@agentproto/acp 0.1.0 → 0.3.0

package/dist/tunnel/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/tunnel/frames.ts","../../src/tunnel/server.ts","../../src/tunnel/client.ts","../../src/tunnel/ws-adapter.ts"],"names":[],"mappings":";;;;;;;;;;;;AAsDO,IAAM,cAAA,GAAiB;AA4X9B,IAAM,WAAA,uBAAkB,GAAA,CAAsB;AAAA,EAC5C,OAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,eAAA;AAAA,EACA,oBAAA;AAAA,EACA,qBAAA;AAAA,EACA,SAAA;AAAA,EACA,aAAA;AAAA,EACA,YAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAC,CAAA;AAQM,SAAS,WAAW,GAAA,EAAiC;AAC1D,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IACE,CAAC,MAAA,IACD,OAAO,MAAA,KAAW,QAAA,IAClB,EAAE,GAAA,IAAO,MAAA,CAAA,IACT,OAAQ,MAAA,CAA0B,CAAA,KAAM,QAAA,EACxC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAK,MAAA,CAAyB,CAAA;AACpC,EAAA,IAAI,CAAC,WAAA,CAAY,GAAA,CAAI,CAAqB,GAAG,OAAO,IAAA;AACpD,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,YAAY,KAAA,EAA4B;AACtD,EAAA,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA;AAC7B;AAMO,SAAS,WAAW,KAAA,EAAoC;AAC7D,EAAA,MAAM,GAAA,GACJ,OAAO,KAAA,KAAU,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,KAAA,EAAO,MAAM,CAAA,GAAI,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA;AAC5E,EAAA,OAAO,GAAA,CAAI,SAAS,QAAQ,CAAA;AAC9B;AAEO,SAAS,WAAW,IAAA,EAAsB;AAC/C,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,IAAA,EAAM,QAAQ,CAAA;AACnC;ACnVO,SAAS,mBAAmB,IAAA,EAAyC;AAC1E,EAAA,MAAM,QAAA,uBAAe,GAAA,EAA0B;AAE/C,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAwB;AAI7C,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAA+B;AACtD,EAAA,IAAI,MAAA,GAAS,KAAA;AAIb,EAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,IACb,CAAA,EAAG,OAAA;AAAA,IACH,OAAA,EAAS,cAAA;AAAA,IACT,YAAA,EAAc;AAAA,MACZ,GAAA,EAAK,KAAK,GAAA,KAAQ,IAAA;AAAA,MAClB,WAAW,IAAA,CAAK,cAAA,KAAmB,MAAA,IAAa,CAAC,CAAC,IAAA,CAAK;AAAA,KACzD;AAAA,IACA,OAAO,IAAA,CAAK,KAAA;AAAA,IACZ,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,YAAA;AAAA,MACN,OAAA,EAAS,aAAA;AAAA,MACT,UAAU,CAAA,EAAG,QAAA,EAAU,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA;AAAA,MACrC,aAAa,OAAA,CAAQ;AAAA;AACvB,GACD,CAAA;AAED,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,CAAC,KAAA,KAAU;AAC5C,IAAA,WAAA,CAAY,KAAK,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAQ;AAChC,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,MAAA,IAAA,CAAK,IAAA,CAAK,KAAK,EAAE,CAAA,EAAG,SAAS,IAAA,EAAM,UAAA,EAAY,SAAS,CAAA;AAAA,IAC1D,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AAED,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,MAAM;AACvC,IAAA,MAAA,GAAS,IAAA;AACT,IAAA,KAAA,MAAW,GAAG,KAAK,KAAK,QAAA,EAAU,KAAA,CAAM,KAAK,SAAS,CAAA;AACtD,IAAA,QAAA,CAAS,KAAA,EAAM;AACf,IAAA,KAAA,MAAW,GAAG,GAAG,CAAA,IAAK,QAAA,MAAc,IAAA,EAAK;AACzC,IAAA,QAAA,CAAS,KAAA,EAAM;AACf,IAAA,KAAA,MAAW,GAAG,EAAE,CAAA,IAAK,UAAA,EAAY;AAC/B,MAAA,IAAI;AACF,QAAA,EAAA,CAAG,KAAA,CAAM,MAAM,eAAe,CAAA;AAAA,MAChC,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,UAAA,CAAW,KAAA,EAAM;AACjB,IAAA,QAAA,EAAS;AACT,IAAA,QAAA,EAAS;AAAA,EACX,CAAC,CAAA;AAED,EAAA,eAAe,YAAY,KAAA,EAAmC;AAC5D,IAAA,QAAQ,MAAM,CAAA;AAAG,MACf,KAAK,OAAA;AACH,QAAA,MAAM,YAAY,KAAK,CAAA;AACvB,QAAA;AAAA,MACF,KAAK,OAAA,EAAS;AACZ,QAAA,MAAM,GAAA,GAAM,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACrC,QAAA,IAAI,GAAA,EAAK;AACP,UAAA,GAAA,CAAI,KAAA,CAAM,OAAO,IAAA,CAAK,KAAA,CAAM,MAAM,QAAQ,CAAA,CAAE,QAAA,CAAS,MAAM,CAAC,CAAA;AAC5D,UAAA;AAAA,QACF;AACA,QAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACvC,QAAA,IAAI,CAAC,KAAA,IAAS,CAAC,KAAA,CAAM,KAAA,EAAO;AAC1B,UAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,YACb,CAAA,EAAG,OAAA;AAAA,YACH,QAAQ,KAAA,CAAM,MAAA;AAAA,YACd,IAAA,EAAM,cAAA;AAAA,YACN,OAAA,EAAS,CAAA,cAAA,EAAiB,KAAA,CAAM,MAAM,CAAA,CAAA;AAAA,WACvC,CAAA;AACD,UAAA;AAAA,QACF;AACA,QAAA,KAAA,CAAM,MAAM,KAAA,CAAM,MAAA,CAAO,KAAK,KAAA,CAAM,IAAA,EAAM,QAAQ,CAAC,CAAA;AACnD,QAAA;AAAA,MACF;AAAA,MACA,KAAK,MAAA,EAAQ;AACX,QAAA,MAAM,GAAA,GAAM,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACrC,QAAA,IAAI,GAAA,EAAK;AACP,UAAA,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,MAAA,IAAU,SAAS,CAAA;AAClC,UAAA;AAAA,QACF;AACA,QAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACvC,QAAA,IAAI,CAAC,KAAA,EAAO;AACV,UAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,YACb,CAAA,EAAG,OAAA;AAAA,YACH,QAAQ,KAAA,CAAM,MAAA;AAAA,YACd,IAAA,EAAM,cAAA;AAAA,YACN,OAAA,EAAS,CAAA,cAAA,EAAiB,KAAA,CAAM,MAAM,CAAA,CAAA;AAAA,WACvC,CAAA;AACD,UAAA;AAAA,QACF;AACA,QAAA,KAAA,CAAM,IAAA,CAAM,KAAA,CAAM,MAAA,IAAyC,SAAS,CAAA;AACpE,QAAA;AAAA,MACF;AAAA,MACA,KAAK,QAAA,EAAU;AACb,QAAA,QAAA,CAAS,GAAA,CAAI,MAAM,MAAM,CAAA,EAAG,OAAO,KAAA,CAAM,IAAA,EAAM,MAAM,IAAI,CAAA;AACzD,QAAA;AAAA,MACF;AAAA,MACA,KAAK,cAAA;AAOH,QAAA,MAAM,kBAAkB,KAAK,CAAA;AAC7B,QAAA;AAAA,MACF,KAAK,SAAA;AACH,QAAA,MAAM,aAAa,KAAK,CAAA;AACxB,QAAA;AAAA,MACF,KAAK,YAAA,EAAc;AACjB,QAAA,MAAM,EAAA,GAAK,UAAA,CAAW,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AACrC,QAAA,IAAI,CAAC,EAAA,EAAI;AAIP,UAAA;AAAA,QACF;AACA,QAAA,IAAI;AACF,UAAA,EAAA,CAAG,IAAA,CAAK,UAAA,CAAW,KAAA,CAAM,IAAI,CAAA,EAAG,EAAE,MAAA,EAAQ,KAAA,CAAM,MAAA,KAAW,IAAA,EAAM,CAAA;AAAA,QACnE,SAAS,GAAA,EAAK;AACZ,UAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,UAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,YACb,CAAA,EAAG,UAAA;AAAA,YACH,OAAO,KAAA,CAAM,KAAA;AAAA,YACb,IAAA,EAAM,IAAA;AAAA,YACN,MAAA,EAAQ,gBAAgB,OAAO,CAAA;AAAA,WAChC,CAAA;AACD,UAAA,IAAI;AACF,YAAA,EAAA,CAAG,KAAA,CAAM,MAAM,aAAa,CAAA;AAAA,UAC9B,CAAA,CAAA,MAAQ;AAAA,UAER;AACA,UAAA,UAAA,CAAW,MAAA,CAAO,MAAM,KAAK,CAAA;AAAA,QAC/B;AACA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,UAAA,EAAY;AACf,QAAA,MAAM,EAAA,GAAK,UAAA,CAAW,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AACrC,QAAA,IAAI,CAAC,EAAA,EAAI;AACT,QAAA,UAAA,CAAW,MAAA,CAAO,MAAM,KAAK,CAAA;AAC7B,QAAA,IAAI;AACF,UAAA,EAAA,CAAG,KAAA,CAAM,KAAA,CAAM,IAAA,EAAM,KAAA,CAAM,MAAM,CAAA;AAAA,QACnC,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,MAAA;AACH,QAAA,IAAA,CAAK,IAAA,CAAK,KAAK,EAAE,CAAA,EAAG,QAAQ,KAAA,EAAO,KAAA,CAAM,OAAO,CAAA;AAChD,QAAA;AAAA,MACF,KAAK,gBAAA;AAMH,QAAA,IAAI;AACF,UAAA,IAAA,CAAK,eAAA,GAAkB;AAAA,YACrB,GAAI,MAAM,QAAA,KAAa,KAAA,CAAA,GAAY,EAAE,QAAA,EAAU,KAAA,CAAM,QAAA,EAAS,GAAI;AAAC,WACpE,CAAA;AAAA,QACH,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA;AAAA,MACF,KAAK,MAAA;AAAA,MACL,KAAK,OAAA;AAEH,QAAA;AAAA,MACF;AACE,QAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,UACb,CAAA,EAAG,OAAA;AAAA,UACH,IAAA,EAAM,eAAA;AAAA,UACN,OAAA,EAAS,CAAA,uCAAA,EAA2C,KAAA,CAAwB,CAAC,CAAA,CAAA;AAAA,SAC9E,CAAA;AAAA;AACL,EACF;AAEA,EAAA,eAAe,YAAY,GAAA,EAAgC;AACzD,IAAA,IAAI,MAAA,EAAQ;AACZ,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,GAAG,CAAA;AAAA,IACrC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,OAAA;AAAA,QACH,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,IAAA,EAAM,oBAAA;AAAA,QACN;AAAA,OACD,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,OAAA;AAAA,QACH,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,IAAA,EAAM,oBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACV,CAAA;AACD,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,QAAA,CAAS,GAAA,IAAO,IAAA,CAAK,QAAA,EAAU;AACjC,MAAA,IAAI,GAAA;AACJ,MAAA,IAAI;AACF,QAAA,GAAA,GAAM,KAAK,QAAA,CAAS;AAAA,UAClB,SAAS,QAAA,CAAS,OAAA;AAAA,UAClB,IAAA,EAAM,CAAC,GAAG,QAAA,CAAS,IAAI,CAAA;AAAA,UACvB,KAAK,QAAA,CAAS,GAAA;AAAA,UACd,KAAK,QAAA,CAAS,GAAA,GAAM,EAAE,GAAG,QAAA,CAAS,KAAI,GAAI,KAAA,CAAA;AAAA,UAC1C,IAAA,EAAM,SAAS,IAAA,IAAQ,EAAA;AAAA,UACvB,IAAA,EAAM,SAAS,IAAA,IAAQ;AAAA,SACxB,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,QAAA,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,EAAE,CAAA,EAAG,OAAA,EAAS,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,IAAA,EAAM,cAAA,EAAgB,OAAA,EAAS,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,QAAA,CAAS,GAAA,CAAI,GAAA,CAAI,MAAA,EAAQ,GAAG,CAAA;AAC5B,MAAA,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,EAAE,CAAA,EAAG,SAAA,EAAW,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,GAAA,EAAK,GAAA,CAAI,GAAA,EAAK,CAAA;AAEjE,MAAA,GAAA,CAAI,OAAO,CAAA,IAAA,KAAQ;AACjB,QAAA,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,EAAE,CAAA,EAAG,QAAA,EAAU,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,IAAA,EAAM,UAAA,CAAW,IAAI,CAAA,EAAG,CAAA;AAAA,MAC5E,CAAC,CAAA;AACD,MAAA,GAAA,CAAI,MAAA,CAAO,CAAC,EAAE,QAAA,EAAU,QAAO,KAAM;AACnC,QAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,UACb,CAAA,EAAG,MAAA;AAAA,UACH,QAAQ,GAAA,CAAI,MAAA;AAAA,UACZ,IAAA,EAAM,QAAA;AAAA,UACN,MAAA,EAAQ,MAAA,IAAU,IAAA,GAAO,MAAA,CAAO,MAAM,CAAA,GAAI;AAAA,SAC3C,CAAA;AACD,QAAA,QAAA,CAAS,MAAA,CAAO,IAAI,MAAM,CAAA;AAAA,MAC5B,CAAC,CAAA;AAED,MAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,QAAA,IAAI;AAGF,UAAA,IAAA,CAAK,cAAA,CAAe;AAAA,YAClB,QAAQ,GAAA,CAAI,MAAA;AAAA,YACZ,KAAA,EAAO,EAAE,GAAA,EAAK,GAAA,CAAI,GAAA,EAAI;AAAA,YACtB,OAAA,EAAS;AAAA,WACV,CAAA;AAAA,QACH,CAAA,CAAA,MAAQ;AAAA,QAAwB;AAAA,MAClC;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI;AACF,MAAA,KAAA,GAAQ,MAAM,QAAA,CAAS,OAAA,EAAS,CAAC,GAAG,QAAA,CAAS,IAAI,CAAA,EAAG;AAAA,QAClD,KAAK,QAAA,CAAS,GAAA;AAAA,QACd,GAAA,EAAK,EAAE,GAAG,OAAA,CAAQ,KAAK,GAAI,QAAA,CAAS,GAAA,IAAO,EAAC,EAAG;AAAA,QAC/C,KAAA,EAAO,CAAC,MAAA,EAAQ,MAAA,EAAQ,MAAM;AAAA;AAAA,OAE/B,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,OAAA;AAAA,QACH,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,IAAA,EAAM,cAAA;AAAA,QACN;AAAA,OACD,CAAA;AACD,MAAA;AAAA,IACF;AAEA,IAAA,QAAA,CAAS,GAAA,CAAI,GAAA,CAAI,MAAA,EAAQ,KAAK,CAAA;AAE9B,IAAA,IAAI,OAAO,KAAA,CAAM,GAAA,KAAQ,QAAA,EAAU;AACjC,MAAA,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,EAAE,CAAA,EAAG,SAAA,EAAW,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,GAAA,EAAK,KAAA,CAAM,GAAA,EAAK,CAAA;AAAA,IACrE,CAAA,MAAO;AAIL,MAAA,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,EAAE,CAAA,EAAG,SAAA,EAAW,QAAQ,GAAA,CAAI,MAAA,EAAQ,GAAA,EAAK,EAAA,EAAI,CAAA;AAAA,IAC9D;AAMA,IAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,cAAA,CAAe,EAAE,MAAA,EAAQ,GAAA,CAAI,QAAQ,KAAA,EAAO,OAAA,EAAS,UAAU,CAAA;AAAA,MACtE,SAAS,GAAA,EAAK;AAIZ,QAAA,OAAA,CAAQ,IAAA;AAAA,UACN,CAAA,qDAAA,EAAwD,GAAA,CAAI,MAAM,CAAA,EAAA,EAChE,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA;AAAA,SACF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,MAAM,CAAA,GAAiB;AAAA,QACrB,CAAA,EAAG,QAAA;AAAA,QACH,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,IAAA,EAAM,WAAW,KAAK;AAAA,OACxB;AACA,MAAA,IAAA,CAAK,IAAA,CAAK,KAAK,CAAC,CAAA;AAAA,IAClB,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,MAAM,CAAA,GAAiB;AAAA,QACrB,CAAA,EAAG,QAAA;AAAA,QACH,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,IAAA,EAAM,WAAW,KAAK;AAAA,OACxB;AACA,MAAA,IAAA,CAAK,IAAA,CAAK,KAAK,CAAC,CAAA;AAAA,IAClB,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACzB,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,OAAA;AAAA,QACH,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,IAAA,EAAM,aAAA;AAAA,QACN,SAAS,GAAA,CAAI;AAAA,OACd,CAAA;AAAA,IACH,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,MAAA,EAAQ,CAAC,IAAA,EAAM,MAAA,KAAW;AACjC,MAAA,MAAM,CAAA,GAAe;AAAA,QACnB,CAAA,EAAG,MAAA;AAAA,QACH,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,IAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAA,CAAK,IAAA,CAAK,KAAK,CAAC,CAAA;AAChB,MAAA,QAAA,CAAS,MAAA,CAAO,IAAI,MAAM,CAAA;AAAA,IAC5B,CAAC,CAAA;AAAA,EACH;AASA,EAAA,eAAe,aAAa,GAAA,EAAiC;AAC3D,IAAA,IAAI,MAAA,EAAQ;AACZ,IAAA,MAAM,MAAA,GAAS,CACb,MAAA,EACA,IAAA,EACA,OAAA,KACS;AACT,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,aAAA;AAAA,QACH,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,MAAA;AAAA,QACA,KAAA,EAAO,EAAE,IAAA,EAAM,OAAA;AAAQ,OACxB,CAAA;AAAA,IACH,CAAA;AACA,IAAA,IAAI,CAAC,IAAA,CAAK,cAAA,IAAkB,CAAC,KAAK,YAAA,EAAc;AAC9C,MAAA,MAAA;AAAA,QACE,GAAA;AAAA,QACA,4BAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA;AAAA,IACF;AACA,IAAA,IACE,CAAC,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,IACxB,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA,IACxB,GAAA,CAAI,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA,EACtB;AACA,MAAA,MAAA;AAAA,QACE,GAAA;AAAA,QACA,cAAA;AAAA,QACA,CAAA,sDAAA,EAAyD,IAAI,IAAI,CAAA,EAAA;AAAA,OACnE;AACA,MAAA;AAAA,IACF;AACA,IAAA,MAAM,UAAA,uBAAiB,GAAA,CAAI;AAAA,MACzB,YAAA;AAAA,MACA,SAAA;AAAA,MACA,uBAAA;AAAA,MACA,mBAAA;AAAA,MACA,0BAAA;AAAA,MACA,wBAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,MAAM,UAAkC,EAAC;AACzC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,QAAQ,GAAA,CAAI,OAAA,IAAW,EAAE,CAAA,EAAG;AACtD,MAAA,IAAI,UAAA,CAAW,GAAA,CAAI,CAAA,CAAE,WAAA,EAAa,CAAA,EAAG;AACrC,MAAA,OAAA,CAAQ,CAAC,CAAA,GAAI,CAAA;AAAA,IACf;AAIA,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,YAAA,CAAa,OAAA,CAAQ,kBAAkB,SAAS,CAAA;AAClE,IAAA,MAAM,GAAA,GAAM,GAAG,IAAA,CAAK,OAAA,CAAQ,OAAO,EAAE,CAAC,CAAA,EAAG,GAAA,CAAI,IAAI,CAAA,CAAA;AACjD,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,KAAK,cAAA,CAAe;AAAA,QACnC,GAAA;AAAA,QACA,GAAI,GAAA,CAAI,SAAA,IAAa,GAAA,CAAI,SAAA,CAAU,MAAA,GAAS,CAAA,GACxC,EAAE,SAAA,EAAW,GAAA,CAAI,SAAA,EAAU,GAC3B,EAAC;AAAA,QACL;AAAA,OACD,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAG/D,MAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,KAAA,CAAM,mCAAmC,CAAA;AAC3D,MAAA,MAAM,MAAA,GAAS,IAAI,MAAA,CAAO,QAAA,CAAS,EAAE,CAAC,CAAA,EAAI,EAAE,CAAA,GAAI,GAAA;AAChD,MAAA,MAAA,CAAO,MAAA,EAAQ,sBAAsB,OAAO,CAAA;AAC5C,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,IAAI;AACF,QAAA,QAAA,CAAS,KAAA,CAAM,MAAM,eAAe,CAAA;AAAA,MACtC,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA;AAAA,IACF;AACA,IAAA,UAAA,CAAW,GAAA,CAAI,GAAA,CAAI,KAAA,EAAO,QAAQ,CAAA;AAClC,IAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,MACb,CAAA,EAAG,aAAA;AAAA,MACH,OAAO,GAAA,CAAI,KAAA;AAAA,MACX,MAAA,EAAQ,GAAA;AAAA,MACR,GAAI,SAAS,QAAA,GAAW,EAAE,UAAU,QAAA,CAAS,QAAA,KAAa;AAAC,KAC5D,CAAA;AAED,IAAA,QAAA,CAAS,SAAA,CAAU,CAAC,IAAA,EAAM,QAAA,KAAa;AACrC,MAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ;AACvB,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,YAAA;AAAA,QACH,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,IAAA,EAAM,WAAW,IAAI,CAAA;AAAA,QACrB,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH,CAAC,CAAA;AACD,IAAA,QAAA,CAAS,OAAA,CAAQ,CAAC,IAAA,EAAM,MAAA,KAAW;AACjC,MAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,GAAA,CAAI,KAAK,CAAA,EAAG;AAChC,MAAA,UAAA,CAAW,MAAA,CAAO,IAAI,KAAK,CAAA;AAC3B,MAAA,IAAI,IAAA,CAAK,KAAK,MAAA,EAAQ;AACpB,QAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,UACb,CAAA,EAAG,UAAA;AAAA,UACH,OAAO,GAAA,CAAI,KAAA;AAAA,UACX,IAAA;AAAA,UACA,GAAI,MAAA,GAAS,EAAE,MAAA,KAAW;AAAC,SAC5B,CAAA;AAAA,MACH;AAAA,IACF,CAAC,CAAA;AACD,IAAA,QAAA,CAAS,QAAQ,CAAA,GAAA,KAAO;AAGtB,MAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,GAAA,CAAI,KAAK,CAAA,EAAG;AAChC,MAAA,UAAA,CAAW,MAAA,CAAO,IAAI,KAAK,CAAA;AAC3B,MAAA,IAAI,IAAA,CAAK,KAAK,MAAA,EAAQ;AACpB,QAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,UACb,CAAA,EAAG,UAAA;AAAA,UACH,OAAO,GAAA,CAAI,KAAA;AAAA,UACX,IAAA,EAAM,IAAA;AAAA,UACN,MAAA,EAAQ,CAAA,gBAAA,EAAmB,GAAA,CAAI,OAAO,CAAA;AAAA,SACvC,CAAA;AAAA,MACH;AACA,MAAA,IAAI;AACF,QAAA,QAAA,CAAS,KAAA,CAAM,MAAM,gBAAgB,CAAA;AAAA,MACvC,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAEA,EAAA,eAAe,kBAAkB,GAAA,EAAsC;AACrE,IAAA,IAAI,MAAA,EAAQ;AACZ,IAAA,MAAM,OAAA,GAAU,CACd,OAAA,KAGS;AACT,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,eAAA;AAAA,QACH,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,GAAG;AAAA,OACiB,CAAA;AAAA,IACxB,CAAA;AAIA,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACtB,MAAA,OAAA,CAAQ;AAAA,QACN,MAAA,EAAQ,GAAA;AAAA,QACR,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,8BAAA;AAAA,UACN,OAAA,EACE;AAAA;AACJ,OACD,CAAA;AACD,MAAA;AAAA,IACF;AAKA,IAAA,IACE,CAAC,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,IACxB,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA,IACxB,GAAA,CAAI,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA,EACtB;AACA,MAAA,OAAA,CAAQ;AAAA,QACN,MAAA,EAAQ,GAAA;AAAA,QACR,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,cAAA;AAAA,UACN,OAAA,EAAS,CAAA,wDAAA,EAA2D,GAAA,CAAI,IAAI,CAAA,EAAA;AAAA;AAC9E,OACD,CAAA;AACD,MAAA;AAAA,IACF;AAIA,IAAA,MAAM,UAAA,uBAAiB,GAAA,CAAI;AAAA,MACzB,YAAA;AAAA,MACA,YAAA;AAAA,MACA,mBAAA;AAAA,MACA,SAAA;AAAA,MACA,oBAAA;AAAA,MACA,qBAAA;AAAA,MACA,IAAA;AAAA,MACA,SAAA;AAAA,MACA,MAAA;AAAA;AAAA,MACA;AAAA;AAAA,KACD,CAAA;AACD,IAAA,MAAM,UAAkC,EAAC;AACzC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,QAAQ,GAAA,CAAI,OAAA,IAAW,EAAE,CAAA,EAAG;AACtD,MAAA,IAAI,UAAA,CAAW,GAAA,CAAI,CAAA,CAAE,WAAA,EAAa,CAAA,EAAG;AACrC,MAAA,OAAA,CAAQ,CAAC,CAAA,GAAI,CAAA;AAAA,IACf;AAEA,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAA,CAAK,YAAA,CAAa,OAAA,CAAQ,OAAO,EAAE,CAAC,CAAA,EAAG,GAAA,CAAI,IAAI,CAAA,CAAA;AAC9D,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,SAAA,GAAY,IAAI,SAAA,IAAa,GAAA;AAOnC,IAAA,IAAI,KAAA,GAA8C,UAAA;AAAA,MAChD,MAAM,WAAW,KAAA,EAAM;AAAA,MACvB;AAAA,KACF;AACA,IAAA,MAAM,aAAa,MAAM;AACvB,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,KAAA,GAAQ,IAAA;AAAA,MACV;AAAA,IACF,CAAA;AACA,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,QACnC,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,OAAA;AAAA,QACA,MACE,GAAA,CAAI,IAAA,KAAS,SAAY,KAAA,CAAA,GAAY,UAAA,CAAW,IAAI,IAAI,CAAA;AAAA,QAC1D,QAAQ,UAAA,CAAW;AAAA;AAAA;AAAA,OAGpB,CAAA;AACD,MAAA,MAAM,aAAqC,EAAC;AAC5C,MAAA,WAAA,CAAY,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAAQ;AAC1C,QAAA,IAAI,UAAA,CAAW,GAAA,CAAI,GAAA,CAAI,WAAA,EAAa,CAAA,EAAG;AACvC,QAAA,UAAA,CAAW,GAAG,CAAA,GAAI,KAAA;AAAA,MACpB,CAAC,CAAA;AAOD,MAAA,MAAM,WAAA,GAAA,CAAe,UAAA,CAAW,cAAc,CAAA,IAAK,IAAI,WAAA,EAAY;AACnE,MAAA,MAAM,WACJ,WAAA,CAAY,UAAA,CAAW,mBAAmB,CAAA,IAC1C,WAAA,CAAY,SAAS,sBAAsB,CAAA;AAE7C,MAAA,IAAI,QAAA,IAAY,YAAY,IAAA,EAAM;AAIhC,QAAA,UAAA,EAAW;AACX,QAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,UACb,CAAA,EAAG,oBAAA;AAAA,UACH,OAAO,GAAA,CAAI,KAAA;AAAA,UACX,QAAQ,WAAA,CAAY,MAAA;AAAA,UACpB,OAAA,EAAS;AAAA,SACV,CAAA;AACD,QAAA,MAAM,MAAA,GAAS,WAAA,CAAY,IAAA,CAAK,SAAA,EAAU;AAC1C,QAAA,IAAI;AACF,UAAA,OAAO,IAAA,EAAM;AACX,YAAA,MAAM,EAAE,KAAA,EAAO,IAAA,EAAK,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,YAAA,IAAI,IAAA,EAAM;AACR,cAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,gBACb,CAAA,EAAG,qBAAA;AAAA,gBACH,OAAO,GAAA,CAAI,KAAA;AAAA,gBACX,GAAA,EAAK;AAAA,eACN,CAAA;AACD,cAAA;AAAA,YACF;AACA,YAAA,IAAI,KAAA,IAAS,KAAA,CAAM,UAAA,GAAa,CAAA,EAAG;AACjC,cAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,gBACb,CAAA,EAAG,qBAAA;AAAA,gBACH,OAAO,GAAA,CAAI,KAAA;AAAA,gBACX,IAAA,EAAM,UAAA,CAAW,MAAA,CAAO,IAAA,CAAK,KAAK,CAAC;AAAA,eACpC,CAAA;AAAA,YACH;AAGA,YAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ;AACrB,cAAA,IAAI;AACF,gBAAA,MAAM,OAAO,MAAA,EAAO;AAAA,cACtB,CAAA,CAAA,MAAQ;AAAA,cAER;AACA,cAAA;AAAA,YACF;AAAA,UACF;AAAA,QACF,SAAS,GAAA,EAAK;AACZ,UAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,UAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,YACb,CAAA,EAAG,qBAAA;AAAA,YACH,OAAO,GAAA,CAAI,KAAA;AAAA,YACX,GAAA,EAAK,IAAA;AAAA,YACL,KAAA,EAAO,EAAE,IAAA,EAAM,wBAAA,EAA0B,OAAA;AAAQ,WAClD,CAAA;AAAA,QACH;AACA,QAAA;AAAA,MACF;AAGA,MAAA,MAAM,MAAM,MAAA,CAAO,IAAA,CAAK,MAAM,WAAA,CAAY,aAAa,CAAA;AACvD,MAAA,OAAA,CAAQ;AAAA,QACN,QAAQ,WAAA,CAAY,MAAA;AAAA,QACpB,OAAA,EAAS,UAAA;AAAA,QACT,MAAM,GAAA,CAAI,MAAA,GAAS,CAAA,GAAI,UAAA,CAAW,GAAG,CAAA,GAAI;AAAA,OAC1C,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,IAAA,KAAS,YAAA;AACrD,MAAA,OAAA,CAAQ;AAAA,QACN,MAAA,EAAQ,UAAU,GAAA,GAAM,GAAA;AAAA,QACxB,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,UAAU,SAAA,GAAY,uBAAA;AAAA,UAC5B;AAAA;AACF,OACD,CAAA;AAAA,IACH,CAAA,SAAE;AACA,MAAA,UAAA,EAAW;AAAA,IACb;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,MAAM,KAAA,GAAQ;AACZ,MAAA,IAAI,MAAA,EAAQ;AACZ,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,KAAA,MAAW,GAAG,KAAK,KAAK,QAAA,EAAU,KAAA,CAAM,KAAK,SAAS,CAAA;AACtD,MAAA,QAAA,CAAS,KAAA,EAAM;AACf,MAAA,IAAA,CAAK,IAAA,CAAK,MAAM,cAAc,CAAA;AAAA,IAChC;AAAA,GACF;AACF;AC/nBO,SAAS,mBAAmB,IAAA,EAAyC;AAC1E,EAAA,MAAM,cAAA,GAAiB,KAAK,cAAA,IAAkB,GAAA;AAC9C,EAAA,IAAI,KAAA,GAA2B,IAAA;AAC/B,EAAA,IAAI,YAAA,GAA2C,IAAA;AAK/C,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAA6B;AACrD,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAGvB;AAwCF,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAyB;AAcjD,EAAA,MAAM,aAAA,uBAAoB,GAAA,EAAuB;AACjD,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAiC;AAErD,EAAA,MAAM,QAAA,GAAW,KAAK,IAAA,CAAK,OAAA,CAAQ,CAAC,KAAA,KAAU,aAAA,CAAc,KAAK,CAAC,CAAA;AAClE,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,MAAM;AACvC,IAAA,KAAA,MAAW,GAAG,IAAI,CAAA,IAAK,WAAA,OAAkB,kBAAA,EAAmB;AAC5D,IAAA,WAAA,CAAY,KAAA,EAAM;AAClB,IAAA,KAAA,MAAW,GAAG,CAAC,CAAA,IAAK,YAAA,EAAc;AAChC,MAAA,CAAA,CAAE,MAAA,CAAO,IAAI,KAAA,CAAM,uCAAuC,CAAC,CAAA;AAAA,IAC7D;AACA,IAAA,YAAA,CAAa,KAAA,EAAM;AACnB,IAAA,KAAA,MAAW,GAAG,CAAC,CAAA,IAAK,WAAA,EAAa;AAC/B,MAAA,YAAA,CAAa,EAAE,KAAK,CAAA;AACpB,MAAA,IAAI,CAAA,CAAE,SAAS,UAAA,EAAY;AACzB,QAAA,CAAA,CAAE,MAAA,CAAO,IAAI,KAAA,CAAM,6CAA6C,CAAC,CAAA;AAAA,MACnE,CAAA,MAAO;AAIL,QAAA,IAAI,CAAC,EAAE,WAAA,EAAa;AAClB,UAAA,CAAA,CAAE,MAAA,CAAO,IAAI,KAAA,CAAM,kDAAkD,CAAC,CAAA;AAAA,QACxE,CAAA,MAAA,IAAW,CAAA,CAAE,UAAA,IAAc,CAAC,EAAE,KAAA,EAAO;AACnC,UAAA,IAAI;AACF,YAAA,CAAA,CAAE,UAAA,CAAW,KAAA,CAAM,IAAI,KAAA,CAAM,2BAA2B,CAAC,CAAA;AAAA,UAC3D,CAAA,CAAA,MAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,IAAA,WAAA,CAAY,KAAA,EAAM;AAClB,IAAA,KAAA,MAAW,GAAG,CAAC,CAAA,IAAK,aAAA,EAAe;AACjC,MAAA,YAAA,CAAa,EAAE,KAAK,CAAA;AACpB,MAAA,CAAA,CAAE,MAAA,CAAO,IAAI,KAAA,CAAM,4CAA4C,CAAC,CAAA;AAAA,IAClE;AACA,IAAA,aAAA,CAAc,KAAA,EAAM;AACpB,IAAA,KAAA,MAAW,GAAG,IAAI,CAAA,IAAK,OAAA,EAAS;AAC9B,MAAA,IAAA,CAAK,kBAAA,EAAmB;AAAA,IAC1B;AACA,IAAA,OAAA,CAAQ,KAAA,EAAM;AACd,IAAA,QAAA,EAAS;AACT,IAAA,QAAA,EAAS;AAAA,EACX,CAAC,CAAA;AAED,EAAA,SAAS,cAAc,KAAA,EAA0B;AAC/C,IAAA,QAAQ,MAAM,CAAA;AAAG,MACf,KAAK,OAAA;AACH,QAAA,IAAI,KAAA,CAAM,YAAY,cAAA,EAAgB;AAIpC,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,qBAAA,EAAwB,KAAA,CAAM,OAAO,CAAA,qBAAA,EAAwB,cAAc,CAAA,CAAA;AAAA,WAC7E;AAAA,QACF;AACA,QAAA,KAAA,GAAQ,KAAA;AACR,QAAA;AAAA,MACF,KAAK,SAAA,EAAW;AACd,QAAA,MAAM,OAAA,GAAU,YAAA,CAAa,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AAC7C,QAAA,IAAI,OAAA,EAAS;AACX,UAAA,YAAA,CAAa,MAAA,CAAO,MAAM,MAAM,CAAA;AAChC,UAAA,OAAA,CAAQ,QAAQ,KAAK,CAAA;AAAA,QACvB;AACA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,QAAA,EAAU;AACb,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACzC,QAAA,IAAA,EAAM,YAAA,CAAa,UAAA,CAAY,KAAA,CAAsB,IAAI,CAAC,CAAA;AAC1D,QAAA;AAAA,MACF;AAAA,MACA,KAAK,QAAA,EAAU;AACb,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACzC,QAAA,IAAA,EAAM,YAAA,CAAa,UAAA,CAAY,KAAA,CAAsB,IAAI,CAAC,CAAA;AAC1D,QAAA;AAAA,MACF;AAAA,MACA,KAAK,MAAA,EAAQ;AACX,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACzC,QAAA,IAAA,EAAM,aAAa,KAAkB,CAAA;AACrC,QAAA,WAAA,CAAY,MAAA,CAAO,MAAM,MAAM,CAAA;AAC/B,QAAA;AAAA,MACF;AAAA,MACA,KAAK,OAAA,EAAS;AACZ,QAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,UAAA,MAAM,OAAA,GAAU,YAAA,CAAa,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AAC7C,UAAA,IAAI,OAAA,EAAS;AACX,YAAA,YAAA,CAAa,MAAA,CAAO,MAAM,MAAM,CAAA;AAChC,YAAA,OAAA,CAAQ,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,KAAA,CAAM,OAAO,CAAA,CAAE,CAAC,CAAA;AAC3D,YAAA;AAAA,UACF;AACA,UAAA,MAAM,IAAA,GAAO,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACzC,UAAA,IAAA,EAAM,WAAA,CAAY,IAAI,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,KAAA,CAAM,OAAO,CAAA,CAAE,CAAC,CAAA;AAC9D,UAAA;AAAA,QACF;AAIA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,eAAA,EAAiB;AAEpB,QAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AAC3C,QAAA,IAAI,CAAC,OAAA,EAAS;AACd,QAAA,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA;AAC9B,QAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,QAAA,MAAM,IAAA,GAAO,MAAM,IAAA,GAAO,UAAA,CAAW,MAAM,IAAI,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACjE,QAAA,IAAI,OAAA,CAAQ,SAAS,UAAA,EAAY;AAC/B,UAAA,OAAA,CAAQ,OAAA,CAAQ;AAAA,YACd,QAAQ,KAAA,CAAM,MAAA;AAAA,YACd,OAAA,EAAS,KAAA,CAAM,OAAA,IAAW,EAAC;AAAA,YAC3B,IAAA;AAAA,YACA,GAAI,MAAM,KAAA,GAAQ,EAAE,OAAO,KAAA,CAAM,KAAA,KAAU;AAAC,WAC7C,CAAA;AAAA,QACH,CAAA,MAAO;AAIL,UAAA,MAAM,MAAA,GAAS,IAAI,cAAA,CAA2B;AAAA,YAC5C,MAAM,UAAA,EAAY;AAChB,cAAA,IAAI,IAAA,CAAK,SAAS,CAAA,EAAG,UAAA,CAAW,QAAQ,IAAI,UAAA,CAAW,IAAI,CAAC,CAAA;AAC5D,cAAA,UAAA,CAAW,KAAA,EAAM;AAAA,YACnB;AAAA,WACD,CAAA;AACD,UAAA,OAAA,CAAQ,WAAA,CAAY;AAAA,YAClB,QAAQ,KAAA,CAAM,MAAA;AAAA,YACd,OAAA,EAAS,KAAA,CAAM,OAAA,IAAW,EAAC;AAAA,YAC3B,IAAA,EAAM;AAAA,WACP,CAAA;AAAA,QACH;AACA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,oBAAA,EAAsB;AACzB,QAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AAC3C,QAAA,IAAI,CAAC,OAAA,EAAS;AACd,QAAA,MAAM,OAAA,GAAU,KAAA,CAAM,OAAA,IAAW,EAAC;AAClC,QAAA,IAAI,OAAA,CAAQ,SAAS,QAAA,EAAU;AAI7B,UAAA,MAAM,MAAA,GAAS,IAAI,cAAA,CAA2B;AAAA,YAC5C,MAAM,UAAA,EAAY;AAChB,cAAA,OAAA,CAAQ,UAAA,GAAa,UAAA;AACrB,cAAA,KAAA,MAAW,KAAA,IAAS,QAAQ,aAAA,EAAe;AACzC,gBAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG,UAAA,CAAW,QAAQ,IAAI,UAAA,CAAW,KAAK,CAAC,CAAA;AAAA,cAChE;AACA,cAAA,OAAA,CAAQ,gBAAgB,EAAC;AAAA,YAC3B,CAAA;AAAA,YACA,QAAQ,MAAM;AAMZ,cAAA,IAAI,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,KAAK,MAAM,OAAA,EAAS;AAC5C,gBAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,gBAAA,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA;AAAA,cAChC;AAAA,YACF;AAAA,WACD,CAAA;AACD,UAAA,OAAA,CAAQ,WAAA,GAAc,IAAA;AAGtB,UAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,UAAA,OAAA,CAAQ,WAAA,CAAY;AAAA,YAClB,QAAQ,KAAA,CAAM,MAAA;AAAA,YACd,OAAA;AAAA,YACA,IAAA,EAAM;AAAA,WACP,CAAA;AAAA,QACH,CAAA,MAAO;AAGL,UAAA,OAAA,CAAQ,UAAA,GAAa,EAAE,MAAA,EAAQ,KAAA,CAAM,QAAQ,OAAA,EAAQ;AAAA,QACvD;AACA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,qBAAA,EAAuB;AAC1B,QAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AAC3C,QAAA,IAAI,CAAC,OAAA,EAAS;AACd,QAAA,MAAM,IAAA,GAAO,MAAM,IAAA,GAAO,UAAA,CAAW,MAAM,IAAI,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACjE,QAAA,IAAI,OAAA,CAAQ,SAAS,QAAA,EAAU;AAC7B,UAAA,IAAI,MAAM,KAAA,EAAO;AAEf,YAAA,IAAI;AACF,cAAA,OAAA,CAAQ,UAAA,EAAY,KAAA;AAAA,gBAClB,IAAI,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,KAAA,CAAM,KAAA,CAAM,OAAO,CAAA,CAAE;AAAA,eACzD;AAAA,YACF,CAAA,CAAA,MAAQ;AAAA,YAER;AACA,YAAA,OAAA,CAAQ,KAAA,GAAQ,IAAA;AAChB,YAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,YAAA,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA;AAC9B,YAAA;AAAA,UACF;AACA,UAAA,IAAI,QAAQ,UAAA,EAAY;AACtB,YAAA,IAAI,IAAA,CAAK,SAAS,CAAA,EAAG;AACnB,cAAA,IAAI;AACF,gBAAA,OAAA,CAAQ,UAAA,CAAW,OAAA,CAAQ,IAAI,UAAA,CAAW,IAAI,CAAC,CAAA;AAAA,cACjD,CAAA,CAAA,MAAQ;AAAA,cAER;AAAA,YACF;AACA,YAAA,IAAI,MAAM,GAAA,EAAK;AACb,cAAA,IAAI;AACF,gBAAA,OAAA,CAAQ,WAAW,KAAA,EAAM;AAAA,cAC3B,CAAA,CAAA,MAAQ;AAAA,cAER;AACA,cAAA,OAAA,CAAQ,KAAA,GAAQ,IAAA;AAChB,cAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,cAAA,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA;AAAA,YAChC;AAAA,UACF,CAAA,MAAO;AAEL,YAAA,IAAI,KAAK,MAAA,GAAS,CAAA,EAAG,OAAA,CAAQ,aAAA,CAAc,KAAK,IAAI,CAAA;AACpD,YAAA,IAAI,MAAM,GAAA,EAAK;AAGb,cAAA,OAAA,CAAQ,KAAA,GAAQ,IAAA;AAAA,YAClB;AAAA,UACF;AAAA,QACF,CAAA,MAAO;AAEL,UAAA,IAAI,KAAK,MAAA,GAAS,CAAA,EAAG,OAAA,CAAQ,YAAA,CAAa,KAAK,IAAI,CAAA;AACnD,UAAA,IAAI,MAAM,KAAA,EAAO;AACf,YAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,YAAA,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA;AAC9B,YAAA,MAAM,YAAA,GAAe,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA;AACvD,YAAA,OAAA,CAAQ,OAAA,CAAQ;AAAA,cACd,MAAA,EAAQ,OAAA,CAAQ,UAAA,EAAY,MAAA,IAAU,GAAA;AAAA,cACtC,OAAA,EAAS,OAAA,CAAQ,UAAA,EAAY,OAAA,IAAW,EAAC;AAAA,cACzC,IAAA,EAAM,YAAA;AAAA,cACN,OAAO,KAAA,CAAM;AAAA,aACd,CAAA;AACD,YAAA;AAAA,UACF;AACA,UAAA,IAAI,MAAM,GAAA,EAAK;AACb,YAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,YAAA,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA;AAC9B,YAAA,MAAM,YAAA,GAAe,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA;AACvD,YAAA,OAAA,CAAQ,OAAA,CAAQ;AAAA,cACd,MAAA,EAAQ,OAAA,CAAQ,UAAA,EAAY,MAAA,IAAU,GAAA;AAAA,cACtC,OAAA,EAAS,OAAA,CAAQ,UAAA,EAAY,OAAA,IAAW,EAAC;AAAA,cACzC,IAAA,EAAM;AAAA,aACP,CAAA;AAAA,UACH;AAAA,QACF;AACA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,aAAA,EAAe;AAClB,QAAA,MAAM,OAAA,GAAU,aAAA,CAAc,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AAC7C,QAAA,IAAI,CAAC,OAAA,EAAS;AACd,QAAA,aAAA,CAAc,MAAA,CAAO,MAAM,KAAK,CAAA;AAChC,QAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,QAAA,IAAI,KAAA,CAAM,KAAA,IAAS,KAAA,CAAM,MAAA,KAAW,GAAA,EAAK;AACvC,UAAA,MAAM,OAAO,KAAA,CAAM,KAAA,EAAO,IAAA,IAAQ,CAAA,KAAA,EAAQ,MAAM,MAAM,CAAA,CAAA;AACtD,UAAA,MAAM,MACJ,KAAA,CAAM,KAAA,EAAO,OAAA,IACb,CAAA,6BAAA,EAAgC,MAAM,MAAM,CAAA,CAAA;AAC9C,UAAA,OAAA,CAAQ,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,GAAG,EAAE,CAAC,CAAA;AAC3C,UAAA;AAAA,QACF;AACA,QAAA,MAAM,OAAO,IAAI,mBAAA;AAAA,UACf,KAAA,CAAM,KAAA;AAAA,UACN,MAAM,QAAA,IAAY,IAAA;AAAA,UAClB,IAAA,CAAK,IAAA;AAAA,UACL,MAAM,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,KAAK;AAAA,SAClC;AACA,QAAA,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,KAAA,EAAO,IAAI,CAAA;AAC7B,QAAA,OAAA,CAAQ,QAAQ,IAAI,CAAA;AACpB,QAAA;AAAA,MACF;AAAA,MACA,KAAK,YAAA,EAAc;AACjB,QAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AACpC,QAAA,IAAI,CAAC,IAAA,EAAM;AACX,QAAA,IAAA,CAAK,gBAAgB,UAAA,CAAW,KAAA,CAAM,IAAI,CAAA,EAAG,KAAA,CAAM,WAAW,IAAI,CAAA;AAClE,QAAA;AAAA,MACF;AAAA,MACA,KAAK,UAAA,EAAY;AAGf,QAAA,MAAM,OAAA,GAAU,aAAA,CAAc,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AAC7C,QAAA,IAAI,OAAA,EAAS;AACX,UAAA,aAAA,CAAc,MAAA,CAAO,MAAM,KAAK,CAAA;AAChC,UAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,UAAA,OAAA,CAAQ,MAAA;AAAA,YACN,IAAI,KAAA;AAAA,cACF,CAAA,+BAAA,EAAkC,KAAA,CAAM,IAAI,CAAA,EAAG,KAAA,CAAM,SAAS,CAAA,EAAA,EAAK,KAAA,CAAM,MAAM,CAAA,CAAA,GAAK,EAAE,CAAA,CAAA;AAAA;AACxF,WACF;AACA,UAAA;AAAA,QACF;AACA,QAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AACpC,QAAA,IAAI,IAAA,EAAM;AACR,UAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,KAAK,CAAA;AAC1B,UAAA,IAAA,CAAK,aAAA,CAAc,KAAA,CAAM,IAAA,EAAM,KAAA,CAAM,UAAU,EAAE,CAAA;AAAA,QACnD;AACA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,MAAA;AACH,QAAA,IAAA,CAAK,IAAA,CAAK,KAAK,EAAE,CAAA,EAAG,QAAQ,KAAA,EAAO,KAAA,CAAM,OAAO,CAAA;AAChD,QAAA;AAAA,MACF,KAAK,MAAA;AAAA,MACL,KAAK,OAAA;AAAA,MACL,KAAK,OAAA;AAAA,MACL,KAAK,MAAA;AAAA,MACL,KAAK,QAAA;AAAA,MACL,KAAK,cAAA;AAAA,MACL,KAAK,SAAA;AAEH,QAAA;AAAA;AACJ,EACF;AAEA,EAAA,OAAO;AAAA,IACL,KAAA,GAAQ;AACN,MAAA,IAAI,KAAA,EAAO,OAAO,OAAA,CAAQ,OAAA,CAAQ,KAAK,CAAA;AACvC,MAAA,IAAI,cAAc,OAAO,YAAA;AACzB,MAAA,YAAA,GAAe,IAAI,OAAA,CAAoB,CAAC,OAAA,EAAS,MAAA,KAAW;AAC1D,QAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,UAAA,MAAA;AAAA,YACE,IAAI,KAAA;AAAA,cACF,2CAA2C,cAAc,CAAA,GAAA;AAAA;AAC3D,WACF;AAAA,QACF,GAAG,cAAc,CAAA;AAEjB,QAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,CAAC,KAAA,KAAU;AACvC,UAAA,IAAI,KAAA,CAAM,MAAM,OAAA,EAAS;AACzB,UAAA,YAAA,CAAa,KAAK,CAAA;AAClB,UAAA,GAAA,EAAI;AACJ,UAAA,IAAI,KAAA,CAAM,YAAY,cAAA,EAAgB;AACpC,YAAA,MAAA;AAAA,cACE,IAAI,KAAA;AAAA,gBACF,CAAA,qBAAA,EAAwB,KAAA,CAAM,OAAO,CAAA,gBAAA,EAAmB,cAAc,CAAA,CAAA