope = 'client' | 'machine'\n\n/**\n * A server's answer to an upgrade's token. Accepted: `principal` names what\n * authenticated (a token id), so connections can be dropped by it later.\n * Refused: the HTTP status, sent before any JSON-RPC (401 no valid\n * credential, 403 a credential not allowed here).\n */\nexport type WsAuthVerdict\n  = | { ok: true, principal?: string, scope?: WsConnectionScope }\n    | { ok: false, status: 401 | 403, reason?: WsRefusalReason }\n\n/**\n * Why a server refused an upgrade with a 403, as a machine-readable code in\n * {@link WS_REFUSAL_HEADER}. Clients show a fixed text per code (never the\n * response body, which a proxy may fill with anything, the request's own\n * headers included) and ignore codes they don't know.\n */\nexport const WS_REFUSAL_HEADER = 'X-Zidane-Refusal'\nconst WS_REFUSAL_REASONS = ['origin', 'insecure-transport', 'untrusted-proxy', 'scope'] as const\nexport type WsRefusalReason = typeof WS_REFUSAL_REASONS[number]\n\nexport function isWsRefusalReason(value: unknown): value is WsRefusalReason {\n  return typeof value === 'string' && (WS_REFUSAL_REASONS as readonly string[]).includes(value)\n}\n\n/** Subprotocols offered in `Sec-WebSocket-Protocol`. */\nexport function offeredSubprotocols(request: Request): string[] {\n  return (request.headers.get('sec-websocket-protocol') ?? '').split(',').map(p => p.trim()).filter(Boolean)\n}\n\n/** The client's token: `Authorization: Bearer`, else the subprotocol entry. */\nexport function requestToken(request: Request): string | undefined {\n  const auth = request.headers.get('authorization')\n  const bearer = auth && /^Bearer\\s+(\\S+)$/i.exec(auth.trim())\n  if (bearer)\n    return bearer[1]\n  const entry = offeredSubprotocols(request).find(p => p.startsWith(WS_BEARER_PREFIX))\n  return entry ? entry.slice(WS_BEARER_PREFIX.length) : undefined\n}\n","/**\n * `IpcClient` over a WebSocket (a remote `zidane-server`, `./ws-server`):\n * one JSON-RPC message per text frame, the same handshake, deadlines and\n * signal delivery as the unix-socket client (`./client-core`).\n *\n * Uses the runtime's global `WebSocket` (Bun; Node >= 22), so it is safe in\n * the Node-imported `zidane/ipc` barrel. Unlike a local daemon client it\n * never asks the host to drain on a version mismatch (a remote server's\n * lifetime is not a client's to end) and opts out of the dev build fence.\n *\n * Opening is bounded (`openTimeoutMs`) and abortable (`signal`, up to the\n * end of the handshake). A refused upgrade is opaque to a WebSocket (no\n * status, just \"expected 101\", close 1002), so on failure the client asks\n * the same URL over plain HTTP, with the same token, why: a 401 or 403\n * becomes a {@link HostAuthError}, a 429 a {@link HostBusyError}, each with a\n * fixed message (the response body\n * is never read: a proxy may echo the request's headers, the token\n * included, and the message reaches a GUI renderer). That request never\n * follows a redirect: a 3xx is reported as a misconfigured URL, and the\n * token goes nowhere but the URL's own origin.\n *\n * Messages name the URL by scheme, host and path only (`displayHostUrl`).\n *\n * Certificates: the runtime's roots and the OS store (`./tls-trust`). Under\n * Bun the bundle goes with each socket and refusal probe; under Node the\n * process default applies (the desktop app sets it).\n */\nimport type { IpcClient } from './client-core'\nimport type { WsRefusalReason, WsTokenCarrier } from './ws-auth'\nimport { createJsonRpcEndpoint, errorResponse, successResponse } from '../../acp/json-rpc'\nimport { HostIdentityError, METHOD_NOT_FOUND } from '../../chat/hosts/connection'\nimport { displayHostUrl } from '../../chat/hosts/url'\nimport { hostRefOf } from '../protocol'\nimport { createSignalListeners, openIpcClient } from './client-core'\nimport { hostCaBundle } from './tls-trust'\nimport { isWsRefusalReason, WS_BEARER_PREFIX, WS_REFUSAL_HEADER, WS_SUBPROTOCOL } from './ws-auth'\n\n/** Options for {@link connectWsClient}. */\nexport interface WsClientOptions {\n  /** `ws://` or `wss://` URL of the server. */\n  url: string\n  /** Bearer token for the server, see `./ws-auth`. */\n  token?: string\n  /**\n   * How the token travels. Default: the `Authorization` header where the\n   * runtime's WebSocket can set one (Bun), else the subprotocol fallback.\n   */\n  tokenCarrier?: WsTokenCarrier\n  /** Client zidane version, surfaced in the host's diagnostics. */\n  appVersion?: string\n  /**\n   * Certificate authorities (PEM) a `wss://` server's certificate may chain\n   * to. Default: the runtime's roots and the OS store (`hostCaBundle`). Bun\n   * only: under Node the process default applies.\n   */\n  ca?: readonly string[]\n  /** The connection dropped (server exit, network error, a missed deadline or heartbeat). Not called for `close()`. */\n  onClose?: () => void\n  /** `$/ping` interval (`./client-core`). Default {@link WS_HEARTBEAT_MS}; `0` disables. */\n  heartbeatMs?: number\n  /** Bound on the upgrade (not the handshake, which has its own). Default {@link WS_OPEN_TIMEOUT_MS}. */\n  openTimeoutMs?: number\n  /** Abandon the connect (upgrade and handshake): it rejects with the signal's reason. */\n  signal?: AbortSignal\n  /**\n   * The host id a saved host answered with when it was added: a hello with\n   * any other id closes the connection and rejects with a\n   * {@link HostIdentityError} (nothing is read from that host).