;AAAA;AACxE,aACF;AACA,YAAA;AAAA,UACF;AACA,UAAA,KAAA,GAAQ,KAAA;AACR,UAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,QACf,CAAC,CAAA;AAAA,MACH,CAAC,CAAA;AACD,MAAA,OAAO,YAAA;AAAA,IACT,CAAA;AAAA,IAEA,MAAM,KAAA,CAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAW;AACpC,MAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAA,CAAK,KAAA,EAAM;AAC7B,MAAA,IAAI,SAAA,EAAW,GAAA,IAAO,KAAA,EAAO,YAAA,CAAa,QAAQ,IAAA,EAAM;AACtD,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,eAAA,EAAkB,KAAA,EAAO,KAAA,IAAS,WAAW,CAAA,iCAAA;AAAA,SAC/C;AAAA,MACF;AACA,MAAA,MAAM,SAAS,UAAA,EAAW;AAC1B,MAAA,MAAM,GAAA,GAAkB;AAAA,QACtB,CAAA,EAAG,OAAA;AAAA,QACH,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA;AAAA,QACA,KAAK,SAAA,EAAW,GAAA;AAAA,QAChB,KAAK,SAAA,EAAW,GAAA;AAAA,QAChB,KAAK,SAAA,EAAW,GAAA;AAAA,QAChB,GAAI,SAAA,EAAW,GAAA,GAAM,EAAE,IAAA,EAAM,SAAA,CAAU,IAAA,IAAQ,EAAA,EAAI,IAAA,EAAM,SAAA,CAAU,IAAA,IAAQ,EAAA,KAAO;AAAC,OACrF;AACA,MAAA,MAAM,YAAA,GAAe,MAAM,IAAI,OAAA;AAAA,QAC7B,CAAC,SAAS,MAAA,KAAW;AACnB,UAAA,YAAA,CAAa,GAAA,CAAI,MAAA,EAAQ,EAAE,OAAA,EAAS,QAAQ,CAAA;AAC5C,UAAA,IAAA,CAAK,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,QACpB;AAAA,OACF;AACA,MAAA,MAAM,OAAO,IAAI,eAAA,CAAgB,QAAQ,YAAA,CAAa,GAAA,EAAK,KAAK,IAAI,CAAA;AACpE,MAAA,WAAA,CAAY,GAAA,CAAI,QAAQ,IAAI,CAAA;AAC5B,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IAEA,MAAM,YAAY,GAAA,EAAqD;AACrE,MAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAA,CAAK,KAAA,EAAM;AAC7B,MAAA,MAAM,QAAQ,UAAA,EAAW;AACzB,MAAA,MAAM,SAAA,GAAY,IAAI,SAAA,IAAa,GAAA;AACnC,MAAA,MAAM,IAAA,GACJ,GAAA,CAAI,IAAA,KAAS,MAAA,GACT,MAAA,GACA,UAAA;AAAA,QACE,OAAO,IAAI,IAAA,KAAS,QAAA,GAAW,IAAI,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,IAAI;AAAA,OAChE;AACN,MAAA,MAAM,KAAA,GAA0B;AAAA,QAC9B,CAAA,EAAG,cAAA;AAAA,QACH,KAAA;AAAA,QACA,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,GAAI,IAAI,OAAA,GAAU,EAAE,SAAS,GAAA,CAAI,OAAA,KAAY,EAAC;AAAA,QAC9C,GAAI,IAAA,KAAS,MAAA,GAAY,EAAE,IAAA,KAAS,EAAC;AAAA,QACrC;AAAA,OACF;AACA,MAAA,OAAO,IAAI,OAAA,CAA4B,CAAC,OAAA,EAAS,MAAA,KAAW;AAI1D,QAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,UAAA,WAAA,CAAY,OAAO,KAAK,CAAA;AACxB,UAAA,MAAA;AAAA,YACE,IAAI,KAAA;AAAA,cACF,CAAA,mBAAA,EAAsB,IAAI,MAAM,CAAA,CAAA,EAAI,IAAI,IAAI,CAAA,kBAAA,EAAqB,YAAY,GAAK,CAAA,GAAA;AAAA;AACpF,WACF;AAAA,QACF,CAAA,EAAG,YAAY,GAAK,CAAA;AACpB,QAAA,WAAA,CAAY,IAAI,KAAA,EAAO;AAAA,UACrB,IAAA,EAAM,UAAA;AAAA,UACN,OAAA;AAAA,UACA,MAAA;AAAA,UACA,KAAA;AAAA,UACA,UAAA,EAAY,IAAA;AAAA,UACZ,cAAc;AAAC,SAChB,CAAA;AACD,QAAA,IAAA,CAAK,IAAA,CAAK,KAAK,KAAK,CAAA;AAAA,MACtB,CAAC,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,MAAM,kBACJ,GAAA,EACmC;AACnC,MAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAA,CAAK,KAAA,EAAM;AAC7B,MAAA,MAAM,QAAQ,UAAA,EAAW;AAMzB,MAAA,MAAM,aAAA,GAAgB,IAAI,SAAA,IAAa,GAAA;AACvC,MAAA,MAAM,IAAA,GACJ,GAAA,CAAI,IAAA,KAAS,MAAA,GACT,MAAA,GACA,UAAA;AAAA,QACE,OAAO,IAAI,IAAA,KAAS,QAAA,GAAW,IAAI,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,IAAI;AAAA,OAChE;AAMN,MAAA,MAAM,KAAA,GAA0B;AAAA,QAC9B,CAAA,EAAG,cAAA;AAAA,QACH,KAAA;AAAA,QACA,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,GAAI,IAAI,OAAA,GAAU,EAAE,SAAS,GAAA,CAAI,OAAA,KAAY,EAAC;AAAA,QAC9C,GAAI,IAAA,KAAS,MAAA,GAAY,EAAE,IAAA,KAAS,EAAC;AAAA,QACrC,SAAA,EAAW,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK;AAAA;AAAA,OAC5B;AACA,MAAA,OAAO,IAAI,OAAA,CAAkC,CAAC,WAAA,EAAa,MAAA,KAAW;AACpE,QAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,UAAA,IAAI,WAAA,CAAY,GAAA,CAAI,KAAK,CAAA,EAAG;AAC1B,YAAA,WAAA,CAAY,OAAO,KAAK,CAAA;AACxB,YAAA,MAAA;AAAA,cACE,IAAI,KAAA;AAAA,gBACF,4BAA4B,GAAA,CAAI,MAAM,IAAI,GAAA,CAAI,IAAI,gCAAgC,aAAa,CAAA,GAAA;AAAA;AACjG,aACF;AAAA,UACF;AAAA,QACF,GAAG,aAAa,CAAA;AAChB,QAAA,WAAA,CAAY,IAAI,KAAA,EAAO;AAAA,UACrB,IAAA,EAAM,QAAA;AAAA,UACN,WAAA;AAAA,UACA,MAAA;AAAA,UACA,KAAA;AAAA,UACA,UAAA,EAAY,IAAA;AAAA,UACZ,eAAe,EAAC;AAAA,UAChB,WAAA,EAAa,KAAA;AAAA,UACb,KAAA,EAAO;AAAA,SACR,CAAA;AACD,QAAA,IAAA,CAAK,IAAA,CAAK,KAAK,KAAK,CAAA;AAAA,MACtB,CAAC,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,MAAM,iBACJ,GAAA,EAC0B;AAC1B,MAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,KAAA,EAAM;AAC3B,MAAA,IAAI,CAAA,CAAE,YAAA,CAAa,SAAA,KAAc,IAAA,EAAM;AACrC,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,eAAA,EAAkB,CAAA,CAAE,KAAA,IAAS,WAAW,CAAA,4FAAA;AAAA,SAC1C;AAAA,MACF;AACA,MAAA,MAAM,QAAQ,UAAA,EAAW;AACzB,MAAA,MAAM,SAAA,GAAY,IAAI,aAAA,IAAiB,GAAA;AACvC,MAAA,MAAM,KAAA,GAAqB;AAAA,QACzB,CAAA,EAAG,SAAA;AAAA,QACH,KAAA;AAAA,QACA,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,GAAI,IAAI,OAAA,GAAU,EAAE,SAAS,GAAA,CAAI,OAAA,KAAY,EAAC;AAAA,QAC9C,GAAI,GAAA,CAAI,SAAA,IAAa,GAAA,CAAI,SAAA,CAAU,MAAA,GAAS,CAAA,GACxC,EAAE,SAAA,EAAW,GAAA,CAAI,SAAA,EAAU,GAC3B;AAAC,OACP;AACA,MAAA,OAAO,IAAI,OAAA,CAAyB,CAAC,OAAA,EAAS,MAAA,KAAW;AACvD,QAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,UAAA,IAAI,CAAC,aAAA,CAAc,GAAA,CAAI,KAAK,CAAA,EAAG;AAC/B,UAAA,aAAA,CAAc,OAAO,KAAK,CAAA;AAC1B,UAAA,MAAA;AAAA,YACE,IAAI,KAAA;AAAA,cACF,CAAA,wBAAA,EAA2B,GAAA,CAAI,IAAI,CAAA,qCAAA,EAAwC,SAAS,CAAA,GAAA;AAAA;AACtF,WACF;AAAA,QACF,GAAG,SAAS,CAAA;AACZ,QAAA,aAAA,CAAc,IAAI,KAAA,EAAO,EAAE,OAAA,EAAS,MAAA,EAAQ,OAAO,CAAA;AACnD,QAAA,IAAA,CAAK,IAAA,CAAK,KAAK,KAAK,CAAA;AAAA,MACtB,CAAC,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,MAAM,KAAA,GAAQ;AACZ,MAAA,IAAA,CAAK,IAAA,CAAK,MAAM,cAAc,CAAA;AAAA,IAChC;AAAA,GACF;AACF;AAOA,IAAM,eAAA,GAAN,cAA8B,YAAA,CAA2C;AAAA,EAC9D,MAAA;AAAA,EACT,GAAA;AAAA,EACS,KAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACQ,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EAEjB,WAAA,CAAY,MAAA,EAAgB,GAAA,EAAa,IAAA,EAAiB;AACxD,IAAA,KAAA,EAAM;AACN,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA,GAAM,CAAA,GAAI,GAAA,GAAM,IAAA;AAC3B,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAIZ,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,QAAA,CAAS,EAAE,IAAA,GAAO;AAAA,IAAC,GAAG,CAAA;AACxC,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,QAAA,CAAS,EAAE,IAAA,GAAO;AAAA,IAAC,GAAG,CAAA;AAGxC,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAI,QAAA,CAAS;AAAA,MACxB,KAAA,CAAM,KAAA,EAAwB,IAAA,EAAM,EAAA,EAAI;AACtC,QAAA,IAAA,CAAK,IAAA,CAAK;AAAA,UACR,CAAA,EAAG,OAAA;AAAA,UACH,MAAA;AAAA,UACA,IAAA,EAAM,WAAW,KAAK;AAAA,SACvB,CAAA;AACD,QAAA,EAAA,EAAG;AAAA,MACL,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,MAAM,EAAA,EAAI;AACR,QAAA,IAAA,CAAK,KAAK,EAAE,CAAA,EAAG,SAAS,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAC1C,QAAA,EAAA,EAAG;AAAA,MACL;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAEA,aAAa,GAAA,EAAmB;AAC9B,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,EACtB;AAAA,EAEA,aAAa,GAAA,EAAmB;AAC9B,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,EACtB;AAAA,EAEA,YAAY,GAAA,EAAkB;AAC5B,IAAA,IAAA,CAAK,IAAA,CAAK,SAAS,GAAG,CAAA;AAAA,EACxB;AAAA,EAEA,aAAa,KAAA,EAAwB;AACnC,IAAA,IAAI,KAAK,MAAA,EAAQ;AACjB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AACd,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,IAAI,CAAA;AACrB,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,IAAI,CAAA;AACrB,IAAA,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,KAAA,CAAM,IAAA,EAAM,MAAM,MAAM,CAAA;AAAA,EAC5C;AAAA,EAEA,kBAAA,GAA2B;AACzB,IAAA,IAAI,KAAK,MAAA,EAAQ;AACjB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AACd,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,IAAI,CAAA;AACrB,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,IAAI,CAAA;AACrB,IAAA,IAAA,CAAK,IAAA;AAAA,MACH,MAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA;AAAA,KACF;AAAA,EACF;AAAA,EAEA,IAAA,CAAK,SAAkC,SAAA,EAAoB;AACzD,IAAA,IAAI,IAAA,CAAK,QAAQ,OAAO,KAAA;AACxB,IAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,MACb,CAAA,EAAG,MAAA;AAAA,MACH,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,QAAQ,OAAO,MAAA,KAAW,QAAA,GAAW,MAAA,GAAS,MAAM,MAAM,CAAA;AAAA,KAC3D,CAAA;AACD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAA,CAAO,MAAc,IAAA,EAAoB;AACvC,IAAA,IAAI,KAAK,MAAA,EAAQ;AACjB,IAAA,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,EAAE,CAAA,EAAG,QAAA,EAAU,QAAQ,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,IAAA,EAAM,CAAA;AAAA,EACjE;AACF,CAAA;AAcA,IAAM,sBAAN,MAAqD;AAAA,EAC1C,QAAA;AAAA,EACD,WAAA,GAA6C,MAAA;AAAA,EACpC,KAAA;AAAA,EACA,IAAA;AAAA,EACA,SAAA;AAAA,EACA,gBAAA,uBAAuB,GAAA,EAEtC;AAAA,EACe,cAAA,uBAAqB,GAAA,EAEpC;AAAA,EACe,cAAA,uBAAqB,GAAA,EAA0B;AAAA,EAEhE,WAAA,CACE,KAAA,EACA,QAAA,EACA,IAAA,EACA,SAAA,EACA;AACA,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AAAA,EAEA,IAAI,UAAA,GAA4C;AAC9C,IAAA,OAAO,IAAA,CAAK,WAAA;AAAA,EACd;AAAA,EAEA,KAAK,IAAA,EAAiC;AACpC,IAAA,IAAI,IAAA,CAAK,gBAAgB,MAAA,EAAQ;AACjC,IAAA,MAAM,KAAA,GACJ,OAAO,IAAA,KAAS,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,IAAA,EAAM,MAAM,CAAA,GAAI,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AACzE,IAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,MACb,CAAA,EAAG,YAAA;AAAA,MACH,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,IAAA,EAAM,WAAW,KAAK,CAAA;AAAA,MACtB,MAAA,EAAQ,OAAO,IAAA,KAAS;AAAA,KACzB,CAAA;AAAA,EACH;AAAA,EAEA,KAAA,CAAM,IAAA,GAAe,GAAA,EAAM,MAAA,EAAuB;AAChD,IAAA,IAAI,IAAA,CAAK,gBAAgB,QAAA,EAAU;AACnC,IAAA,IAAI,IAAA,CAAK,gBAAgB,MAAA,EAAQ;AAC/B,MAAA,IAAA,CAAK,WAAA,GAAc,SAAA;AACnB,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,UAAA;AAAA,QACH,OAAO,IAAA,CAAK,KAAA;AAAA,QACZ,IAAA;AAAA,QACA,GAAI,MAAA,GAAS,EAAE,MAAA,KAAW;AAAC,OAC5B,CAAA;AAAA,IACH;AAKA,IAAA,IAAA,CAAK,aAAA,CAAc,IAAA,EAAM,MAAA,IAAU,EAAE,CAAA;AAAA,EACvC;AAAA,EAEA,UACE,QAAA,EACY;AACZ,IAAA,IAAA,CAAK,gBAAA,CAAiB,IAAI,QAAQ,CAAA;AAClC,IAAA,OAAO,MAAM,IAAA,CAAK,gBAAA,CAAiB,MAAA,CAAO,QAAQ,CAAA;AAAA,EACpD;AAAA,EAEA,QAAQ,QAAA,EAA8D;AACpE,IAAA,IAAA,CAAK,cAAA,CAAe,IAAI,QAAQ,CAAA;AAChC,IAAA,OAAO,MAAM,IAAA,CAAK,cAAA,CAAe,MAAA,CAAO,QAAQ,CAAA;AAAA,EAClD;AAAA,EAEA,QAAQ,QAAA,EAA4C;AAClD,IAAA,IAAA,CAAK,cAAA,CAAe,IAAI,QAAQ,CAAA;AAChC,IAAA,OAAO,MAAM,IAAA,CAAK,cAAA,CAAe,MAAA,CAAO,QAAQ,CAAA;AAAA,EAClD;AAAA,EAEA,eAAA,CAAgB,MAAc,QAAA,EAAyB;AACrD,IAAA,IAAI,IAAA,CAAK,gBAAgB,MAAA,EAAQ;AACjC,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,gBAAA,EAAkB;AACrC,MAAA,IAAI;AACF,QAAA,CAAA,CAAE,MAAM,QAAQ,CAAA;AAAA,MAClB,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA,EAEA,aAAA,CAAc,MAAc,MAAA,EAAsB;AAChD,IAAA,IAAI,IAAA,CAAK,gBAAgB,QAAA,EAAU;AACnC,IAAA,IAAA,CAAK,WAAA,GAAc,QAAA;AACnB,IAAA,IAAA,CAAK,SAAA,EAAU;AACf,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,cAAA,EAAgB;AACnC,MAAA,IAAI;AACF,QAAA,CAAA,CAAE,MAAM,MAAM,CAAA;AAAA,MAChB,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,CAAK,iBAAiB,KAAA,EAAM;AAC5B,IAAA,IAAA,CAAK,eAAe,KAAA,EAAM;AAC1B,IAAA,IAAA,CAAK,eAAe,KAAA,EAAM;AAAA,EAC5B;AAAA,EAEA,kBAAA,GAA2B;AACzB,IAAA,IAAI,IAAA,CAAK,gBAAgB,QAAA,EAAU;AACnC,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,cAAA,EAAgB;AACnC,MAAA,IAAI;AACF,QAAA,CAAA,CAAE,IAAI,KAAA,CAAM,uBAAuB,CAAC,CAAA;AAAA,MACtC,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,CAAK,aAAA,CAAc,MAAM,eAAe,CAAA;AAAA,EAC1C;AACF,CAAA;;;ACx8BA,IAAM,UAAA,GAAa,CAAA;AAEZ,SAAS,cAAc,EAAA,EAA8B;AAC1D,EAAA,MAAM,aAAA,uBAAoB,GAAA,EAAkC;AAC5D,EAAA,MAAM,aAAA,uBAAoB,GAAA,EAA+B;AACzD,EAAA,IAAI,MAAA,GAAS,GAAG,UAAA,KAAe,UAAA;AAM/B,EAAA,MAAM,SAAA,GAAY,CAAC,EAAA,KAAsD;AACvE,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI,OAAO,EAAA,CAAG,IAAA,KAAS,QAAA,SAAiB,EAAA,CAAG,IAAA;AAAA,SAAA,IAClC,EAAA,CAAG,IAAA,YAAgB,WAAA,EAAa,IAAA,GAAO,MAAA,CAAO,KAAK,EAAA,CAAG,IAAI,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA;AAAA,SAC/E,IAAA,GAAQ,EAAA,CAAG,IAAA,CAAgB,QAAA,CAAS,MAAM,CAAA;AAC/C,IAAA,MAAM,KAAA,GAAQ,WAAW,IAAI,CAAA;AAC7B,IAAA,IAAI,CAAC,KAAA,EAAO;AACZ,IAAA,KAAA,MAAW,CAAA,IAAK,aAAA,EAAe,CAAA,CAAE,KAAK,CAAA;AAAA,EACxC,CAAA;AAEA,EAAA,MAAM,UAAU,MAAY;AAC1B,IAAA,IAAI,CAAC,MAAA,EAAQ;AACb,IAAA,MAAA,GAAS,KAAA;AACT,IAAA,KAAA,MAAW,CAAA,IAAK,aAAA,EAAe,CAAA,CAAE,kBAAkB,CAAA;AACnD,IAAA,aAAA,CAAc,KAAA,EAAM;AACpB,IAAA,aAAA,CAAc,KAAA,EAAM;AAAA,EACtB,CAAA;AAEA,EAAA,MAAM,OAAA,GAAU,CAAC,EAAA,KAAmC;AAClD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACb,IAAA,MAAA,GAAS,KAAA;AACT,IAAA,KAAA,MAAW,CAAA,IAAK,aAAA,EAAe,CAAA,CAAE,EAAA,CAAG,WAAW,iBAAiB,CAAA;AAChE,IAAA,aAAA,CAAc,KAAA,EAAM;AACpB,IAAA,aAAA,CAAc,KAAA,EAAM;AAAA,EACtB,CAAA;AAEA,EAAA,EAAA,CAAG,gBAAA,CAAiB,WAAW,SAAS,CAAA;AACxC,EAAA,EAAA,CAAG,gBAAA,CAAiB,SAAS,OAAO,CAAA;AACpC,EAAA,EAAA,CAAG,gBAAA,CAAiB,SAAS,OAAO,CAAA;AAEpC,EAAA,OAAO;AAAA,IACL,IAAI,MAAA,GAAS;AACX,MAAA,OAAO,MAAA;AAAA,IACT,CAAA;AAAA,IACA,KAAK,KAAA,EAAO;AACV,MAAA,IAAI,CAAC,MAAA,EAAQ;AACb,MAAA,IAAI;AACF,QAAA,EAAA,CAAG,IAAA,CAAK,WAAA,CAAY,KAAK,CAAC,CAAA;AAAA,MAC5B,CAAA,CAAA,MAAQ;AAAA,MAGR;AAAA,IACF,CAAA;AAAA,IACA,MAAM,MAAA,EAAQ;AACZ,MAAA,IAAI,CAAC,MAAA,EAAQ;AACb,MAAA,IAAI;AACF,QAAA,EAAA,CAAG,KAAA,CAAM,KAAM,MAAM,CAAA;AAAA,MACvB,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF,CAAA;AAAA,IACA,QAAQ,OAAA,EAAS;AACf,MAAA,aAAA,CAAc,IAAI,OAAO,CAAA;AACzB,MAAA,OAAO,MAAM,aAAA,CAAc,MAAA,CAAO,OAAO,CAAA;AAAA,IAC3C,CAAA;AAAA,IACA,QAAQ,OAAA,EAAS;AACf,MAAA,aAAA,CAAc,IAAI,OAAO,CAAA;AACzB,MAAA,OAAO,MAAM,aAAA,CAAc,MAAA,CAAO,OAAO,CAAA;AAAA,IAC3C;AAAA,GACF;AACF","file":"index.mjs","sourcesContent":["/**\n * Tunnel frame protocol — agentproto/tunnel/v1.\n *\n * Bidirectional, event-shaped frames over a single duplex transport\n * (typically a WebSocket). Each frame is one JSON object per message.\n * The protocol is deliberately NOT JSON-RPC: process I/O is a\n * continuous event stream, not a request/response pattern, so we drop\n * the `id` / response correlation and let the underlying child-process\n * lifecycle drive everything.\n *\n * # Roles\n *\n *   host    — the orchestrator (e.g. Guilde API). Sends `spawn`,\n *             `stdin`, `kill`, `resize`. Receives `stdout`, `stderr`,\n *             `exit`, `error`. Holds the ACP client; sees the duplex\n *             stream as a `ChildProcess`-shaped duck.\n *\n *   daemon  — the local executor (e.g. `agentproto serve` on a user's\n *             laptop). Receives spawn-side frames; spawns real\n *             subprocesses; relays I/O back. Owns the actual file\n *             system, environment, network egress.\n *\n * # Identifiers\n *\n *   execId  — host-chosen UUID per spawned process. Lets one tunnel\n *             multiplex many concurrent agent CLIs (one daemon serving\n *             several conversations).\n *\n * # Encoding\n *\n *   - Each WS message is one JSON object. Binary frames are not used;\n *     stdout/stdin payloads are base64-encoded utf-safe strings.\n *   - Why base64 and not raw text: claude-code & friends emit JSON-RPC\n *     ACP traffic over stdio. A child can also emit non-utf8 bytes\n *     (debug logs, terminal control codes when in TTY mode). Base64\n *     keeps the wire JSON-clean and bytewise-faithful.\n *   - All frames carry `t` (type) and a per-type payload. Versioning\n *     is per-tunnel via `hello.version`, not per-frame.\n *\n * # Lifecycle\n *\n *   1. Daemon connects to host's WS endpoint with bearer token.\n *   2. Daemon sends `hello { version, capabilities, label? }`.\n *   3. Host sends `spawn` for each child it wants on this daemon.\n *   4. Daemon spawns, replies with `spawned { execId, pid }` (or\n *      `error { execId, message }`).\n *   5. stdout/stderr/exit notifications flow daemon→host;\n *      stdin/resize/kill flow host→daemon.\n *   6. Either side can send `ping`; receiver MUST `pong` back. Used\n *      to detect half-open connections.\n *   7. On disconnect, daemon SHOULD kill all children associated with\n *      this tunnel (host can re-spawn after reconnect).\n */\n\nexport const TUNNEL_VERSION = \"agentproto/tunnel/v1\" as const\n\n// ─── host → daemon ──────────────────────────────────────────────\n\nexport interface SpawnFrame {\n  t: \"spawn\"\n  execId: string\n  command: string\n  args: readonly string[]\n  /**\n   * Working directory on the daemon side. Daemon SHOULD reject\n   * absolute paths that escape its declared `--root` (see\n   * `agentproto serve --root`); host MUST pass paths that exist\n   * on the daemon.\n   */\n  cwd?: string\n  /**\n   * Environment overrides. Daemon merges these atop its own\n   * process.env. Daemon MAY redact values from logs but MUST forward\n   * them verbatim into the child.\n   */\n  env?: Readonly<Record<string, string>>\n  /**\n   * When true, the daemon allocates a PTY instead of plain pipes.\n   * Required for binaries that detect `isTTY` (REPLs, claude\n   * interactive). When false (default), stdin/stdout/stderr are\n   * separate pipes — the right choice for ACP wrappers that speak\n   * line-delimited JSON-RPC.\n   */\n  pty?: boolean\n  /** Initial PTY column width. Ignored when `pty` is false. Default 80. */\n  cols?: number\n  /** Initial PTY row height. Ignored when `pty` is false. Default 24. */\n  rows?: number\n}\n\nexport interface StdinFrame {\n  t: \"stdin\"\n  execId: string\n  /** Base64-encoded payload bytes. Empty string is a no-op. */\n  data: string\n}\n\nexport interface KillFrame {\n  t: \"kill\"\n  execId: string\n  /** Default \"SIGTERM\". POSIX names; Windows daemons translate. */\n  signal?: string\n}\n\nexport interface ResizeFrame {\n  t: \"resize\"\n  execId: string\n  cols: number\n  rows: number\n}\n\n/**\n * Generic HTTP-over-tunnel request (HOST → DAEMON). Lets the host\n * proxy arbitrary HTTP traffic (MCP JSON-RPC today, anything tomorrow)\n * through the daemon's local network stack without exposing a public\n * URL. The daemon forwards to its configured \"http upstream\" (default:\n * its own gateway on `127.0.0.1:<port>`) and replies with an\n * `HttpResponseFrame` carrying the same `reqId`.\n */\nexport interface HttpRequestFrame {\n  t: \"http_request\"\n  /** Correlates the response. Host-chosen, MUST be unique per inflight request. */\n  reqId: string\n  /** HTTP method (GET / POST / PUT / DELETE / PATCH / OPTIONS). */\n  method: string\n  /** Path + querystring, e.g. `/mcp` or `/mcp?session=abc`.\n   *  Daemon prepends its upstream base. Absolute URLs are rejected. */\n  path: string\n  /** Forwarded request headers. Hop-by-hop headers (Connection,\n   *  Keep-Alive, Transfer-Encoding, Upgrade, Proxy-*) MUST be stripped\n   *  before forwarding; daemon SHOULD also drop them defensively. */\n  headers?: Readonly<Record<string, string>>\n  /** Base64-encoded request body. Omitted when no body. */\n  body?: string\n  /** Per-request timeout in ms. Daemon SHOULD enforce + reply with\n   *  `error: { code: \"timeout\" }` when exceeded. Default 30_000. */\n  timeoutMs?: number\n}\n\n/**\n * Generic HTTP-over-tunnel response (DAEMON → HOST). Mirrors\n * `HttpRequestFrame` — see its docs.\n *\n * Two-frame protocol:\n *   - SHORT RESPONSES (most HTTP): daemon emits a single `http_response`\n *     with body inline. The buffered `forwardHttp` resolves directly\n *     from this frame.\n *   - STREAMED RESPONSES (text/event-stream, long-lived chunked\n *     transfers, large downloads): daemon emits `http_response_head`\n *     first with status+headers, then one or more `http_response_chunk`\n *     frames, the last of which has `end: true`. The streaming\n *     `forwardHttpStream` builds a `ReadableStream` from the chunks.\n *\n * Hosts that only support the legacy buffered API can detect the\n * stream protocol by looking for `http_response_head` and either\n * pull the chunks into a buffer (compat) or refuse to handle.\n */\nexport interface HttpResponseFrame {\n  t: \"http_response\"\n  reqId: string\n  /** HTTP status code (e.g. 200, 404, 500). Set even on transport\n   *  failure (then `error` is also set and status SHOULD be 502/504). */\n  status: number\n  headers?: Readonly<Record<string, string>>\n  /** Base64-encoded response body. */\n  body?: string\n  /** Set when the daemon failed to complete the upstream call. */\n  error?: Readonly<{\n    code: string\n    message: string\n  }>\n}\n\n/**\n * Streaming HTTP response head (DAEMON → HOST). Sent ONCE per\n * streaming response, before any chunk frames. Carries status +\n * headers so the host can finalize the response shape (e.g. write\n * Content-Type) before any body bytes arrive.\n */\nexport interface HttpResponseHeadFrame {\n  t: \"http_response_head\"\n  reqId: string\n  status: number\n  headers?: Readonly<Record<string, string>>\n}\n\n/**\n * Streaming HTTP response body chunk (DAEMON → HOST). Each chunk\n * carries some bytes of the response body. The terminal chunk has\n * `end: true` and MAY include final bytes. An immediate `end: true`\n * with no data signals empty-body close.\n *\n * `error` set on a chunk frame indicates the daemon's upstream\n * failed mid-stream; host SHOULD propagate it as a stream error.\n */\nexport interface HttpResponseChunkFrame {\n  t: \"http_response_chunk\"\n  reqId: string\n  /** Base64-encoded chunk bytes. Omitted on pure end-of-stream\n   *  markers (those carry `end: true` only). */\n  data?: string\n  /** Set on the last chunk. After this frame the host SHOULD ignore\n   *  any further frames for this reqId. */\n  end?: boolean\n  /** Set when the upstream failed mid-stream. Host surfaces this as\n   *  a stream error and closes the readable. */\n  error?: Readonly<{\n    code: string\n    message: string\n  }>\n}\n\n// ─── daemon → host ──────────────────────────────────────────────\n\nexport interface HelloFrame {\n  t: \"hello\"\n  version: typeof TUNNEL_VERSION\n  /**\n   * Daemon-declared capabilities. Hosts MAY refuse to dispatch\n   * features the daemon hasn't claimed.\n   */\n  capabilities: Readonly<{\n    pty: boolean\n    /** Daemon can bridge browser-WS upgrades to its local upstream via\n     *  `ws_open` / `ws_message` / `ws_close`. Hosts MUST gate\n     *  `forwardWebSocket()` on this — older daemons ignore the frames. */\n    wsForward?: boolean\n    /** Future: file-transfer, port-forward, etc. */\n  }>\n  /** User-friendly daemon label, surfaced in host UIs. */\n  label?: string\n  /** Daemon process info — diagnostics only, not authoritative. */\n  daemon?: Readonly<{\n    name: string\n    version: string\n    platform: string\n    nodeVersion?: string\n  }>\n}\n\nexport interface SpawnedFrame {\n  t: \"spawned\"\n  execId: string\n  pid: number\n}\n\nexport interface StdoutFrame {\n  t: \"stdout\"\n  execId: string\n  /** Base64-encoded payload bytes. */\n  data: string\n}\n\nexport interface StderrFrame {\n  t: \"stderr\"\n  execId: string\n  /** Base64-encoded payload bytes. */\n  data: string\n}\n\nexport interface ExitFrame {\n  t: \"exit\"\n  execId: string\n  /** Null when killed by signal. */\n  code: number | null\n  /** POSIX signal name when killed by signal; null otherwise. */\n  signal: string | null\n}\n\n// ─── either direction ───────────────────────────────────────────\n\nexport interface ErrorFrame {\n  t: \"error\"\n  /** Omitted for tunnel-level errors not tied to a specific exec. */\n  execId?: string\n  /** Stable machine-readable code, e.g. \"spawn_failed\", \"unknown_exec\". */\n  code: string\n  /** Human-readable diagnostic. */\n  message: string\n}\n\nexport interface PingFrame {\n  t: \"ping\"\n  /** Echoed verbatim in the matching pong. */\n  nonce: string\n}\n\nexport interface PongFrame {\n  t: \"pong\"\n  nonce: string\n}\n\n/**\n * HOST → DAEMON. Graceful drain signal sent during host rollover (e.g.\n * Kubernetes preStop). On receipt the daemon SHOULD:\n *   1. Stop accepting new in-flight work where it can.\n *   2. Close the WS cleanly (does not need to wait — host will follow\n *      up with a `close(1012, \"service_restart\")` ~2 s later as a\n *      hard backstop).\n *   3. Reconnect IMMEDIATELY without the usual exponential backoff —\n *      the host is mid-deploy, the new replica is already listening.\n *\n * Backward-compatible: daemons that don't know the frame just ignore\n * it (parseFrame returns null for unknown types). The host's close\n * then triggers the daemon's normal backoff loop — worst case ~30 s\n * reconnect gap instead of ~2 s with the handler.\n */\nexport interface ReconnectSoonFrame {\n  t: \"reconnect_soon\"\n  /** Hint of how long the host plans to wait before forcing close.\n   *  Optional — daemons MAY use it to decide whether to finish\n   *  in-flight work or close immediately. */\n  reasonMs?: number\n}\n\n// ─── WebSocket forwarding ───────────────────────────────────────\n//\n// Mirrors the HTTP-forwarding shape but for full-duplex upgrades.\n// The daemon opens a WS connection to its local upstream (typically\n// `ws://127.0.0.1:<port>${path}`), then proxies frames in both\n// directions. Each open is correlated by `reqId`.\n//\n// Capabilities: daemons MUST set `hello.capabilities.wsForward = true`\n// to opt in. Hosts that don't see it MUST NOT send `ws_open`. Older\n// daemons silently ignore unknown frames, so misrouted `ws_open` on a\n// non-capable daemon is benign (the host's open will time out).\n\n/**\n * HOST → DAEMON. Open a WS connection to the daemon's upstream.\n * Path semantics match `HttpRequestFrame` — absolute URLs rejected,\n * daemon prepends its `ws://<upstream>` base. Headers forwarded as-is\n * (cookies are typically NOT forwarded since the daemon's upstream is\n * loopback; cookie passthrough is opt-in via daemon config).\n */\nexport interface WsOpenFrame {\n  t: \"ws_open\"\n  /** Correlates every WS frame in both directions for this connection. */\n  reqId: string\n  /** Path + querystring on the daemon-local upstream, e.g.\n   *  `/sessions/abc/pty?cols=80&rows=24`. */\n  path: string\n  /** Headers to set on the upstream WS request. Hop-by-hop headers\n   *  (Connection, Upgrade, Sec-WebSocket-*) MUST be stripped — the\n   *  daemon's `ws` client manages those. */\n  headers?: Readonly<Record<string, string>>\n  /** Subprotocols requested by the browser; forwarded to upstream. */\n  protocols?: readonly string[]\n}\n\n/**\n * DAEMON → HOST. Result of a `ws_open`. On success the upstream WS is\n * connected and frames can flow. On failure `error` is set; no further\n * frames for this `reqId` will arrive.\n */\nexport interface WsOpenAckFrame {\n  t: \"ws_open_ack\"\n  reqId: string\n  /** HTTP status from the upstream upgrade. 101 on success; 4xx/5xx\n   *  when the upstream refused the upgrade. */\n  status: number\n  /** Selected subprotocol, if any. */\n  protocol?: string\n  /** Set when the daemon couldn't open the upstream (DNS failure,\n   *  refused, timeout). Distinct from a clean upstream-side close,\n   *  which arrives as `ws_close`. */\n  error?: Readonly<{\n    code: string\n    message: string\n  }>\n}\n\n/**\n * Either direction. One application-level WS frame's payload. Text\n * frames carry UTF-8 bytes (`binary: false`); binary frames carry\n * arbitrary bytes (`binary: true`). The `data` field is base64-encoded\n * either way so the transport stays JSON.\n */\nexport interface WsMessageFrame {\n  t: \"ws_message\"\n  reqId: string\n  /** Base64-encoded WS frame payload. */\n  data: string\n  /** True for binary frames; false (or omitted) for text. */\n  binary?: boolean\n}\n\n/**\n * Either direction. Close the bridged WS connection. Includes the\n * close code (1000 normal, 1006 abnormal, etc.) and optional reason.\n * After sending or receiving this frame, neither side will send\n * further frames for `reqId`.\n */\nexport interface WsCloseFrame {\n  t: \"ws_close\"\n  reqId: string\n  /** WebSocket close code. */\n  code: number\n  reason?: string\n}\n\n// ─── union + guards ─────────────────────────────────────────────\n\nexport type HostToDaemonFrame =\n  | SpawnFrame\n  | StdinFrame\n  | KillFrame\n  | ResizeFrame\n  | HttpRequestFrame\n  | WsOpenFrame\n  | WsMessageFrame\n  | WsCloseFrame\n  | PingFrame\n  | PongFrame\n  | ErrorFrame\n  | ReconnectSoonFrame\n\nexport type DaemonToHostFrame =\n  | HelloFrame\n  | SpawnedFrame\n  | StdoutFrame\n  | StderrFrame\n  | ExitFrame\n  | HttpResponseFrame\n  | HttpResponseHeadFrame\n  | HttpResponseChunkFrame\n  | WsOpenAckFrame\n  | WsMessageFrame\n  | WsCloseFrame\n  | PingFrame\n  | PongFrame\n  | ErrorFrame\n\nexport type TunnelFrame = HostToDaemonFrame | DaemonToHostFrame\n\nconst KNOWN_TYPES = new Set<TunnelFrame[\"t\"]>([\n  \"spawn\",\n  \"stdin\",\n  \"kill\",\n  \"resize\",\n  \"http_request\",\n  \"http_response\",\n  \"http_response_head\",\n  \"http_response_chunk\",\n  \"ws_open\",\n  \"ws_open_ack\",\n  \"ws_message\",\n  \"ws_close\",\n  \"ping\",\n  \"pong\",\n  \"error\",\n  \"hello\",\n  \"spawned\",\n  \"stdout\",\n  \"stderr\",\n  \"exit\",\n  \"reconnect_soon\",\n])\n\n/**\n * Parse a raw WS message into a `TunnelFrame`. Returns null when the\n * payload isn't a valid frame — callers MUST handle null defensively\n * (typically: send an `error` frame and ignore). We don't throw so\n * one bad frame can't tear down the tunnel.\n */\nexport function parseFrame(raw: string): TunnelFrame | null {\n  let parsed: unknown\n  try {\n    parsed = JSON.parse(raw)\n  } catch {\n    return null\n  }\n  if (\n    !parsed ||\n    typeof parsed !== \"object\" ||\n    !(\"t\" in parsed) ||\n    typeof (parsed as { t: unknown }).t !== \"string\"\n  ) {\n    return null\n  }\n  const t = (parsed as { t: string }).t\n  if (!KNOWN_TYPES.has(t as TunnelFrame[\"t\"])) return null\n  return parsed as TunnelFrame\n}\n\nexport function encodeFrame(frame: TunnelFrame): string {\n  return JSON.stringify(frame)\n}\n\n/**\n * Encode raw bytes for an `stdin` / `stdout` / `stderr` frame's `data`\n * field. Centralised so both sides agree on the encoding.\n */\nexport function encodeData(bytes: Uint8Array | string): string {\n  const buf =\n    typeof bytes === \"string\" ? Buffer.from(bytes, \"utf8\") : Buffer.from(bytes)\n  return buf.toString(\"base64\")\n}\n\nexport function decodeData(data: string): Buffer {\n  return Buffer.from(data, \"base64\")\n}\n","/**\n * Tunnel server (daemon side).\n *\n * Sits on the local machine that actually owns the binaries (e.g. the\n * user's laptop running `agentproto serve`). Accepts spawn frames from\n * a remote host, spawns the requested child via node:child_process,\n * pipes stdio back as `stdout`/`stderr` frames, and reports lifecycle\n * via `spawned`/`exit`/`error`.\n *\n * Transport-agnostic: the caller passes a `FrameSink`. For WebSocket\n * callers, see `wrapWebSocket()` in ./ws-adapter.ts.\n *\n * Security: this process MUST refuse spawn requests by default unless\n * the caller installed an `authorize(spawn)` hook. We don't expose a\n * \"trust everything\" mode — every host integration is responsible for\n * deciding what the remote may exec. The hook gets the full SpawnFrame\n * and can mutate it (e.g. force `cwd` into a workspace) or reject.