\n   */\n  expectHostId?: string\n  /**\n   * Answer the host's requests and notifications on this connection: a\n   * machine serving its host (`docs/MACHINES.md`). A throw becomes a\n   * JSON-RPC error (its `code` when it carries one). Default: a client\n   * refuses requests and reads only `ipc.signal`.\n   */\n  serve?: {\n    request: (method: string, params: unknown) => Promise<unknown>\n    notification?: (method: string, params: unknown) => void\n  }\n}\n\n/** Heartbeat interval on both ends of a WebSocket by default. */\nexport const WS_HEARTBEAT_MS = 20_000\n/** How long an upgrade may take by default. */\nconst WS_OPEN_TIMEOUT_MS = 15_000\n\nconst FORBIDDEN: Record<WsRefusalReason, string> = {\n  'origin': 'this client\\'s origin is not allowed by the server (allowedOrigins)',\n  'insecure-transport': 'the server only accepts connections through its HTTPS proxy',\n  'untrusted-proxy': 'the server only accepts connections from its trusted proxies',\n  'scope': 'this token\\'s scope cannot open a client connection',\n}\n\n/**\n * The server refused this client's credential: 401 (no valid token) or 403\n * (not allowed here). `reason` only when the server sent a code clients know.\n */\nexport class HostAuthError extends Error {\n  /** The server URL, scheme, host and path only. */\n  readonly url: string\n  /**\n   * @param url - The server URL.\n   * @param status - HTTP status of the refusal.\n   * @param reason - Refusal code the server sent, when any.\n   */\n  constructor(url: string, readonly status: 401 | 403, readonly reason?: WsRefusalReason) {\n    const shown = displayHostUrl(url)\n    super(`WebSocket connection to ${shown} failed: ${status === 401\n      ? 'token refused (401): the server does not know this token, or it was revoked. Create a new one on the server (zidane server token create --name <device>) and use it here'\n      : `forbidden (403): ${reason ? FORBIDDEN[reason] : 'refused by the server or a proxy in front of it (origin, token scope or proxy rules)'}`}.`)\n    this.name = 'HostAuthError'\n    this.url = shown\n  }\n}\n\n/** The server turned the upgrade down with a 429: too many open connections (per token, per address) or upgrades (per address). Transient. */\nexport class HostBusyError extends Error {\n  /** @param url - The server URL. */\n  constructor(url: string) {\n    super(`WebSocket connection to ${displayHostUrl(url)} failed: too many connections or connection attempts (429). The server caps open connections per token and per address: close other windows that use this token, or wait a few seconds.`)\n    this.name = 'HostBusyError'\n  }\n}\n\n/** The URL answered with a redirect: not followed (the token would go along). */\nexport class HostRedirectError extends Error {\n  constructor(url: string, status: number) {\n    super(`WebSocket connection to ${displayHostUrl(url)} failed: the server redirects (${status}); not following it with the token. Check the URL (scheme, host, path) or the proxy in front of the server.`)\n    this.name = 'HostRedirectError'\n  }\n}\n\n/** Bun's WebSocket and fetch take handshake headers and TLS options; the WHATWG ones (Node, browsers) do not. */\nconst isBun = (): boolean => typeof (globalThis as { Bun?: unknown }).Bun !== 'undefined'\n\n/** Under Bun, the CAs to pass along for a `wss:` / `https:` URL; `null`: the runtime's default. */\nfunction bunCa(options: WsClientOptions): readonly string[] | null {\n  return isBun() && /^(?:wss|https):/i.test(options.url) ? options.ca ?? hostCaBundle() : null\n}\n\nfunction createSocket(options: WsClientOptions): WebSocket {\n  const protocols = [WS_SUBPROTOCOL]\n  const carrier = options.tokenCarrier ?? (isBun() ? 'header' : 'subprotocol')\n  if (options.token && carrier === 'subprotocol')\n    protocols.push(`${WS_BEARER_PREFIX}${options.token}`)\n  const headers = options.token && carrier === 'header' ? { Authorization: `Bearer ${options.token}` } : null\n  const ca = bunCa(options)\n  if (headers || ca) {\n    // Bun's constructor extension: `{ headers, protocols, tls }` in place of the protocol list.\n    const BunWebSocket = WebSocket as unknown as new (url: string, init: { headers?: Record<string, string>, protocols: string[], tls?: { ca: readonly string[] } }) => WebSocket\n    return new BunWebSocket(options.url, { ...(headers ? { headers } : {}), protocols, ...(ca ? { tls: { ca } } : {}) })\n  }\n  return new WebSocket(options.url, protocols)\n}\n\n/** The upgrade took longer than `openTimeoutMs`: nothing answered, so there is no refusal to ask about. */\nclass WsOpenTimeoutError extends Error {\n  constructor(url: string, timeoutMs: number) {\n    super(`WebSocket connection to ${displayHostUrl(url)} timed out after ${timeoutMs} ms.`)\n    this.name = 'WsOpenTimeoutError'\n  }\n}\n\nfunction abortError(signal: AbortSignal): Error {\n  return signal.reason instanceof Error ? signal.reason : new DOMException('The connect was aborted.', 'AbortError')\n}\n\n/** Resolves on `open`; rejects on failure, timeout or abort (closing the socket). */\nfunction opened(ws: WebSocket, url: string, timeoutMs: number, signal: AbortSignal | undefined): Promise<void> {\n  return new Promise((resolve, reject) => {\n    const done = new AbortController()\n    let timer: ReturnType<typeof setTimeout> | undefined\n    const settle = (err?: Error): void => {\n      if (done.signal.aborted)\n        return\n      done.abort()\n      clearTimeout(timer)\n      if (!err)\n        return resolve()\n      ws.close()\n      reject(err)\n    }\n    const fail = (detail: string) => () => settle(new Error(`WebSocket connection to ${displayHostUrl(url)} failed${detail}.`))\n    ws.addEventListener('open', () => settle(), { signal: done.signal })\n    ws.addEventListener('error', fail(''), { signal: done.signal })\n    ws.addEventListener('close', event => fail(` (close ${event.code}${event.reason ? `: ${event.reason}` : ''})`)(), { signal: done.signal })\n    signal?.addEventListener('abort', () => settle(abortError(signal)), { signal: done.signal })\n    timer = setTimeout(() => settle(new WsOpenTimeoutError(url, timeoutMs)), timeoutMs)\n  })\n}\n\n/** Why an upgrade failed, asked over plain HTTP: a {@link HostAuthError} for 401 / 403, a {@link HostBusyError} for 429, a {@link HostRedirectError} for 3xx, else `null`. */\nasync function refusal(options: WsClientOptions): Promise<Error | null> {\n  try {\n    const url = new URL(options.url)\n    url.protocol = url.protocol === 'wss:' ? 'https:' : 'http:'\n    const timeout = AbortSignal.timeout(5000)\n    const ca = bunCa(options)\n    const response = await fetch(url, {\n      headers: options.token ? { Authorization: `Bearer ${options.token}` } : {},\n      redirect: 'manual',\n      signal: options.signal ? AbortSignal.any([options.signal, timeout]) : timeout,\n      // Bun's fetch extension, as for the socket.\n      ...(ca ? { tls: { ca } } : {}),\n    } as RequestInit)\n    void response.body?.cancel().catch(() => {})\n    if (response.type === 'opaqueredirect' || (response.status >= 300 && response.status < 400))\n      return new HostRedirectError(options.url, response.status)\n    if (response.status === 429)\n      return new HostBusyError(options.url)\n    if (response.status !== 401 && response.status !== 403)\n      return null\n    const reason = response.headers.get(WS_REFUSAL_HEADER)\n    return new HostAuthError(options.url, response.status, response.status === 403 && isWsRefusalReason(reason) ? reason : undefined)\n  }\n  catch {\n    return null\n  }\n}\n\n/** Close a connection whose host is not the one expected, and say so. */\nfunction checkIdentity(client: IpcClient, options: WsClientOptions): IpcClient {\n  if (options.expectHostId === undefined)\n    return client\n  const ref = hostRefOf(client.hello)\n  if (ref?.id === options.expectHostId)\n    return client\n  client.close()\n  throw new HostIdentityError(displayHostUrl(options.url), ref?.name)\n}\n\n/**\n * Connects to a remote zidane server over WebSocket and completes the `ipc.hello` handshake.\n * A refused upgrade rejects with {@link HostAuthError} for a 401 or 403, and {@link HostBusyError} for a 429. A hello from another host than `expectHostId` rejects with `HostIdentityError`. A version mismatch rejects with {@link IpcVersionMismatchError} and leaves the server running.\n * @param options - Server URL, token and connection settings.\n * @returns A typed client.\n * @example\n * ```ts\n * import { connectWsClient } from 'zidane/ipc/remote'\n *\n * const client = await connectWsClient({\n *   url: 'wss://zidane.example.com/',\n *   token: process.env.ZIDANE_HOST_TOKEN,\n * })\n * const sessions = await client.request('sessions.list', {})\n * console.log(sessions.length)\n * client.close()\n * ```\n */\nexport async function connectWsClient(options: WsClientOptions): Promise<IpcClient> {\n  const { signal } = options\n  signal?.throwIfAborted()\n  const ws = createSocket(options)\n  ws.binaryType = 'arraybuffer'\n  try {\n    await opened(ws, options.url, options.openTimeoutMs ?? WS_OPEN_TIMEOUT_MS, signal)\n  }\n  catch (err) {\n    if (signal?.aborted || err instanceof WsOpenTimeoutError)\n      throw err\n    throw (await refusal(options)) ?? err\n  }\n\n  const signals = createSignalListeners()\n  let closed = false\n\n  const rpc = createJsonRpcEndpoint({\n    send: (json) => {\n      try {\n        ws.send(json)\n      }\n      catch {\n        // A closing socket: the close handler fails what is pending.\n      }\n    },\n    // The host never sends requests to clients, only notifications; a machine serves them.\n    onRequest: async (message) => {\n      const serve = options.serve\n      if (!serve)\n        return errorResponse(message.id, METHOD_NOT_FOUND, 'Clients do not accept requests.')\n      try {\n        return successResponse(message.id, (await serve.request(message.method, message.params)) ?? null)\n      }\n      catch (err) {\n        const code = (err as { code?: unknown }).code\n        return errorResponse(message.id, typeof code === 'number' ? code : -32000, err instanceof Error ? err.message : String(err))\n      }\n    },\n    onNotification: (message) => {\n      if (message.method === 'ipc.signal' || !options.serve?.notification)\n        return signals.onNotification(message)\n      options.serve.notification(message.method, (message as { params?: unknown }).params)\n    },\n  })\n\n  const decoder = new TextDecoder()\n  ws.addEventListener('message', (event: MessageEvent) => {\n    if (closed)\n      return\n    rpc.receive(typeof event.data === 'string' ? event.data : decoder.decode(event.data as ArrayBuffer))\n  })\n\n  /** The host went away (or the connection was given up): fail what is pending, tell the owner. */\n  const lost = (): void => {\n    if (closed)\n      return\n    closed = true\n    rpc.close()\n    options.onClose?.