\n */\n\nimport { spawn, type ChildProcess } from \"node:child_process\"\nimport { hostname, platform } from \"node:os\"\nimport {\n  TUNNEL_VERSION,\n  decodeData,\n  encodeData,\n  encodeFrame,\n  parseFrame,\n  type ExitFrame,\n  type HttpRequestFrame,\n  type HttpResponseFrame,\n  type SpawnFrame,\n  type StderrFrame,\n  type StdoutFrame,\n  type TunnelFrame,\n  type WsOpenFrame,\n} from \"./frames.js\"\nimport type { FrameSink } from \"./transport.js\"\n\nexport interface TunnelServerOptions {\n  sink: FrameSink\n  /**\n   * Authorization hook. Called for each `spawn` frame BEFORE the\n   * subprocess is created. Return the (possibly mutated) frame to\n   * proceed; throw or return null to reject. Rejection causes an\n   * `error` frame with code \"spawn_unauthorized\".\n   *\n   * No default — callers MUST decide. Pass `(req) => req` to allow\n   * everything (useful for tests; never for production).\n   */\n  authorize: (req: SpawnFrame) => SpawnFrame | null | Promise<SpawnFrame | null>\n  /**\n   * Upstream HTTP base URL for `http_request` frames. The daemon\n   * appends the frame's `path` and forwards. Typically the local\n   * gateway address — `http://127.0.0.1:18790`. When omitted, the\n   * daemon replies to any `http_request` with\n   * `error: { code: \"http_upstream_not_configured\" }`.\n   */\n  httpUpstream?: string\n  /** User-friendly label sent in the hello frame. */\n  label?: string\n  /**\n   * Whether this daemon advertises PTY support. Set to true only when\n   * `spawnPty` is also provided.\n   */\n  pty?: boolean\n  /**\n   * Factory for PTY-backed processes. When provided (and `pty: true`),\n   * spawn frames with `pty: true` use this instead of node:child_process.\n   * Injected from the CLI layer so the ACP package stays native-free.\n   */\n  spawnPty?: (opts: {\n    command: string\n    args: string[]\n    cwd?: string\n    env?: Record<string, string>\n    cols: number\n    rows: number\n  }) => PtyProcess\n  /**\n   * Optional hook fired once per successful spawn — after authorize\n   * passed and the ChildProcess has emitted its `spawn` event.\n   * Lets the daemon adopt this child into a higher-level registry\n   * (e.g. @agentproto/runtime's sessions registry, AIP-46) so the\n   * spawn shows up in /sessions, the LocalDaemonSessionsCard, and\n   * the CLI TUI alongside spawns originated locally.\n   *\n   * The hook is fire-and-forget — the tunnel doesn't await its\n   * return. Errors from the hook are swallowed so an observer\n   * registry hiccup never breaks the tunnel exchange.\n   */\n  onChildSpawned?: (info: {\n    execId: string\n    child: ChildProcess\n    request: SpawnFrame\n  }) => void\n  /**\n   * Optional hook fired when the host sends a `reconnect_soon` frame —\n   * graceful drain signal during host rollover. The daemon SHOULD\n   * close + reconnect immediately (skipping any backoff) so the new\n   * host replica picks it up. Default: ignore (the host follows up\n   * with `close(1012)` and the daemon's own reconnect supervisor\n   * handles it via normal backoff, ~30 s gap).\n   *\n   * Implementations typically call into their connection supervisor\n   * to mark the next reconnect as \"no-backoff\" then close the sink.\n   * `reasonMs` is the host's hint for how long it will wait before\n   * forcing close — daemons MAY use it to drain in-flight RPCs first.\n   */\n  onReconnectSoon?: (info: { reasonMs?: number }) => void\n  /**\n   * Factory that dials a WS connection to the local upstream. When\n   * provided (and `httpUpstream` is set), the daemon advertises\n   * `wsForward` capability and handles `ws_open` frames by piping the\n   * upstream WS through the tunnel. Injected so `@agentproto/acp`\n   * stays free of a hard `ws` dependency — the CLI provides this\n   * factory using its already-pulled-in `ws` package.\n   */\n  dialUpstreamWs?: (params: {\n    url: string\n    protocols?: readonly string[]\n    headers?: Readonly<Record<string, string>>\n  }) => Promise<UpstreamWebSocket>\n}\n\n/**\n * Minimal upstream WS surface — satisfied by the `ws` library's\n * client socket. Daemons supplying `dialUpstreamWs` resolve into\n * one of these as soon as the WS is OPEN. `protocol` is the\n * subprotocol negotiated by the upstream (empty string when none).\n */\nexport interface UpstreamWebSocket {\n  readonly protocol: string\n  /** Send a frame to the upstream. */\n  send(data: Buffer | string, opts: { binary: boolean }): void\n  /** Close the upstream connection. */\n  close(code?: number, reason?: string): void\n  /** Subscribe to inbound frames. */\n  onMessage(handler: (data: Buffer, isBinary: boolean) => void): void\n  /** Subscribe to upstream close. */\n  onClose(handler: (code: number, reason: string) => void): void\n  /** Subscribe to transport errors. */\n  onError(handler: (err: Error) => void): void\n}\n\n/** Minimal PTY process surface — satisfied by node-pty's IPty. */\nexport interface PtyProcess {\n  readonly pid: number\n  write(data: string): void\n  resize(cols: number, rows: number): void\n  kill(signal?: string): void\n  onData(handler: (data: string) => void): void\n  onExit(handler: (event: { exitCode: number; signal?: number }) => void): void\n}\n\nexport interface TunnelServer {\n  /** Currently-live execId → ChildProcess. Read-only diagnostic. */\n  readonly children: ReadonlyMap<string, ChildProcess>\n  /** Kill all live children and close the sink. */\n  close(): Promise<void>\n}\n\nexport function createTunnelServer(opts: TunnelServerOptions): TunnelServer {\n  const children = new Map<string, ChildProcess>()\n  // PTY-backed processes keyed by execId (separate from pipe-based children).\n  const ptyProcs = new Map<string, PtyProcess>()\n  // Per-reqId map of bridged upstream WS connections. Each entry's\n  // lifecycle starts at ws_open (we send open_ack on success) and ends\n  // at ws_close (either direction). On tunnel teardown we close all.\n  const upstreamWs = new Map<string, UpstreamWebSocket>()\n  let closed = false\n\n  // Greet the host immediately so it can fail fast on version\n  // mismatch before issuing spawns.\n  opts.sink.send({\n    t: \"hello\",\n    version: TUNNEL_VERSION,\n    capabilities: {\n      pty: opts.pty === true,\n      wsForward: opts.dialUpstreamWs !== undefined && !!opts.httpUpstream,\n    },\n    label: opts.label,\n    daemon: {\n      name: \"agentproto\",\n      version: \"0.1.0-alpha\",\n      platform: `${platform()}/${hostname()}`,\n      nodeVersion: process.version,\n    },\n  })\n\n  const offFrame = opts.sink.onFrame((frame) => {\n    handleFrame(frame).catch((err) => {\n      const message = err instanceof Error ? err.message : String(err)\n      opts.sink.send({ t: \"error\", code: \"internal\", message })\n    })\n  })\n\n  const offClose = opts.sink.onClose(() => {\n    closed = true\n    for (const [, child] of children) child.kill(\"SIGTERM\")\n    children.clear()\n    for (const [, pty] of ptyProcs) pty.kill()\n    ptyProcs.clear()\n    for (const [, ws] of upstreamWs) {\n      try {\n        ws.close(1001, \"tunnel_closed\")\n      } catch {\n        /* socket may already be dead */\n      }\n    }\n    upstreamWs.clear()\n    offFrame()\n    offClose()\n  })\n\n  async function handleFrame(frame: TunnelFrame): Promise<void> {\n    switch (frame.t) {\n      case \"spawn\":\n        await handleSpawn(frame)\n        return\n      case \"stdin\": {\n        const pty = ptyProcs.get(frame.execId)\n        if (pty) {\n          pty.write(Buffer.from(frame.data, \"base64\").toString(\"utf8\"))\n          return\n        }\n        const child = children.get(frame.execId)\n        if (!child || !child.stdin) {\n          opts.sink.send({\n            t: \"error\",\n            execId: frame.execId,\n            code: \"unknown_exec\",\n            message: `No live exec '${frame.execId}'`,\n          })\n          return\n        }\n        child.stdin.write(Buffer.from(frame.data, \"base64\"))\n        return\n      }\n      case \"kill\": {\n        const pty = ptyProcs.get(frame.execId)\n        if (pty) {\n          pty.kill(frame.signal ?? \"SIGTERM\")\n          return\n        }\n        const child = children.get(frame.execId)\n        if (!child) {\n          opts.sink.send({\n            t: \"error\",\n            execId: frame.execId,\n            code: \"unknown_exec\",\n            message: `No live exec '${frame.execId}'`,\n          })\n          return\n        }\n        child.kill((frame.signal as NodeJS.Signals | undefined) ?? \"SIGTERM\")\n        return\n      }\n      case \"resize\": {\n        ptyProcs.get(frame.execId)?.resize(frame.cols, frame.rows)\n        return\n      }\n      case \"http_request\":\n        // Fire-and-forget — the handler emits its own http_response\n        // frame (or error). Errors that escape handleHttpRequest\n        // bubble to the outer .catch and become a generic `error`\n        // frame, but the per-request error path inside the handler\n        // produces an http_response with `error:` set, which is what\n        // the host's forwardHttp expects.\n        await handleHttpRequest(frame)\n        return\n      case \"ws_open\":\n        await handleWsOpen(frame)\n        return\n      case \"ws_message\": {\n        const ws = upstreamWs.get(frame.reqId)\n        if (!ws) {\n          // Stale frame for a closed bridge — silently drop. Sending\n          // an error frame would race with our own ws_close on the\n          // teardown path.\n          return\n        }\n        try {\n          ws.send(decodeData(frame.data), { binary: frame.binary === true })\n        } catch (err) {\n          const message = err instanceof Error ? err.message : String(err)\n          opts.sink.send({\n            t: \"ws_close\",\n            reqId: frame.reqId,\n            code: 1011,\n            reason: `send_failed: ${message}`,\n          })\n          try {\n            ws.close(1011, \"send_failed\")\n          } catch {\n            /* defensive */\n          }\n          upstreamWs.delete(frame.reqId)\n        }\n        return\n      }\n      case \"ws_close\": {\n        const ws = upstreamWs.get(frame.reqId)\n        if (!ws) return\n        upstreamWs.delete(frame.reqId)\n        try {\n          ws.close(frame.code, frame.reason)\n        } catch {\n          /* socket may already be dead */\n        }\n        return\n      }\n      case \"ping\":\n        opts.sink.send({ t: \"pong\", nonce: frame.nonce })\n        return\n      case \"reconnect_soon\":\n        // Host is shutting down this replica (e.g. k8s preStop). Fire\n        // the supervisor hook so the daemon CLI can drop the WS +\n        // reconnect without exponential backoff. We do NOT close the\n        // sink here — that's the supervisor's call (it may want to\n        // drain in-flight RPCs first using the `reasonMs` hint).\n        try {\n          opts.onReconnectSoon?.({\n            ...(frame.reasonMs !== undefined ? { reasonMs: frame.reasonMs } : {}),\n          })\n        } catch {\n          /* defensive — supervisor hook must never break the tunnel */\n        }\n        return\n      case \"pong\":\n      case \"error\":\n        // Daemon doesn't act on these; host-side concern.\n        return\n      default:\n        opts.sink.send({\n          t: \"error\",\n          code: \"unknown_frame\",\n          message: `Daemon received unexpected frame type '${(frame as { t: string }).t}'`,\n        })\n    }\n  }\n\n  async function handleSpawn(req: SpawnFrame): Promise<void> {\n    if (closed) return\n    let approved: SpawnFrame | null\n    try {\n      approved = await opts.authorize(req)\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err)\n      opts.sink.send({\n        t: \"error\",\n        execId: req.execId,\n        code: \"spawn_unauthorized\",\n        message,\n      })\n      return\n    }\n    if (!approved) {\n      opts.sink.send({\n        t: \"error\",\n        execId: req.execId,\n        code: \"spawn_unauthorized\",\n        message: \"Authorize hook rejected the spawn request.\",\n      })\n      return\n    }\n\n    // PTY path — use injected spawnPty factory when pty:true is requested.\n    if (approved.pty && opts.spawnPty) {\n      let pty: PtyProcess\n      try {\n        pty = opts.spawnPty({\n          command: approved.command,\n          args: [...approved.args],\n          cwd: approved.cwd,\n          env: approved.env ? { ...approved.env } : undefined,\n          cols: approved.cols ?? 80,\n          rows: approved.rows ?? 24,\n        })\n      } catch (err) {\n        const message = err instanceof Error ? err.message : String(err)\n        opts.sink.send({ t: \"error\", execId: req.execId, code: \"spawn_failed\", message })\n        return\n      }\n\n      ptyProcs.set(req.execId, pty)\n      opts.sink.send({ t: \"spawned\", execId: req.execId, pid: pty.pid })\n\n      pty.onData(data => {\n        opts.sink.send({ t: \"stdout\", execId: req.execId, data: encodeData(data) })\n      })\n      pty.onExit(({ exitCode, signal }) => {\n        opts.sink.send({\n          t: \"exit\",\n          execId: req.execId,\n          code: exitCode,\n          signal: signal != null ? String(signal) : null,\n        })\n        ptyProcs.delete(req.execId)\n      })\n\n      if (opts.onChildSpawned) {\n        try {\n          // PTY processes can't be adopted as ChildProcess — pass a no-op shim\n          // so the hook fires (for session visibility) without crashing.\n          opts.onChildSpawned({\n            execId: req.execId,\n            child: { pid: pty.pid } as unknown as ChildProcess,\n            request: approved,\n          })\n        } catch { /* fire-and-forget */ }\n      }\n      return\n    }\n\n    let child: ChildProcess\n    try {\n      child = spawn(approved.command, [...approved.args], {\n        cwd: approved.cwd,\n        env: { ...process.env, ...(approved.env ?? {}) },\n        stdio: [\"pipe\", \"pipe\", \"pipe\"],\n        // detached:false so SIGINT/SIGTERM on the daemon kills children too.\n      })\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err)\n      opts.sink.send({\n        t: \"error\",\n        execId: req.execId,\n        code: \"spawn_failed\",\n        message,\n      })\n      return\n    }\n\n    children.set(req.execId, child)\n\n    if (typeof child.pid === \"number\") {\n      opts.sink.send({ t: \"spawned\", execId: req.execId, pid: child.pid })\n    } else {\n      // Pid is null when spawn synchronously failed. The 'error'\n      // event below will fire with the real cause; we still report\n      // a placeholder spawned to keep the lifecycle predictable.\n      opts.sink.send({ t: \"spawned\", execId: req.execId, pid: -1 })\n    }\n\n    // Notify the higher-level registry (when wired) — this is what\n    // makes tunnel-driven spawns visible in the daemon's\n    // /sessions list alongside spawns originated locally. Errors\n    // from the observer never break the tunnel.\n    if (opts.onChildSpawned) {\n      try {\n        opts.onChildSpawned({ execId: req.execId, child, request: approved })\n      } catch (err) {\n        // Hook is fire-and-forget — log + continue.\n        // Use console.warn directly because tunnel server has no\n        // logger context.\n        console.warn(\n          `[tunnel-server] onChildSpawned hook threw for execId=${req.execId}: ${\n            err instanceof Error ? err.message : String(err)\n          }`\n        )\n      }\n    }\n\n    child.stdout?.on(\"data\", (chunk: Buffer) => {\n      const f: StdoutFrame = {\n        t: \"stdout\",\n        execId: req.execId,\n        data: encodeData(chunk),\n      }\n      opts.sink.send(f)\n    })\n    child.stderr?.on(\"data\", (chunk: Buffer) => {\n      const f: StderrFrame = {\n        t: \"stderr\",\n        execId: req.execId,\n        data: encodeData(chunk),\n      }\n      opts.sink.send(f)\n    })\n\n    child.on(\"error\", (err) => {\n      opts.sink.send({\n        t: \"error\",\n        execId: req.execId,\n        code: \"child_error\",\n        message: err.message,\n      })\n    })\n\n    child.on(\"exit\", (code, signal) => {\n      const f: ExitFrame = {\n        t: \"exit\",\n        execId: req.execId,\n        code,\n        signal,\n      }\n      opts.sink.send(f)\n      children.delete(req.execId)\n    })\n  }\n\n  /**\n   * Open a bridged WS connection to the local upstream. Same path-\n   * safety rules as `handleHttpRequest` (no absolute URLs, no `..`),\n   * same hop-by-hop header stripping. The `dialUpstreamWs` factory\n   * resolves to an `UpstreamWebSocket` once the upgrade is OPEN — we\n   * then emit `ws_open_ack` to the host and start piping frames.\n   */\n  async function handleWsOpen(req: WsOpenFrame): Promise<void> {\n    if (closed) return\n    const reject = (\n      status: number,\n      code: string,\n      message: string\n    ): void => {\n      opts.sink.send({\n        t: \"ws_open_ack\",\n        reqId: req.reqId,\n        status,\n        error: { code, message },\n      })\n    }\n    if (!opts.dialUpstreamWs || !opts.httpUpstream) {\n      reject(\n        502,\n        \"ws_upstream_not_configured\",\n        \"Daemon does not support WS forwarding — start with `--upstream ws://…` (or upgrade).\"\n      )\n      return\n    }\n    if (\n      !req.path.startsWith(\"/\") ||\n      req.path.startsWith(\"//\") ||\n      req.path.includes(\"..\")\n    ) {\n      reject(\n        400,\n        \"invalid_path\",\n        `Daemon WS forward requires a safe relative path; got '${req.path}'.`\n      )\n      return\n    }\n    const HOP_BY_HOP = new Set([\n      \"connection\",\n      \"upgrade\",\n      \"sec-websocket-version\",\n      \"sec-websocket-key\",\n      \"sec-websocket-extensions\",\n      \"sec-websocket-protocol\",\n      \"host\",\n      \"content-length\",\n    ])\n    const headers: Record<string, string> = {}\n    for (const [k, v] of Object.entries(req.headers ?? {})) {\n      if (HOP_BY_HOP.has(k.toLowerCase())) continue\n      headers[k] = v\n    }\n    // Map the http upstream base to a ws scheme. The daemon's upstream\n    // is conventionally http://127.0.0.1:<port>; the same host accepts\n    // WS upgrades on the same port, so ws://… works.\n    const base = opts.httpUpstream.replace(/^http(s?):\\/\\//, \"ws$1://\")\n    const url = `${base.replace(/\\/$/, \"\")}${req.path}`\n    let upstream: UpstreamWebSocket\n    try {\n      upstream = await opts.dialUpstreamWs({\n        url,\n        ...(req.protocols && req.protocols.length > 0\n          ? { protocols: req.protocols }\n          : {}),\n        headers,\n      })\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err)\n      // Try to extract an HTTP status from a `ws` error like\n      // `Unexpected server response: 404`.\n      const m = message.match(/Unexpected server response: (\\d+)/)\n      const status = m ? Number.parseInt(m[1]!, 10) : 502\n      reject(status, \"upstream_ws_failed\", message)\n      return\n    }\n    // Race: caller already abandoned us (tunnel closed mid-upgrade).\n    if (closed) {\n      try {\n        upstream.close(1001, \"tunnel_closed\")\n      } catch {\n        /* defensive */\n      }\n      return\n    }\n    upstreamWs.set(req.reqId, upstream)\n    opts.sink.send({\n      t: \"ws_open_ack\",\n      reqId: req.reqId,\n      status: 101,\n      ...(upstream.protocol ? { protocol: upstream.protocol } : {}),\n    })\n\n    upstream.onMessage((data, isBinary) => {\n      if (!opts.sink.isOpen) return\n      opts.sink.send({\n        t: \"ws_message\",\n        reqId: req.reqId,\n        data: encodeData(data),\n        binary: isBinary,\n      })\n    })\n    upstream.onClose((code, reason) => {\n      if (!upstreamWs.has(req.reqId)) return\n      upstreamWs.delete(req.reqId)\n      if (opts.sink.isOpen) {\n        opts.sink.send({\n          t: \"ws_close\",\n          reqId: req.reqId,\n          code,\n          ...(reason ? { reason } : {}),\n        })\n      }\n    })\n    upstream.onError(err => {\n      // Errors typically precede a close; emit a stable error code in\n      // the close frame so the host can distinguish from clean close.\n      if (!upstreamWs.has(req.reqId)) return\n      upstreamWs.delete(req.reqId)\n      if (opts.sink.isOpen) {\n        opts.sink.send({\n          t: \"ws_close\",\n          reqId: req.reqId,\n          code: 1011,\n          reason: `upstream_error: ${err.message}`,\n        })\n      }\n      try {\n        upstream.close(1011, \"upstream_error\")\n      } catch {\n        /* defensive */\n      }\n    })\n  }\n\n  async function handleHttpRequest(req: HttpRequestFrame): Promise<void> {\n    if (closed) return\n    const respond = (\n      partial:\n        | { status: number; headers?: HttpResponseFrame[\"headers\"]; body?: string }\n        | { error: HttpResponseFrame[\"error\"]; status: number }\n    ): void => {\n      opts.sink.send({\n        t: \"http_response\",\n        reqId: req.reqId,\n        ...partial,\n      } as HttpResponseFrame)\n    }\n\n    // Reject if no upstream is configured. Better explicit error\n    // than a confusing 502 from a missing fetch target.\n    if (!opts.httpUpstream) {\n      respond({\n        status: 502,\n        error: {\n          code: \"http_upstream_not_configured\",\n          message:\n            \"Daemon was not started with an http upstream — cannot forward HTTP frames.\",\n        },\n      })\n      return\n    }\n\n    // Path-only is required to keep the daemon from being a generic\n    // SSRF amplifier. Absolute URLs (including protocol-relative `//`)\n    // and parent-traversal are rejected. Querystrings are fine.\n    if (\n      !req.path.startsWith(\"/\") ||\n      req.path.startsWith(\"//\") ||\n      req.path.includes(\"..\")\n    ) {\n      respond({\n        status: 400,\n        error: {\n          code: \"invalid_path\",\n          message: `Daemon http forward requires a safe relative path; got '${req.path}'.`,\n        },\n      })\n      return\n    }\n\n    // Strip hop-by-hop headers defensively before forwarding —\n    // they're meaningful only to the previous transport hop.\n    const HOP_BY_HOP = new Set([\n      \"connection\",\n      \"keep-alive\",\n      \"transfer-encoding\",\n      \"upgrade\",\n      \"proxy-authenticate\",\n      \"proxy-authorization\",\n      \"te\",\n      \"trailer\",\n      \"host\", // upstream sets its own based on the URL\n      \"content-length\", // fetch recomputes\n    ])\n    const headers: Record<string, string> = {}\n    for (const [k, v] of Object.entries(req.headers ?? {})) {\n      if (HOP_BY_HOP.has(k.toLowerCase())) continue\n      headers[k] = v\n    }\n\n    const url = `${opts.httpUpstream.replace(/\\/$/, \"\")}${req.path}`\n    const controller = new AbortController()\n    const timeoutMs = req.timeoutMs ?? 30_000\n    // For streaming responses (SSE / long-poll), the daemon-side\n    // request must NOT abort on the regular timeout — the stream is\n    // *meant* to be long-lived. We arm the timer initially, then\n    // disarm it as soon as we detect a streaming response so the\n    // stream can run indefinitely (the host enforces its own teardown\n    // via tunnel close / explicit cancel).\n    let timer: ReturnType<typeof setTimeout> | null = setTimeout(\n      () => controller.abort(),\n      timeoutMs\n    )\n    const clearTimer = () => {\n      if (timer) {\n        clearTimeout(timer)\n        timer = null\n      }\n    }\n    try {\n      const upstreamRes = await fetch(url, {\n        method: req.method,\n        headers,\n        body:\n          req.body === undefined ? undefined : decodeData(req.body),\n        signal: controller.signal,\n        // node fetch follows redirects by default — fine for MCP, the\n        // upstream gateway doesn't redirect anyway.\n      })\n      const outHeaders: Record<string, string> = {}\n      upstreamRes.headers.forEach((value, key) => {\n        if (HOP_BY_HOP.has(key.toLowerCase())) return\n        outHeaders[key] = value\n      })\n\n      // Streaming detection — SSE responses MUST go through the\n      // chunked-frame protocol so the host can pipe bytes to the\n      // browser in real time. Anything else stays on the buffered\n      // path for now (small JSON responses are simpler that way; we\n      // can widen streaming to all responses later once it's proven).\n      const contentType = (outHeaders[\"content-type\"] ?? \"\").toLowerCase()\n      const isStream =\n        contentType.startsWith(\"text/event-stream\") ||\n        contentType.includes(\"application/x-ndjson\")\n\n      if (isStream && upstreamRes.body) {\n        // Disarm the request-level timeout — SSE streams are\n        // long-lived by design. The host closing the tunnel (or the\n        // upstream closing its end) is what terminates us now.\n        clearTimer()\n        opts.sink.send({\n          t: \"http_response_head\",\n          reqId: req.reqId,\n          status: upstreamRes.status,\n          headers: outHeaders,\n        })\n        const reader = upstreamRes.body.getReader()\n        try {\n          while (true) {\n            const { value, done } = await reader.read()\n            if (done) {\n              opts.sink.send({\n                t: \"http_response_chunk\",\n                reqId: req.reqId,\n                end: true,\n              })\n              return\n            }\n            if (value && value.byteLength > 0) {\n              opts.sink.send({\n                t: \"http_response_chunk\",\n                reqId: req.reqId,\n                data: encodeData(Buffer.from(value)),\n              })\n            }\n            // Stop streaming if the tunnel sink closed under us — no\n            // point feeding chunks into the void.\n            if (!opts.sink.isOpen) {\n              try {\n                await reader.cancel()\n              } catch {\n                /* ignore */\n              }\n              return\n            }\n          }\n        } catch (err) {\n          const message = err instanceof Error ? err.message : String(err)\n          opts.sink.send({\n            t: \"http_response_chunk\",\n            reqId: req.reqId,\n            end: true,\n            error: { code: \"upstream_stream_failed\", message },\n          })\n        }\n        return\n      }\n\n      // Buffered path (unchanged): small responses + non-SSE traffic.\n      const buf = Buffer.from(await upstreamRes.arrayBuffer())\n      respond({\n        status: upstreamRes.status,\n        headers: outHeaders,\n        body: buf.length > 0 ? encodeData(buf) : \"\",\n      })\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err)\n      const aborted = err instanceof Error && err.name === \"AbortError\"\n      respond({\n        status: aborted ? 504 : 502,\n        error: {\n          code: aborted ? \"timeout\" : \"upstream_fetch_failed\",\n          message,\n        },\n      })\n    } finally {\n      clearTimer()\n    }\n  }\n\n  return {\n    children,\n    async close() {\n      if (closed) return\n      closed = true\n      for (const [, child] of children) child.kill(\"SIGTERM\")\n      children.clear()\n      opts.sink.close(\"server.close\")\n    },\n  }\n}\n\n// Re-exports for convenience — server-only callers don't need to\n// reach into ./frames for these.\nexport { encodeFrame, parseFrame }\n","/**\n * Tunnel client (host side).\n *\n * Sits on the orchestrator (e.g. Guilde API). Speaks to a remote daemon\n * over a `FrameSink`. Exposes `spawn(command, args, opts)` that returns\n * an object shaped like Node's `ChildProcess` — same `.stdin` /\n * `.stdout` / `.stderr` / `.on('exit')` / `.kill()` surface. This lets\n * the existing ACP protocol arm drive remote subprocesses with zero\n * code changes; the arm thinks it's talking to a local child.\n *\n * The duck is intentionally minimal — only the methods the ACP arm\n * actually calls. If you need the full ChildProcess interface, wrap\n * this with a node:stream.Readable shim.\n */\n\nimport { EventEmitter } from \"node:events\"\nimport { Readable, Writable } from \"node:stream\"\nimport { randomUUID } from \"node:crypto\"\nimport {\n  TUNNEL_VERSION,\n  decodeData,\n  encodeData,\n  type ExitFrame,\n  type HelloFrame,\n  type HttpRequestFrame,\n  type HttpResponseFrame,\n  type SpawnFrame,\n  type SpawnedFrame,\n  type StderrFrame,\n  type StdoutFrame,\n  type TunnelFrame,\n  type WsOpenFrame,\n} from \"./frames.js\"\nimport type { FrameSink } from \"./transport.js\"\n\n/** Resolved response from `forwardHttp`. Mirrors `HttpResponseFrame`\n *  but with the body decoded back to a Buffer for the caller. */\nexport interface TunnelHttpResponse {\n  status: number\n  headers: Readonly<Record<string, string>>\n  body: Buffer\n  /** Set when the daemon failed to complete the upstream call. */\n  error?: Readonly<{\n    code: string\n    message: string\n  }>\n}\n\n/** Resolved response from `forwardHttpStream`. Body is a Web\n *  `ReadableStream<Uint8Array>` — consume it to receive chunks as\n *  they arrive from the daemon's upstream (SSE, long-poll, NDJSON).\n *  The stream closes when the daemon's upstream closes OR an upstream\n *  error occurs (surfaced as a stream error on the reader). */\nexport interface TunnelHttpStreamResponse {\n  status: number\n  headers: Readonly<Record<string, string>>\n  body: ReadableStream<Uint8Array>\n}\n\nexport interface TunnelHttpRequest {\n  method: string\n  path: string\n  headers?: Readonly<Record<string, string>>\n  body?: Buffer | Uint8Array | string\n  /** Per-request timeout in ms. Default 30_000. */\n  timeoutMs?: number\n}\n\nexport interface TunnelWebSocketOpenRequest {\n  /** Path + querystring on the daemon-local upstream. Daemon prepends\n   *  its `ws://<upstream>` base; absolute URLs are rejected. */\n  path: string\n  /** Headers forwarded to the upstream upgrade. Hop-by-hop / Sec-* are\n   *  stripped by the daemon. Cookies are NOT forwarded unless the\n   *  daemon was started with `--upstream-cookies`. */\n  headers?: Readonly<Record<string, string>>\n  /** Subprotocols requested. Echoed in `protocol` on success. */\n  protocols?: readonly string[]\n  /** How long to wait for the upstream upgrade before erroring. The\n   *  message stream itself has no timeout (WS lives as long as either\n   *  end keeps it open). Default 30_000. */\n  openTimeoutMs?: number\n}\n\n/**\n * Bridged WS connection. Mirrors the surface of a browser WebSocket\n * minus URL/protocol bookkeeping — the host already chose those when\n * calling `forwardWebSocket`. Messages are typed as text (UTF-8 string)\n * or binary (Uint8Array); the bridge preserves the upstream's framing.