()\n  }\n  ws.addEventListener('close', lost)\n  ws.addEventListener('error', () => {\n    // 'close' follows.\n  })\n\n  const close = (): void => {\n    if (closed)\n      return\n    closed = true\n    rpc.close()\n    ws.close(1000)\n  }\n\n  // Aborted mid-handshake: the close fails the pending hello, and the connect rejects with the signal's reason.\n  const onAbort = (): void => close()\n  signal?.addEventListener('abort', onAbort, { once: true })\n  try {\n    return checkIdentity(await openIpcClient(\n      {\n        rpc,\n        close,\n        abort: () => {\n          lost()\n          ws.close(1000)\n        },\n        where: displayHostUrl(options.url),\n      },\n      signals.listeners,\n      {\n        ...(options.appVersion ? { appVersion: options.appVersion } : {}),\n        drain: 'never',\n        buildFence: false,\n        heartbeatMs: options.heartbeatMs ?? WS_HEARTBEAT_MS,\n      },\n    ), options)\n  }\n  catch (err) {\n    throw signal?.aborted ? abortError(signal) : err\n  }\n  finally {\n    signal?.removeEventListener('abort', onAbort)\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAiBA,MAAM,MAAM;AAKZ,SAAS,aAAa,MAAwB;CAC5C,IAAI;EACF,OAAO,IAAI,oBAAoB,IAAI,KAAK,CAAC;CAC3C,QACM;EACJ,OAAO,CAAC;CACV;AACF;AAEA,IAAI;;;;;;AAOJ,SAAgB,eAAgC;CAC9C,IAAI,WAAW,KAAA,GAAW;EACxB,MAAM,SAAS,aAAa,QAAQ;EACpC,SAAS,OAAO,WAAW,IAAI,OAAO,CAAC,mBAAG,IAAI,IAAI;GAAC,GAAG,aAAa,SAAS;GAAG,GAAG;GAAQ,GAAG,aAAa,OAAO;EAAC,CAAC,CAAC;CACtH;CACA,OAAO;AACT;;;;;AAMA,SAAgB,0BAAmC;CACjD,MAAM,KAAK,aAAa;CACxB,IAAI,CAAC,MAAM,CAAC,IAAI,4BAA4B,OAAQ,WAAiC,QAAQ,aAC3F,OAAO;CACT,IAAI,yBAAyB,EAAE;CAC/B,OAAO;AACT;;;;;;;;;;;;;;AC5CA,MAAa,iBAAiB;;AAE9B,MAAa,mBAAmB;;;;;;;AA2BhC,MAAa,oBAAoB;AACjC,MAAM,qBAAqB;CAAC;CAAU;CAAsB;CAAmB;AAAO;AAGtF,SAAgB,kBAAkB,OAA0C;CAC1E,OAAO,OAAO,UAAU,YAAa,mBAAyC,SAAS,KAAK;AAC9F;;;;;;;;;;;ACoCA,MAAa,kBAAkB;;AAE/B,MAAM,qBAAqB;AAE3B,MAAM,YAA6C;CACjD,UAAU;CACV,sBAAsB;CACtB,mBAAmB;CACnB,SAAS;AACX;;;;;AAMA,IAAa,gBAAb,cAAmC,MAAM;CAQL;CAA4B;;CAN9D;;;;;;CAMA,YAAY,KAAa,QAA4B,QAAmC;EACtF,MAAM,QAAQ,eAAe,GAAG;EAChC,MAAM,2BAA2B,MAAM,WAAW,WAAW,MACzD,6KACA,oBAAoB,SAAS,UAAU,UAAU,yFAAyF,EAAE;EAJhH,KAAA,SAAA;EAA4B,KAAA,SAAA;EAK5D,KAAK,OAAO;EACZ,KAAK,MAAM;CACb;AACF;;AAGA,IAAa,gBAAb,cAAmC,MAAM;;CAEvC,YAAY,KAAa;EACvB,MAAM,2BAA2B,eAAe,GAAG,EAAE,wLAAwL;EAC7O,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,oBAAb,cAAuC,MAAM;CAC3C,YAAY,KAAa,QAAgB;EACvC,MAAM,2BAA2B,eAAe,GAAG,EAAE,iCAAiC,OAAO,4GAA4G;EACzM,KAAK,OAAO;CACd;AACF;;AAGA,MAAM,cAAuB,OAAQ,WAAiC,QAAQ;;AAG9E,SAAS,MAAM,SAAoD;CACjE,OAAO,MAAM,KAAK,mBAAmB,KAAK,QAAQ,GAAG,IAAI,QAAQ,MAAM,aAAa,IAAI;AAC1F;AAEA,SAAS,aAAa,SAAqC;CACzD,MAAM,YAAY,CAAC,cAAc;CACjC,MAAM,UAAU,QAAQ,iBAAiB,MAAM,IAAI,WAAW;CAC9D,IAAI,QAAQ,SAAS,YAAY,eAC/B,UAAU,KAAK,GAAG,mBAAmB,QAAQ,OAAO;CACtD,MAAM,UAAU,QAAQ,SAAS,YAAY,WAAW,EAAE,eAAe,UAAU,QAAQ,QAAQ,IAAI;CACvG,MAAM,KAAK,MAAM,OAAO;CACxB,IAAI,WAAW,IAGb,OAAO,IAAIA,UAAa,QAAQ,KAAK;EAAE,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAAI;EAAW,GAAI,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;CAAG,CAAC;CAErH,OAAO,IAAI,UAAU,QAAQ,KAAK,SAAS;AAC7C;;AAGA,IAAM,qBAAN,cAAiC,MAAM;CACrC,YAAY,KAAa,WAAmB;EAC1C,MAAM,2BAA2B,eAAe,GAAG,EAAE,mBAAmB,UAAU,KAAK;EACvF,KAAK,OAAO;CACd;AACF;AAEA,SAAS,WAAW,QAA4B;CAC9C,OAAO,OAAO,kBAAkB,QAAQ,OAAO,SAAS,IAAI,aAAa,4BAA4B,YAAY;AACnH;;AAGA,SAAS,OAAO,IAAe,KAAa,WAAmB,QAAgD;CAC7G,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,OAAO,IAAI,gBAAgB;EACjC,IAAI;EACJ,MAAM,UAAU,QAAsB;GACpC,IAAI,KAAK,OAAO,SACd;GACF,KAAK,MAAM;GACX,aAAa,KAAK;GAClB,IAAI,CAAC,KACH,OAAO,QAAQ;GACjB,GAAG,MAAM;GACT,OAAO,GAAG;EACZ;EACA,MAAM,QAAQ,iBAAyB,uBAAO,IAAI,MAAM,2BAA2B,eAAe,GAAG,EAAE,SAAS,OAAO,EAAE,CAAC;EAC1H,GAAG,iBAAiB,cAAc,OAAO,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC;EACnE,GAAG,iBAAiB,SAAS,KAAK,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC;EAC9D,GAAG,iBAAiB,UAAS,UAAS,KAAK,WAAW,MAAM,OAAO,MAAM,SAAS,KAAK,MAAM,WAAW,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC;EACzI,QAAQ,iBAAiB,eAAe,OAAO,WAAW,MAAM,CAAC,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC;EAC3F,QAAQ,iBAAiB,OAAO,IAAI,mBAAmB,KAAK,SAAS,CAAC,GAAG,SAAS;CACpF,CAAC;AACH;;AAGA,eAAe,QAAQ,SAAiD;CACtE,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;EAC/B,IAAI,WAAW,IAAI,aAAa,SAAS,WAAW;EACpD,MAAM,UAAU,YAAY,QAAQ,GAAI;EACxC,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,WAAW,MAAM,MAAM,KAAK;GAChC,SAAS,QAAQ,QAAQ,EAAE,eAAe,UAAU,QAAQ,QAAQ,IAAI,CAAC;GACzE,UAAU;GACV,QAAQ,QAAQ,SAAS,YAAY,IAAI,CAAC,QAAQ,QAAQ,OAAO,CAAC,IAAI;GAEtE,GAAI,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;EAC9B,CAAgB;EAChB,SAAc,MAAM,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC;EAC3C,IAAI,SAAS,SAAS,oBAAqB,SAAS,UAAU,OAAO,SAAS,SAAS,KACrF,OAAO,IAAI,kBAAkB,QAAQ,KAAK,SAAS,MAAM;EAC3D,IAAI,SAAS,WAAW,KACtB,OAAO,IAAI,cAAc,QAAQ,GAAG;EACtC,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,OAAO;EACT,MAAM,SAAS,SAAS,QAAQ,IAAI,iBAAiB;EACrD,OAAO,IAAI,cAAc,QAAQ,KAAK,SAAS,QAAQ,SAAS,WAAW,OAAO,kBAAkB,MAAM,IAAI,SAAS,KAAA,CAAS;CAClI,QACM;EACJ,OAAO;CACT;AACF;;AAGA,SAAS,cAAc,QAAmB,SAAqC;CAC7E,IAAI,QAAQ,iBAAiB,KAAA,GAC3B,OAAO;CACT,MAAM,MAAM,UAAU,OAAO,KAAK;CAClC,IAAI,KAAK,OAAO,QAAQ,cACtB,OAAO;CACT,OAAO,MAAM;CACb,MAAM,IAAI,kBAAkB,eAAe,QAAQ,GAAG,GAAG,KAAK,IAAI;AACpE;;;;;;;;;;;;;;;;;;;AAoBA,eAAsB,gBAAgB,SAA8C;CAClF,MAAM,EAAE,WAAW;CACnB,QAAQ,eAAe;CACvB,MAAM,KAAK,aAAa,OAAO;CAC/B,GAAG,aAAa;CAChB,IAAI;EACF,MAAM,OAAO,IAAI,QAAQ,KAAK,QAAQ,iBAAiB,oBAAoB,MAAM;CACnF,SACO,KAAK;EACV,IAAI,QAAQ,WAAW,eAAe,oBACpC,MAAM;EACR,MAAO,MAAM,QAAQ,OAAO,KAAM;CACpC;CAEA,MAAM,UAAU,sBAAsB;CACtC,IAAI,SAAS;CAEb,MAAM,MAAM,sBAAsB;EAChC,OAAO,SAAS;GACd,IAAI;IACF,GAAG,KAAK,IAAI;GACd,QACM,CAEN;EACF;EAEA,WAAW,OAAO,YAAY;GAC5B,MAAM,QAAQ,QAAQ;GACtB,IAAI,CAAC,OACH,OAAO,cAAc,QAAQ,IAAI,kBAAkB,iCAAiC;GACtF,IAAI;IACF,OAAO,gBAAgB,QAAQ,IAAK,MAAM,MAAM,QAAQ,QAAQ,QAAQ,QAAQ,MAAM,KAAM,IAAI;GAClG,SACO,KAAK;IACV,MAAM,OAAQ,IAA2B;IACzC,OAAO,cAAc,QAAQ,IAAI,OAAO,SAAS,WAAW,OAAO,OAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;GAC7H;EACF;EACA,iBAAiB,YAAY;GAC3B,IAAI,QAAQ,WAAW,gBAAgB,CAAC,QAAQ,OAAO,cACrD,OAAO,QAAQ,eAAe,OAAO;GACvC,QAAQ,MAAM,aAAa,QAAQ,QAAS,QAAiC,MAAM;EACrF;CACF,CAAC;CAED,MAAM,UAAU,IAAI,YAAY;CAChC,GAAG,iBAAiB,YAAY,UAAwB;EACtD,IAAI,QACF;EACF,IAAI,QAAQ,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO,QAAQ,OAAO,MAAM,IAAmB,CAAC;CACrG,CAAC;;CAGD,MAAM,aAAmB;EACvB,IAAI,QACF;EACF,SAAS;EACT,IAAI,MAAM;EACV,QAAQ,UAAU;CACpB;CACA,GAAG,iBAAiB,SAAS,IAAI;CACjC,GAAG,iBAAiB,eAAe,CAEnC,CAAC;CAED,MAAM,cAAoB;EACxB,IAAI,QACF;EACF,SAAS;EACT,IAAI,MAAM;EACV,GAAG,MAAM,GAAI;CACf;CAGA,MAAM,gBAAsB,MAAM;CAClC,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;CACzD,IAAI;EACF,OAAO,cAAc,MAAM,cACzB;GACE;GACA;GACA,aAAa;IACX,KAAK;IACL,GAAG,MAAM,GAAI;GACf;GACA,OAAO,eAAe,QAAQ,GAAG;EACnC,GACA,QAAQ,WACR;GACE,GAAI,QAAQ,aAAa,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;GAC/D,OAAO;GACP,YAAY;GACZ,aAAa,QAAQ,eAAA;EACvB,CACF,GAAG,OAAO;CACZ,SACO,KAAK;EACV,MAAM,QAAQ,UAAU,WAAW,MAAM,IAAI;CAC/C,UACQ;EACN,QAAQ,oBAAoB,SAAS,OAAO;CAC9C;AACF"}

package/docs/CODEMODE.md

@@ -74,6 +74,12 @@ array of results) shows the text a direct call returns, not JSON. The host
 sends both (`CodemodeValue`, the `text` of a `result` message). The prelude
 keeps the text in a `WeakMap` keyed by the value.
 
+A tool that returns images (`generate_image`, `read_file` on a picture)
+resolves to its content blocks, images in the MCP shape `image()` takes.
+Printing that result shows its text and attaches its images as image
+output, so `return r` hands the model and the transcript the picture, not
+its base64.
+
 A tool whose input has exactly one required property, a string
 (`stringArgumentOf`), also takes that string bare. Examples are
 `tools.shell("ls")`, and `tools.grep("TODO", { glob: "*.ts" })`, which passes

package/docs/IPC.md

@@ -119,6 +119,7 @@ method. The source of truth is `IpcMethods` in `src/ipc/protocol.ts`.
 | `sessions.workspaceFileSize` | A file's byte size in the session's workspace, or `null`. |
 | `sessions.setLaunchOverrides` | A window's overrides for the session agent. They are the flags of `zidane run --system / --mcp / --context` and `cwd`, a folder picked mid-session (it moves the live agent without a rebuild). `system` replaces the base prompt, and extension fragments still append. `mcp` adds servers after the discovered ones. `execution` runs the session on the launch context. The overrides are in memory and per client. The session runs the most recent connected setter's overrides. A client that clears them (a call with no field) or disconnects drops only its own, so the previous setter's apply again. |
 | `sessions.retryEnvironment` | Provision a failed (or restart-stranded) environment again, in the background. Progress arrives as `sessions:changed`. |
+| `sessions.moveEnvironment` | Move a local, idle session into a new environment (`{ kind, branch? }`, as on `sessions.create`). It returns once the row shows `provisioning`. The history stays, and the agent is rebuilt in the new directory when it is ready. The old checkout is not changed. |
 | `sessions.setTitle` | Rename a session. |
 | `sessions.generateTitle` | Title a session on the host, with the host's providers and credentials. It takes `{ providerKey?, model? }`, the window's pick, used when the host has that provider, else the session's own. It is written as a rename and refuses Main. |
 | `sessions.setArchived` | Archive or unarchive a session. |
@@ -245,6 +246,7 @@ answers "method not found", which clients treat as unsupported. The changes are:
 - The `mcp:status` and `mcp:settled` signals.
 - `activeWork` on `daemon.info` (`zidane server wait-idle` reports an older host as not saying).
 - Timing from the host: `startedAt` on `run:start`, `runStartedAt` on a running `SessionRow`, `runStartedAt` and `runOutputTokens` on `sessions.getHeader` `usage`, `runOutputTokens` on a parent `turn:end`, `startedAt` on `tool` events and `durationMs` on `tool-result` events (saved on the `tool_result` block, so a replay has it too). Against an older host a client times runs and calls from when it saw them, and adds the run's output up itself.
+- `sessions.moveEnvironment`. Against an older host the GUI shows the "method not found" error.