\n */\nexport interface TunnelWebSocket {\n  /** True until `close` runs in either direction. */\n  readonly readyState: \"open\" | \"closing\" | \"closed\"\n  /** Selected subprotocol from the upstream's upgrade response, if any. */\n  readonly protocol: string | null\n  /** Send a frame to the daemon's upstream. No-op when not open. */\n  send(data: string | Uint8Array): void\n  /** Initiate a clean close. Idempotent. */\n  close(code?: number, reason?: string): void\n  /** Subscribe to inbound frames. Returns an unsubscribe fn. */\n  onMessage(\n    listener: (data: Buffer, isBinary: boolean) => void\n  ): () => void\n  /** Subscribe to close. Fires exactly once (after either side closes\n   *  OR the tunnel itself drops). Returns an unsubscribe fn. */\n  onClose(listener: (code: number, reason: string) => void): () => void\n  /** Subscribe to transport-level errors. Closes follow shortly. */\n  onError(listener: (err: Error) => void): () => void\n}\n\nexport interface TunnelClientOptions {\n  sink: FrameSink\n  /**\n   * Reject the `spawn` call if the daemon hasn't sent its `hello`\n   * within this window. Defaults to 10s — generous for high-latency\n   * tunnels but fast enough that misconfigured daemons fail loudly.\n   */\n  helloTimeoutMs?: number\n}\n\nexport interface TunnelSpawnOptions {\n  cwd?: string\n  env?: Readonly<Record<string, string>>\n  /** Allocate a PTY on the daemon. Requires `hello.capabilities.pty`. */\n  pty?: boolean\n  /** Initial PTY column width (ignored when `pty` is false). Default 80. */\n  cols?: number\n  /** Initial PTY row height (ignored when `pty` is false). Default 24. */\n  rows?: number\n}\n\n/**\n * Minimal ChildProcess-shaped duck. Covers the surface our ACP arm\n * calls; expand only when a real consumer needs more.\n */\nexport interface TunnelChildProcess {\n  readonly execId: string\n  readonly pid: number | null\n  readonly stdin: Writable\n  readonly stdout: Readable\n  readonly stderr: Readable\n  /** \"exit\" → (code, signal). \"error\" → (Error). */\n  on(event: \"exit\", listener: (code: number | null, signal: string | null) => void): this\n  on(event: \"error\", listener: (err: Error) => void): this\n  kill(signal?: NodeJS.Signals | number): boolean\n  /** Send a terminal resize to the daemon. No-op if the exec isn't PTY-backed. */\n  resize(cols: number, rows: number): void\n}\n\nexport interface TunnelClient {\n  /**\n   * Resolves once the daemon has sent its `hello` frame, OR rejects\n   * with a tunnel-level error. Subsequent calls return the cached\n   * promise.\n   */\n  ready(): Promise<HelloFrame>\n  spawn(\n    command: string,\n    args: readonly string[],\n    opts?: TunnelSpawnOptions\n  ): Promise<TunnelChildProcess>\n  /**\n   * Forward an HTTP request through the tunnel to the daemon's\n   * configured upstream (typically `http://127.0.0.1:<port>`). The\n   * daemon completes the upstream call and replies with the response,\n   * which this promise resolves to. Rejects on tunnel-transport\n   * failure; the daemon-reported HTTP status (incl. 5xx) is returned\n   * in the resolved value.\n   *\n   * Streaming responses (text/event-stream, NDJSON) are buffered into\n   * the returned Buffer. For real streaming, use `forwardHttpStream`.\n   */\n  forwardHttp(req: TunnelHttpRequest): Promise<TunnelHttpResponse>\n  /**\n   * Stream an HTTP response through the tunnel. The promise resolves\n   * as soon as the response head (status + headers) arrives — the\n   * body chunks then flow through `body` (a ReadableStream) until the\n   * daemon's upstream closes. Required for SSE / NDJSON / long-poll\n   * upstreams where buffering until the end would defeat the point.\n   * For one-shot HTTP, prefer `forwardHttp`.\n   */\n  forwardHttpStream(req: TunnelHttpRequest): Promise<TunnelHttpStreamResponse>\n  /**\n   * Open a bridged WebSocket through the tunnel. The promise resolves\n   * once the daemon has completed the upstream upgrade; from that\n   * point messages flow via the returned `TunnelWebSocket`.\n   *\n   * Rejects on:\n   *   - missing `hello.capabilities.wsForward` — older daemon, no bridge\n   *   - upstream upgrade failure (4xx/5xx) — `cause` carries the status\n   *   - timeout waiting for `ws_open_ack`\n   */\n  forwardWebSocket(req: TunnelWebSocketOpenRequest): Promise<TunnelWebSocket>\n  close(): Promise<void>\n}\n\nexport function createTunnelClient(opts: TunnelClientOptions): TunnelClient {\n  const helloTimeoutMs = opts.helloTimeoutMs ?? 10_000\n  let hello: HelloFrame | null = null\n  let helloPromise: Promise<HelloFrame> | null = null\n\n  // Per-execId routing tables. We dispatch incoming frames to the\n  // right child duck by execId; spawn awaits its own `spawned` /\n  // `error` reply via these one-shot resolvers.\n  const childByExec = new Map<string, TunnelChildDuck>()\n  const spawnPending = new Map<\n    string,\n    { resolve: (frame: SpawnedFrame) => void; reject: (err: Error) => void }\n  >()\n\n  // Inflight HTTP forwards keyed by reqId. Each entry's mode depends\n  // on which API the caller used:\n  //   - \"buffered\": forwardHttp(). Resolves once the full body has\n  //     arrived (either as a single `http_response` frame, OR as\n  //     `http_response_head` + chunks that get concatenated here).\n  //   - \"stream\": forwardHttpStream(). Resolves on `http_response_head`\n  //     with a ReadableStream that's fed by subsequent chunk frames.\n  //     For backward-compat with daemons that emit a single\n  //     `http_response`, we synthesize a one-chunk stream + end.\n  // Either mode handles either server response shape — the daemon's\n  // streaming decision is purely server-side (Content-Type based), and\n  // the client adapts.\n  type HttpPending =\n    | {\n        mode: \"buffered\"\n        resolve: (resp: TunnelHttpResponse) => void\n        reject: (err: Error) => void\n        timer: ReturnType<typeof setTimeout>\n        // Set when daemon starts a chunked response.\n        streamHead: {\n          status: number\n          headers: Record<string, string>\n        } | null\n        streamChunks: Buffer[]\n      }\n    | {\n        mode: \"stream\"\n        resolveHead: (resp: TunnelHttpStreamResponse) => void\n        reject: (err: Error) => void\n        timer: ReturnType<typeof setTimeout>\n        // Set once the head arrives — drains pendingChunks into it.\n        controller: ReadableStreamDefaultController<Uint8Array> | null\n        pendingChunks: Buffer[]\n        headEmitted: boolean\n        // Goes true after `end: true` so a late close-of-tunnel doesn't\n        // try to error a closed controller.\n        ended: boolean\n      }\n  const httpPending = new Map<string, HttpPending>()\n\n  // Per-reqId routing for bridged WS connections. Lifecycle:\n  //   1. forwardWebSocket() inserts a `wsOpenPending` entry + sends ws_open\n  //   2. Daemon emits ws_open_ack → we resolve the open promise into a\n  //      TunnelWebSocketDuck, move it to `wsByReq`, drop the pending entry\n  //   3. Bidirectional ws_message frames route to the duck\n  //   4. ws_close in either direction tears the duck down + drops from the map\n  //   5. Tunnel close errors all open WSes with code 1006\n  type WsPending = {\n    resolve: (ws: TunnelWebSocket) => void\n    reject: (err: Error) => void\n    timer: ReturnType<typeof setTimeout>\n  }\n  const wsOpenPending = new Map<string, WsPending>()\n  const wsByReq = new Map<string, TunnelWebSocketDuck>()\n\n  const offFrame = opts.sink.onFrame((frame) => routeIncoming(frame))\n  const offClose = opts.sink.onClose(() => {\n    for (const [, duck] of childByExec) duck.__handleSinkClosed()\n    childByExec.clear()\n    for (const [, p] of spawnPending) {\n      p.reject(new Error(\"Tunnel closed before spawn completed.\"))\n    }\n    spawnPending.clear()\n    for (const [, p] of httpPending) {\n      clearTimeout(p.timer)\n      if (p.mode === \"buffered\") {\n        p.reject(new Error(\"Tunnel closed before HTTP response arrived.\"))\n      } else {\n        // For an active stream, error the controller so the consumer's\n        // reader.read() rejects instead of hanging forever. If the head\n        // hasn't been emitted yet, reject the head promise too.\n        if (!p.headEmitted) {\n          p.reject(new Error(\"Tunnel closed before HTTP response head arrived.\"))\n        } else if (p.controller && !p.ended) {\n          try {\n            p.controller.error(new Error(\"Tunnel closed mid-stream.\"))\n          } catch {\n            /* already closed */\n          }\n        }\n      }\n    }\n    httpPending.clear()\n    for (const [, p] of wsOpenPending) {\n      clearTimeout(p.timer)\n      p.reject(new Error(\"Tunnel closed before WS upgrade completed.\"))\n    }\n    wsOpenPending.clear()\n    for (const [, duck] of wsByReq) {\n      duck.__handleSinkClosed()\n    }\n    wsByReq.clear()\n    offFrame()\n    offClose()\n  })\n\n  function routeIncoming(frame: TunnelFrame): void {\n    switch (frame.t) {\n      case \"hello\":\n        if (frame.version !== TUNNEL_VERSION) {\n          // Mismatch — surface via the ready() rejection. We don't\n          // tear down the sink because the caller may want to\n          // negotiate a fallback.\n          throw new Error(\n            `Tunnel daemon speaks ${frame.version}; this client speaks ${TUNNEL_VERSION}.`\n          )\n        }\n        hello = frame\n        return\n      case \"spawned\": {\n        const pending = spawnPending.get(frame.execId)\n        if (pending) {\n          spawnPending.delete(frame.execId)\n          pending.resolve(frame)\n        }\n        return\n      }\n      case \"stdout\": {\n        const duck = childByExec.get(frame.execId)\n        duck?.__pushStdout(decodeData((frame as StdoutFrame).data))\n        return\n      }\n      case \"stderr\": {\n        const duck = childByExec.get(frame.execId)\n        duck?.__pushStderr(decodeData((frame as StderrFrame).data))\n        return\n      }\n      case \"exit\": {\n        const duck = childByExec.get(frame.execId)\n        duck?.__handleExit(frame as ExitFrame)\n        childByExec.delete(frame.execId)\n        return\n      }\n      case \"error\": {\n        if (frame.execId) {\n          const pending = spawnPending.get(frame.execId)\n          if (pending) {\n            spawnPending.delete(frame.execId)\n            pending.reject(new Error(`${frame.code}: ${frame.message}`))\n            return\n          }\n          const duck = childByExec.get(frame.execId)\n          duck?.__pushError(new Error(`${frame.code}: ${frame.message}`))\n          return\n        }\n        // Tunnel-level error: nowhere to surface it cleanly here.\n        // Callers that care should wrap the FrameSink and observe\n        // tunnel-error frames themselves.\n        return\n      }\n      case \"http_response\": {\n        // Buffered response from the daemon — single-frame body.\n        const pending = httpPending.get(frame.reqId)\n        if (!pending) return\n        httpPending.delete(frame.reqId)\n        clearTimeout(pending.timer)\n        const body = frame.body ? decodeData(frame.body) : Buffer.alloc(0)\n        if (pending.mode === \"buffered\") {\n          pending.resolve({\n            status: frame.status,\n            headers: frame.headers ?? {},\n            body,\n            ...(frame.error ? { error: frame.error } : {}),\n          })\n        } else {\n          // Caller asked for a stream but the daemon decided to send\n          // a single buffered response. Synthesize a one-chunk stream\n          // so the same consumer code path works.\n          const stream = new ReadableStream<Uint8Array>({\n            start(controller) {\n              if (body.length > 0) controller.enqueue(new Uint8Array(body))\n              controller.close()\n            },\n          })\n          pending.resolveHead({\n            status: frame.status,\n            headers: frame.headers ?? {},\n            body: stream,\n          })\n        }\n        return\n      }\n      case \"http_response_head\": {\n        const pending = httpPending.get(frame.reqId)\n        if (!pending) return\n        const headers = frame.headers ?? {}\n        if (pending.mode === \"stream\") {\n          // Wire a ReadableStream whose controller drains any chunks\n          // we've buffered while waiting for the head frame (rare —\n          // chunks shouldn't precede the head — but harmless).\n          const stream = new ReadableStream<Uint8Array>({\n            start(controller) {\n              pending.controller = controller\n              for (const chunk of pending.pendingChunks) {\n                if (chunk.length > 0) controller.enqueue(new Uint8Array(chunk))\n              }\n              pending.pendingChunks = []\n            },\n            cancel: () => {\n              // Consumer abandoned the stream — clean up the pending\n              // entry. We don't send a cancel frame to the daemon\n              // (the protocol doesn't define one), so the daemon will\n              // keep streaming until its upstream closes; we simply\n              // drop frames we still receive.\n              if (httpPending.get(frame.reqId) === pending) {\n                clearTimeout(pending.timer)\n                httpPending.delete(frame.reqId)\n              }\n            },\n          })\n          pending.headEmitted = true\n          // Stream is long-lived — disarm the buffered-mode timeout\n          // (it was a safety net for a stuck buffered response).\n          clearTimeout(pending.timer)\n          pending.resolveHead({\n            status: frame.status,\n            headers,\n            body: stream,\n          })\n        } else {\n          // Buffered caller, streaming server — start accumulating\n          // chunks; we'll resolve once `end: true` arrives.\n          pending.streamHead = { status: frame.status, headers }\n        }\n        return\n      }\n      case \"http_response_chunk\": {\n        const pending = httpPending.get(frame.reqId)\n        if (!pending) return\n        const data = frame.data ? decodeData(frame.data) : Buffer.alloc(0)\n        if (pending.mode === \"stream\") {\n          if (frame.error) {\n            // Upstream error mid-stream — surface it on the reader.