 
 Version changes:
 

package/docs/ONBOARDING.md

@@ -165,7 +165,7 @@ Row icons (`showRowIcons`, desktop app) is a preset setting like the others: Foc
 | Group | Settings | Apps |
 |---|---|---|
 | Desktop | `browser` (includes `browserAgent`), `terminal` (includes `terminalAgent`), `notifications` (includes `notificationSound`) | desktop |
-| Work | `codemode` (experimental, on by default), `inlineAutocomplete` (on by default), `autoTitle` (uses tokens, turns on Decisions), `spaces` | both |
+| Work | `codemode` (experimental, on by default), `webSearch` (on by default), `inlineAutocomplete` (on by default), `autoTitle` (uses tokens, turns on Decisions), `spaces` | both |
 | Trust | `loadProjectExtensions` | both |
 | In the background | `checkForUpdates`, `subscriptionUsage` | both |
 | In the background | `useDaemon` | desktop |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zidane",
-  "version": "8.2.3",
+  "version": "8.2.5",
   "description": "an agent that goes straight to the goal",
   "type": "module",
   "private": false,

package/dist/client-core-EEEX_u6D.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client-core-EEEX_u6D.d.ts","names":["OrchestrationCreateWorkerParams","OrchestrationWorkerRow","OrchestrationWorkerSummary"],"sources":["../src/ipc/protocol.ts","../src/ipc/transports/client-core.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAwMa;;;;;;cAOA;;;;;;;;;;;;;;;;;;;;;;;;cAgCA;;UAGI;;EAEf;;;UAIe;;EAEf;;EAEA,QAAQ;;;KAIE;EACJ;EAAU,SAAS;;;;EAEnB;EAAW;;;;;;;;;;UAcF;;EAEf;IAAe,QAAQ,KAAK;IAAsB;MAAU;;;;EAE5D;IAAoB;MAAU;;IAAqB;;;EAEnD;IAAgB;MAAU;MAAmB;;IAAmB;;;EAEhE;IAAmB;MAAU;MAAmB;;IAAmB;;;EAEnE;IACE;MAAU;MAAmB;MAAiB;MAA4B;;IAC1E;MAAU;;;;EAGZ;IAAoB;MAAU;;IAAqB;;;;;;;EAMnD;IAAuB;MAAU;;IAAqB;;;;;;;EAMtD;IAAiC;MAAU;QAAsB;IAAwB;;;;;;;;;;EASzF;IAAoB,QAAQ;IAAuB;;;;;;;;EAOnD;IAAmB;MAAU;MAAmB;;IAAsB,QAAQ;;;EAE9E;IAAqB;MAAU;MAAmB;MAAoB;;IAAmB;;;EAGzF;IAAmB;MAAU;MAA6B;;IAA2C,QAAQ;;;;;;;;EAO7G;IAAuB;MAAU;;IAA+B,QAAQ;;;EAExE;IAAsB;MAAU;;IAAqB,QAAQ;;;;;;;EAM7D;IAAkB;MAAU;MAAmB;;IAAmB,QAAQ;;;;;;;;;;;;;;;;EAe1E;IAAuB;MAAU;MAAmB;MAAe;;IAAkB;MAAU,OAAO;MAAe;MAAe;;;;;;;;EAMpI;IAA4B;MAAU;MAAmB;MAAgB;;IAAmB;;;;;;;;;;;EAU5F;IAAwB;MAAU;MAAmB;;IAAmB,QAAQ;;;;;;;EAMhF;IAAgC;MAAU;MAAmB;MAAmB;MAAa,QAAQ;;IAAa;;;EAElH;IAAqB,QAAQ;IAAqB,QAAQ;;;EAE1D;IAAqB;MAAU;;IAAqB;MAAU,cAAc;;;;EAE5E;IAA+B;MAAU;;IAAqB;;;EAE9D;IAAiC;MAAU;;IAAqB,QAAQ;;;EAExE;IAAmC;MAAU;MAAmB;;IAAoB,QAAQ;;;;;;;;;;;EAU5F;IAA4B;MAAU;MAAmB;MAAiB;MAAc,MAAM;MAAwB;;IAA2B,QAAQ;;;;;;;;;;;EAUzJ;IAAkC;MAAU;MAAmB;MAAiB;;IAAgB;MAAU;;;;EAE1G;IAAkC;MAAU;;IAAkB;MAAU;;;;EAExE;IAAgC;MAAU;MAAmB;;IAAgB;;;EAE7E;IAAiC;MAAU;MAAmB;MAAc;;IAAmB;;;EAE/F;IAAiC;MAAU;MAAmB;MAAc,UAAU;;IAA6B,QAAQ;;;EAE3H;IAAgC;MAAU;MAAmB;;IAAgB;;;;;;;;;;;EAU7E;IAAuB;MAAU;MAAc;;IAAiB,QAAQ;;;;;;;EAMxE;IAAyB,QAAQ;IAA2B;;;EAE5D;IAAyB;MAAU;;IAAgB,QAAQ;;;EAE3D;IAAuB;MAAU;MAAmB;;IAAiB;;;;;;;;;;;EAUrE;IAA4B;MAAU;MAAmB;MAAsB;;IAAkB;MAAU;;;;EAE3G;IAA0B;MAAU;MAAmB;;IAAqB;;;EAE5E;IAA0B;MAAU;MAAmB;;IAAqB;;;EAE5E;IAAuB;MAAU;MAAmB;;IAAmB;;;EAEvE;IAAyB;MAAU;MAAmB;;IAAmB;;;EAEzE;IAAwB;MAAU;MAAmB,QAAQ;;IAAiB;;;;;;;;;;;EAU9E;IACE;MACE;MACA,aAAa;MACb;;MAEA;MACA,YAAY;MACZ,SAAS;MACT,eAAe;;IAEjB;;;EAGF;IAA8B;MAAU;MAAmB,SAAS;;IAA2B;;;;;;;;;;;;;;;EAc/F;IAAyB;MAAU;;IAAqB,QAAQ;;;;;;;;;EAQhE;IAAqB;MAAU;MAAmB;MAAe;;IAAoB,QAAQ;;;EAE7F;IAAsB;MAAU;MAAmB;;IAAkB,QAAQ;;;EAE7E;IAA+B;MAAU;;IAAqB,QAAQ;;;;;;;;EAOtE;IAAwB;MAAU;MAAmB;MAAe;;IAAkB,QAAQ;;;;;;EAK9F;IAAoB;MAAU;MAA6B;MAAe;MAAc;MAAgB;;IAAkB,QAAQ;;;EAElI;IAAsB;MAAU;MAAmB;;IAAsB;;;;;;;EAMzE;IAAsB;MAAU,UAAU;;IAAmB,QAAQ;;;;;;;;;EAQrE;IACE;MAAU;MAAmB;MAAe;;IAC5C,QAAQ;;;;;;;EAOV;IACE;MAAU;MAAe;MAAsB;;IAC/C,QAAQ,eAAe;;;;;;;;;EASzB;IAAoB;MAAU;;IAAqB;;;EAEnD;IAAmB;MAAU;MAAmB;MAAgB;;IAAkB;MAAU;;;;EAE5F;IAAyB;MAAU;MAAmB;;IAAkB;;;EAExE;IAA2B;MAAU;MAAmB;MAAgB;;IAAgB;;;EAExF;IAAqB;MAAU;MAAmB;MAAgB;;IAAsB;;;EAExF;IAAwB;MAAU;MAAmB;;IAAe;;;EAEpE;IAA0B;MAAU;MAAmB,OAAO;;IAAiB;;;;;;EAK/E;IAAyB;MAAU;MAAmB,QAAQ;;IAAwB;;;EAEtF;IAAsB;MAAU;;IAAqB,QAAQ;;;EAG7D;IAAe;MAAU;;IAAqB,QAAQ;;;;;;;;;;;;;;;;;;;;;;EAqBtD;IAAe;MAAU;MAAmB,gBAAgB;MAAY;;IAAyB,QAAQ;;;EAezG;IAAwB,QAAQ;IAAuB;;;EAEvD;IAAgC;MAAU;QAAmBA;IAAiC;;;EAE9F;IAAwB;MAAU;MAAgB;;IAAkB,QAAQC;;;EAE5E;IAAwB;MAAU;MAAgB;;IAAqB,QAAQC;;;EAE/E;IAAwB;MAAU;MAAgB;MAAmB;MAAgB;;IAAkB;;;EAEvG;IAAyB;MAAU;MAAgB;MAAmB;;IAAmB;;;EAEzF;IAA0B;MAAU;MAAgB;;IAAqB;;;EAEzE;IAA8B;MAAU;MAAgB;MAAmB;;IAAkB;;;EAG7F;IAAmB;MAAU;MAAa;;IAAiB,QAAQ;;;EAEnE;IAA2B;MAAU;MAAa;MAAc;MAAoB;;IAAiB,QAAQ;;;EAG7G;IAAuB;MAAU;;IAAsB,QAAQ;;;EAE/D;IAA0B;MAAU;MAAmB,UAAU;;IAAuB;MAAU;;;;EAElG;IAAyB;MAAU;MAAmB;;IAAmB;MAAU;;;;EAEnF;IAA4B;MAAU;;IAAqB,QAAQ;;;;;;;EAMnE;IAA0B;MAAU;;IAAkB;MAAU;;;;EAEhE;IAA4B;MAAU;;IAAkB;MAAU;;;;EAElE;IAAqB;MAAU;MAAmB,UAAU;;IAAmB;MAAU;;;;;;;;;EAOzF;IAAoB;MAAU;;IAAqB,QAAQ;;;EAE3D;IAAmB,QAAQ;IAAmB,QAAQ;;;;EAGtD;IAAqB;MAAU;MAAoB;MAAkB;;IAAqB,QAAQ;;;EAElG;IAAqB;MAAU;MAAoB;;IAAoB;;;EAEvE;IAAoB;MAAU;MAAoB;MAAc;MAAmB;;IAAsB;;;EAEzG;IAAqB;MAAU;MAAoB;MAAkB;MAAc;MAAc;;IAAmB;;;EAEpH;IAAkB;MAAU;MAAoB;MAAkB;;IAAkB;;;EAEpF;IAAsB;MAAU;;IAAsB,QAAQ;;;EAE9D;IAAoB;MAAU;;IAAsB;;;EAEpD;IAAwB;MAAU;MAAoB;;IAAmB;;;;;;;EAMzE;IAA6B;MAAU;;IAAoB;MAAU;;;;EAErE;IAA+B;MAAU;;IAAoB;MAAU;;;;;;;;EAMvE;IAA2B,QAAQ;IAA2B,QAAQ;;;EAEtE;IAA4B,QAAQ;IAA0B,QAAQ;;;EAEtE;IAAoB;MAAU;MAAiB;;IAAqB,QAAQ;;;EAE5E;IAA2B;MAAU;;IAAmB;;;EAGxD;IAAuB;MAAU;MAAmB,UAAU;;IAAoB;;;EAElF;IAAuB;MAAU;;IAAsB;;;EAEvD;IAA2B,QAAQ;IAAuB,QAAQ;;;;;;;EAOlE;IAAgB;MAAU;;IAAqB,QAAQ;;;;;;;;;;;;EAYvD;IACE;MAAU;;IACV;MAAU,MAAM;MAAqB,mBAAmB;;;;;;;;EAO1D;IAA8B;MAAU;;IAAqB,QAAQ;;;;;;;;EAOrE;IAA0B;MAAU;MAAmB,QAAQ;;IAAqB,QAAQ;;;;;;;;EAO5F;IAA0B;MAAU;MAAmB;;IAAkB,QAAQ;;;EAEjF;IAAmC;MAAU;;IAAqB;MAAU;MAAc;;;;EAE1F;;;;;IAKE;MAAU;MAAmB;MAAc;MAA4B,cAAc;MAAoB;MAAoB;;IAC7H;MAAU;;;;EAGZ;IAAkB;MAAU;MAAmB;;IAAc;;;;;;EAK7D;IAAkB;MAAU;MAAmB;MAAY;MAAc,cAAc;;IAAsB;;;EAE7G;IAAuB;MAAU;MAAmB;;IAAc,QAAQ;;;EAE1E;IAAmB;MAAU;MAAmB;;IAAc;MAAU;;;;EAGxE;IAAgB;MAAU;;IAAqB;MAAU;MAAc;MAAiB,cAAc;MAAoB;QAAW;QAAiB;;;;;;;;;;;;;EAUtJ;IAAgB;MAAU;MAAmB;MAAc;;IAAmB;;;EAE9E;IAA2B;MAAU;MAAmB,aAAa;;IAAsB;;;EAE3F;IAAgB;MAAU;MAAmB;MAAiB;;IAAiB;;;;;;;;;;;EAU/E;IAAoB;MAAU;MAAqB;MAAoB,SAAS;MAAW;MAAa;;IAAkB;;;;;;;;;;;EAU1H;IAAqB;MAAU;MAAmB;MAAc;MAAe;;IAAe;MAAU;MAA2B;MAAa;;;;EAGhJ;IAAkB,QAAQ;IAAuB,QAAQ;;;EAEzD;IAAkB;MAAU,OAAO,QAAQ;;IAAiB,QAAQ;;;EAGpE;IAAmB,QAAQ;IAAuB,QAAQ;;;;;;;;EAO1D;IAAoB;MAAU;;IAAqB;;;;;;;EAOnD;IAAc,QAAQ;IAAuB,QAAQ;;;;;;;EAMrD;IAAiB;MAAU;;IAAiB,QAAQ;;;;;;;;EAQpD;IAAiB,QAAQ;IAAuB;MAAU,WAAW;;;;;;;;;EAOrE;IAAoB;MAAU;MAAkB;;IAAe,QAAQ;;;;;;;;EAOvE;IAAiB;MAAU;MAAkB;;IAAoB;MAAU;MAAkB,UAAU;;;;;;;;;;;;;;EAYvG;IAAsB;MAAU;MAAmB;MAAoB;MAAc;MAAe;;IAAwB,QAAQ;;;;;;;;;EAQpI;IAAyB;MAAU;MAAgB;MAAe;MAAgB;;IAAkB,QAAQ;;;;;;;;EAO5G;IAAwB;MAAU;MAAgB;MAAgB;;IAAkB,QAAQ;;;EAE5F;IAAuB;MAAU;;IAAkB;MAAU;;;;;;;;;;;EAU7D;IAAoB;MAAU;MAAc;;IAAiB;MAAU,QAAQ;;;;EAE/E;IAAkB;MAAU;MAAc;;IAAiB;MAAU,SAAS;MAAkB,QAAQ;;;;EAExG;IAAwB;MAAU;MAAc;;IAAiB;MAAU,YAAY;;;;EAEvF;IAAqB;MAAU;MAAc;;IAAiB;MAAU,SAAS;;;;;;;;;;;;;;EAYjF;IAAqB;MAAU,MAAM;MAAiB;MAAc;MAAgB;MAAmB;MAAe;MAAoB;;IAAuB;MAAU;MAAqB;MAAiB;;;;EAEjN;IAAoB;MAAU,MAAM;MAAiB;;IAAgB;MAAU;MAAiB;;;;EAEhG;IAAoB;MAAU,MAAM;MAAiB;;IAAgB;MAAU;MAAiB;MAAmB;;;;;;;;EAMnH;IAAgB;MAAU,QAAQ;;IAAmB;MAAU;MAAc;;;;EAE7E;IAAgB;MAAU;;IAAgB;MAAU;;;;;;;;EAMpD;IAAiB;MAAU;MAAc;;IAAiB;MAAU,WAAW;;;;;;;;;EAO/E;IAAoB;MAAU;MAAc;MAAe;;IAAkB,QAAQ;;;;;;;;EAOrF;IAAiB;MAAU;MAAc;MAAe;;IAAiB,QAAQ;;;;;;;EAOjF;IAAmB,QAAQ;IAAuB,QAAQ;;;EAE1D;IAAqB;MAAU;;IAAqB;MAAU;;;;;;;;EAM9D;IAAuB;MAAU;MAAmB;;IAAiB;MAAU;MAAc;MAAgB;;;;;;;;;;;EAS7G;IAA0B;MAAU;MAAgB;MAAc;MAAiB;;IAAkB,QAAQ;;;EAE7G;IAAyB;MAAU;;IAAkB,QAAQ;;;EAE7D;IAAwB;MAAU;MAAgB;;IAAoB,QAAQ;;;EAE9E;IAA2B,QAAQ;IAAuB,QAAQ;;;;;;;;;;;EAUlE;IAAoB;MAAU;;IAAkB,QAAQ;;;EAExD;IAAkB;MAAU;MAAgB,SAAS;;IAAa,QAAQ;;;EAE1E;IAAoB,QAAQ;IAAuB;MAAU;;;;;;;;EAM7D;IAA+B;MAAU;;IAAgB;MAAU;MAAY;MAAc;;;;;;;;;;;;EAW7F;IAAiB,QAAQ;IAAuB,QAAQ;;;EAExD;IAAgB;MAAU;MAAkB;MAAoB;MAAoB,aAAa;MAAgB;;IAAmB,QAAQ;;;EAE5I;IAAe;MAAU;MAAkB,UAAU;MAAc,SAAS;;IAAe,QAAQ;;;EAEnG;IAAgB;MAAU;;IAAiB;MAAU;;;;EAErD;IAAkB;MAAU;;IAAoB;MAAU;;;;EAG1D;IAAiB,QAAQ;IAAuB,QAAQ;;;;;;;;;;;;EAWxD;IAAqB;MAAU;;IAAsB;MAAU;;;;;;;;;iBAQjD,UAAU,OAAO,cAAc;;KAOnC,sBAAsB;;KAEtB,UAAU,UAAU,iBAAiB,WAAW;;KAEhD,UAAU,UAAU,iBAAiB,WAAW;;cAG/C;;cAEA;;UAGI;;EAEf;;EAEA;;;;;;;;EAQA;;;UAIe;;EAEf,QAAQ;;EAER;;;;;;;EAOA;;;;;;;EAOA;;;;;EAKA;;;;;;;;;iBAUoB,eACpB,UAAU,+BAA+B;EAAU;MAAwB,QAAQ,gBACnF;EAAU;IAAsB,mBAC/B,QAAQ;;;;;;;;;;;;;iBAqBW,cACpB,UAAU,+BAA+B;EAAU;MAAwB,QAAQ,gBACnF,mBACA;EAAW;IACV,QAAQ;;cAsEE;;cAEA;KAER,0BAA0B,gDAAgD,QAAQ,GAAG,QAAQ,UAAU,OAAO,QAAQ,UAAU;;;;;;KAOzH,sBAAsB;EAAgB;;;;;;;;;;;;;;;;;;;iBAsB5B,oBACpB,SAAS,wBACT,mBACA;EAAW;IACV,QAAQ;;UAyDD;EACR;;EAEA;;;;;EAKA;;;UAIe,yBAAyB;;EAExC;;EAEA;;EAEA;;EAEA;;EAEA;;;cAIW;;UAGI,uBAAuB;;EAEtC;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,MAAM;;EAEN,UAAU;;;UAIK;;EAEf;;EAEA;;EAEA;;EAEA;;;UAIe,6BAA6B;;EAE5C;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;;UAIe,0BAA0B;;EAEzC;IAAU;IAAc;IAA2B;;IAAkB;IAAmB;IAAuB;;;EAE/G;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;;UAIe;;EAEf;;EAEA;;EAEA,QAAQ;;;;;;EAMR,WAAW;IAAQ;IAAY;IAAe;;;;;;;EAM9C,iBAAiB;;;;;;EAMjB,cAAc;;;UAIC;EACf;EACA;;EAEA;;EAEA;EACA;EACA;;EAEA;;;UAIe;EACf;EACA;EACA;EACA;EACA;EACA;;;KAIU,sBAAsB;;UAGjB;EACf;EACA;EACA;;;UAIe;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;IAAS;IAAe;IAAgB;IAAoB;;;EAE5D;;EAEA;IAAY;IAAY;IAAe;IAAsB;MAAmB;MAAgB;MAAiB;MAAoB;;;;;UAItH;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;;;;;;KAQU;EACJ;EAAY;EAAgB;EAAiB,SAAS;IAAQ;IAAY;;;EAC1E;EAAY;EAAgB;EAAiB;EAAsB;;;UAG1D;;EAEf;;EAEA;;EAEA;;EAEA,OAAO;;EAEP;;EAEA;;EAEA;;EAEA;;;UAIe;;EAEf,WAAW;;EAEX;;EAEA,OAAO;;;UAIQ;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,SAAS;;;UAIM;;EAEf;;EAEA;;;UAIe;;EAEf;;EAEA;;EAEA;;;UAIe;;EAEf;;EAEA;;EAEA;;EAEA,SAAS;;EAET;;;UAIe;;EAEf,aAAa;;EAEb;;EAEA;;;UAIe;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,cAAc;;EAEd;;EAEA;;EAEA,SAAS;;EAET,eAAe;;EAEf,iBAAiB;;EAEjB,cAAc;;EAEd;;;;;;EAMA;;;UAIe;;EAEf;;EAEA;;EAEA;;EAEA,cAAc;;EAEd;;EAEA;;EAEA,YAAY;;EAEZ,SAAS;;EAET,eAAe;;EAEf;;EAEA;;EAEA;IAAc;;;EAEd,cAAc;;EAEd;;EAEA;;;UAQe;;EAEf;;EAEA;;EAEA;;;;;;;EAOA;;;;;;;;;EASA;;;;;;KAOU;;UAGK;;EAEf;;EAEA,MAAM;;EAEN;;;UAIe;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;;;;;EAMA;;EAEA,WAAW;;EAEX;;;;;;;EAOA;;;;;EAKA;;;;;EAKA;;;;;;EAMA;;EAEA;;;;;EAKA;;;;;;EAMA;;;KAIU;;;;UCpuDK;;EAEf,OAAO;;;;;EAKP,UAAU,UAAU,eAAe,QAAQ,GAAG,QAAQ,UAAU,OAAO,QAAQ,UAAU;;;;;;;EAOzF,SAAS,UAAU,eAAe,QAAQ,GAAG,QAAQ,UAAU;;EAE/D,WAAW,IAAI;;EAEf;;KAGU,kBAAkB,QAAQ,YAAY,OAAO;;cAG5C,gCAAgC;WAKL,SAAS;;;;;EAAnC,YAAA,iBAA0B,SAAS"}