\n            try {\n              pending.controller?.error(\n                new Error(`${frame.error.code}: ${frame.error.message}`)\n              )\n            } catch {\n              /* already closed */\n            }\n            pending.ended = true\n            clearTimeout(pending.timer)\n            httpPending.delete(frame.reqId)\n            return\n          }\n          if (pending.controller) {\n            if (data.length > 0) {\n              try {\n                pending.controller.enqueue(new Uint8Array(data))\n              } catch {\n                /* reader detached — drop */\n              }\n            }\n            if (frame.end) {\n              try {\n                pending.controller.close()\n              } catch {\n                /* already closed */\n              }\n              pending.ended = true\n              clearTimeout(pending.timer)\n              httpPending.delete(frame.reqId)\n            }\n          } else {\n            // Head hasn't been processed yet — buffer until it is.\n            if (data.length > 0) pending.pendingChunks.push(data)\n            if (frame.end) {\n              // Race: chunk-end before head. Defer closing until head\n              // creates the controller.\n              pending.ended = true\n            }\n          }\n        } else {\n          // Buffered mode — accumulate chunks; resolve on end.\n          if (data.length > 0) pending.streamChunks.push(data)\n          if (frame.error) {\n            clearTimeout(pending.timer)\n            httpPending.delete(frame.reqId)\n            const concatenated = Buffer.concat(pending.streamChunks)\n            pending.resolve({\n              status: pending.streamHead?.status ?? 502,\n              headers: pending.streamHead?.headers ?? {},\n              body: concatenated,\n              error: frame.error,\n            })\n            return\n          }\n          if (frame.end) {\n            clearTimeout(pending.timer)\n            httpPending.delete(frame.reqId)\n            const concatenated = Buffer.concat(pending.streamChunks)\n            pending.resolve({\n              status: pending.streamHead?.status ?? 200,\n              headers: pending.streamHead?.headers ?? {},\n              body: concatenated,\n            })\n          }\n        }\n        return\n      }\n      case \"ws_open_ack\": {\n        const pending = wsOpenPending.get(frame.reqId)\n        if (!pending) return\n        wsOpenPending.delete(frame.reqId)\n        clearTimeout(pending.timer)\n        if (frame.error || frame.status !== 101) {\n          const code = frame.error?.code ?? `http_${frame.status}`\n          const msg =\n            frame.error?.message ??\n            `Upstream WS upgrade returned ${frame.status}`\n          pending.reject(new Error(`${code}: ${msg}`))\n          return\n        }\n        const duck = new TunnelWebSocketDuck(\n          frame.reqId,\n          frame.protocol ?? null,\n          opts.sink,\n          () => wsByReq.delete(frame.reqId)\n        )\n        wsByReq.set(frame.reqId, duck)\n        pending.resolve(duck)\n        return\n      }\n      case \"ws_message\": {\n        const duck = wsByReq.get(frame.reqId)\n        if (!duck) return // stale frame after close — drop\n        duck.__handleMessage(decodeData(frame.data), frame.binary === true)\n        return\n      }\n      case \"ws_close\": {\n        // Resolve a pending open if the daemon closes before acking\n        // (e.g. upstream refused mid-upgrade and emitted close).\n        const pending = wsOpenPending.get(frame.reqId)\n        if (pending) {\n          wsOpenPending.delete(frame.reqId)\n          clearTimeout(pending.timer)\n          pending.reject(\n            new Error(\n              `WS closed before upgrade (code ${frame.code}${frame.reason ? `: ${frame.reason}` : \"\"})`\n            )\n          )\n          return\n        }\n        const duck = wsByReq.get(frame.reqId)\n        if (duck) {\n          wsByReq.delete(frame.reqId)\n          duck.__handleClose(frame.code, frame.reason ?? \"\")\n        }\n        return\n      }\n      case \"ping\":\n        opts.sink.send({ t: \"pong\", nonce: frame.nonce })\n        return\n      case \"pong\":\n      case \"spawn\":\n      case \"stdin\":\n      case \"kill\":\n      case \"resize\":\n      case \"http_request\":\n      case \"ws_open\":\n        // Not expected on the host side; ignore.\n        return\n    }\n  }\n\n  return {\n    ready() {\n      if (hello) return Promise.resolve(hello)\n      if (helloPromise) return helloPromise\n      helloPromise = new Promise<HelloFrame>((resolve, reject) => {\n        const timer = setTimeout(() => {\n          reject(\n            new Error(\n              `Tunnel daemon did not send hello within ${helloTimeoutMs}ms.`\n            )\n          )\n        }, helloTimeoutMs)\n        // Rebind sink listener so we resolve on the next hello.\n        const off = opts.sink.onFrame((frame) => {\n          if (frame.t !== \"hello\") return\n          clearTimeout(timer)\n          off()\n          if (frame.version !== TUNNEL_VERSION) {\n            reject(\n              new Error(\n                `Tunnel daemon speaks ${frame.version}; client speaks ${TUNNEL_VERSION}.`\n              )\n            )\n            return\n          }\n          hello = frame\n          resolve(frame)\n        })\n      })\n      return helloPromise\n    },\n\n    async spawn(command, args, spawnOpts) {\n      if (!hello) await this.ready()\n      if (spawnOpts?.pty && hello?.capabilities.pty !== true) {\n        throw new Error(\n          `Tunnel daemon '${hello?.label ?? \"(unnamed)\"}' does not advertise PTY support.`\n        )\n      }\n      const execId = randomUUID()\n      const req: SpawnFrame = {\n        t: \"spawn\",\n        execId,\n        command,\n        args,\n        cwd: spawnOpts?.cwd,\n        env: spawnOpts?.env,\n        pty: spawnOpts?.pty,\n        ...(spawnOpts?.pty ? { cols: spawnOpts.cols ?? 80, rows: spawnOpts.rows ?? 24 } : {}),\n      }\n      const spawnedFrame = await new Promise<SpawnedFrame>(\n        (resolve, reject) => {\n          spawnPending.set(execId, { resolve, reject })\n          opts.sink.send(req)\n        }\n      )\n      const duck = new TunnelChildDuck(execId, spawnedFrame.pid, opts.sink)\n      childByExec.set(execId, duck)\n      return duck\n    },\n\n    async forwardHttp(req: TunnelHttpRequest): Promise<TunnelHttpResponse> {\n      if (!hello) await this.ready()\n      const reqId = randomUUID()\n      const timeoutMs = req.timeoutMs ?? 30_000\n      const body =\n        req.body === undefined\n          ? undefined\n          : encodeData(\n              typeof req.body === \"string\" ? req.body : Buffer.from(req.body)\n            )\n      const frame: HttpRequestFrame = {\n        t: \"http_request\",\n        reqId,\n        method: req.method,\n        path: req.path,\n        ...(req.headers ? { headers: req.headers } : {}),\n        ...(body !== undefined ? { body } : {}),\n        timeoutMs,\n      }\n      return new Promise<TunnelHttpResponse>((resolve, reject) => {\n        // Belt-and-suspenders timeout: in addition to the daemon-side\n        // enforcement, we time out client-side at timeoutMs + 5s so a\n        // misbehaving daemon can't stall this promise forever.\n        const timer = setTimeout(() => {\n          httpPending.delete(reqId)\n          reject(\n            new Error(\n              `Tunnel forwardHttp(${req.method} ${req.path}) timed out after ${timeoutMs + 5_000}ms.`\n            )\n          )\n        }, timeoutMs + 5_000)\n        httpPending.set(reqId, {\n          mode: \"buffered\",\n          resolve,\n          reject,\n          timer,\n          streamHead: null,\n          streamChunks: [],\n        })\n        opts.sink.send(frame)\n      })\n    },\n\n    async forwardHttpStream(\n      req: TunnelHttpRequest\n    ): Promise<TunnelHttpStreamResponse> {\n      if (!hello) await this.ready()\n      const reqId = randomUUID()\n      // Streaming requests don't enforce a body-completion timeout —\n      // SSE / long-poll streams are *meant* to stay open. We do gate\n      // the HEAD on a generous-but-finite window so a daemon that\n      // silently drops the request still surfaces an error rather\n      // than hanging forever; once head arrives, the timer is cleared.\n      const headTimeoutMs = req.timeoutMs ?? 30_000\n      const body =\n        req.body === undefined\n          ? undefined\n          : encodeData(\n              typeof req.body === \"string\" ? req.body : Buffer.from(req.body)\n            )\n      // Daemon-side request timeout: pass a very large number so the\n      // daemon doesn't kill its own fetch before the stream completes.\n      // Daemon detects SSE content-type and disarms its timer anyway,\n      // but for non-SSE callers using forwardHttpStream this keeps\n      // things safe.\n      const frame: HttpRequestFrame = {\n        t: \"http_request\",\n        reqId,\n        method: req.method,\n        path: req.path,\n        ...(req.headers ? { headers: req.headers } : {}),\n        ...(body !== undefined ? { body } : {}),\n        timeoutMs: 24 * 60 * 60 * 1000, // 24h — effectively \"forever\"\n      }\n      return new Promise<TunnelHttpStreamResponse>((resolveHead, reject) => {\n        const timer = setTimeout(() => {\n          if (httpPending.has(reqId)) {\n            httpPending.delete(reqId)\n            reject(\n              new Error(\n                `Tunnel forwardHttpStream(${req.method} ${req.path}) head did not arrive within ${headTimeoutMs}ms.`\n              )\n            )\n          }\n        }, headTimeoutMs)\n        httpPending.set(reqId, {\n          mode: \"stream\",\n          resolveHead,\n          reject,\n          timer,\n          controller: null,\n          pendingChunks: [],\n          headEmitted: false,\n          ended: false,\n        })\n        opts.sink.send(frame)\n      })\n    },\n\n    async forwardWebSocket(\n      req: TunnelWebSocketOpenRequest\n    ): Promise<TunnelWebSocket> {\n      const h = await this.ready()\n      if (h.capabilities.wsForward !== true) {\n        throw new Error(\n          `Tunnel daemon '${h.label ?? \"(unnamed)\"}' does not advertise wsForward capability. Update the daemon to forward browser WS upgrades.`\n        )\n      }\n      const reqId = randomUUID()\n      const timeoutMs = req.openTimeoutMs ?? 30_000\n      const frame: WsOpenFrame = {\n        t: \"ws_open\",\n        reqId,\n        path: req.path,\n        ...(req.headers ? { headers: req.headers } : {}),\n        ...(req.protocols && req.protocols.length > 0\n          ? { protocols: req.protocols }\n          : {}),\n      }\n      return new Promise<TunnelWebSocket>((resolve, reject) => {\n        const timer = setTimeout(() => {\n          if (!wsOpenPending.has(reqId)) return\n          wsOpenPending.delete(reqId)\n          reject(\n            new Error(\n              `Tunnel forwardWebSocket(${req.path}) did not receive ws_open_ack within ${timeoutMs}ms.`\n            )\n          )\n        }, timeoutMs)\n        wsOpenPending.set(reqId, { resolve, reject, timer })\n        opts.sink.send(frame)\n      })\n    },\n\n    async close() {\n      opts.sink.close(\"client.close\")\n    },\n  }\n}\n\n/**\n * Internal ChildProcess duck. Public methods mirror the subset of\n * Node's ChildProcess that our ACP arm calls; double-underscored\n * methods are control hooks for the client.\n */\nclass TunnelChildDuck extends EventEmitter implements TunnelChildProcess {\n  readonly execId: string\n  pid: number | null\n  readonly stdin: Writable\n  readonly stdout: Readable\n  readonly stderr: Readable\n  private readonly sink: FrameSink\n  private exited = false\n\n  constructor(execId: string, pid: number, sink: FrameSink) {\n    super()\n    this.execId = execId\n    this.pid = pid > 0 ? pid : null\n    this.sink = sink\n\n    // stdout / stderr are passive Readables — consumers attach\n    // listeners and we push() data as it arrives.\n    this.stdout = new Readable({ read() {} })\n    this.stderr = new Readable({ read() {} })\n\n    // stdin is a Writable that converts each chunk to a `stdin` frame.\n    this.stdin = new Writable({\n      write(chunk: Buffer | string, _enc, cb) {\n        sink.send({\n          t: \"stdin\",\n          execId,\n          data: encodeData(chunk),\n        })\n        cb()\n      },\n      // Sending an empty stdin frame on `final` mirrors the local\n      // semantics of closing a child's stdin (signal EOF). Daemons\n      // ignore empty payloads, so this is safe even if the child\n      // doesn't care about EOF.\n      final(cb) {\n        sink.send({ t: \"stdin\", execId, data: \"\" })\n        cb()\n      },\n    })\n  }\n\n  __pushStdout(buf: Buffer): void {\n    this.stdout.push(buf)\n  }\n\n  __pushStderr(buf: Buffer): void {\n    this.stderr.push(buf)\n  }\n\n  __pushError(err: Error): void {\n    this.emit(\"error\", err)\n  }\n\n  __handleExit(frame: ExitFrame): void {\n    if (this.exited) return\n    this.exited = true\n    this.stdout.push(null)\n    this.stderr.push(null)\n    this.emit(\"exit\", frame.code, frame.signal)\n  }\n\n  __handleSinkClosed(): void {\n    if (this.exited) return\n    this.exited = true\n    this.stdout.push(null)\n    this.stderr.push(null)\n    this.emit(\n      \"exit\",\n      null,\n      \"SIGHUP\" // surrogate signal — the tunnel went away\n    )\n  }\n\n  kill(signal: NodeJS.Signals | number = \"SIGTERM\"): boolean {\n    if (this.exited) return false\n    this.sink.send({\n      t: \"kill\",\n      execId: this.execId,\n      signal: typeof signal === \"string\" ? signal : `SIG${signal}`,\n    })\n    return true\n  }\n\n  resize(cols: number, rows: number): void {\n    if (this.exited) return\n    this.sink.send({ t: \"resize\", execId: this.execId, cols, rows })\n  }\n}\n\n/**\n * Internal duck for a bridged WS. Mirrors the `TunnelWebSocket`\n * interface; double-underscored methods are control hooks called by\n * the client's frame router.\n *\n * Listener semantics:\n *   - `onMessage` fires for every `ws_message` frame routed here\n *   - `onClose` fires exactly once, either when the daemon emits\n *     `ws_close`, when the caller calls `.close()`, or when the\n *     underlying tunnel disappears (with code 1006 in that case)\n *   - `onError` fires for transport-level errors; close follows\n */\nclass TunnelWebSocketDuck implements TunnelWebSocket {\n  readonly protocol: string | null\n  private _readyState: \"open\" | \"closing\" | \"closed\" = \"open\"\n  private readonly reqId: string\n  private readonly sink: FrameSink\n  private readonly onCleanup: () => void\n  private readonly messageListeners = new Set<\n    (data: Buffer, isBinary: boolean) => void\n  >()\n  private readonly closeListeners = new Set<\n    (code: number, reason: string) => void\n  >()\n  private readonly errorListeners = new Set<(err: Error) => void>()\n\n  constructor(\n    reqId: string,\n    protocol: string | null,\n    sink: FrameSink,\n    onCleanup: () => void\n  ) {\n    this.reqId = reqId\n    this.protocol = protocol\n    this.sink = sink\n    this.onCleanup = onCleanup\n  }\n\n  get readyState(): \"open\" | \"closing\" | \"closed\" {\n    return this._readyState\n  }\n\n  send(data: string | Uint8Array): void {\n    if (this._readyState !== \"open\") return\n    const bytes =\n      typeof data === \"string\" ? Buffer.from(data, \"utf8\") : Buffer.from(data)\n    this.sink.send({\n      t: \"ws_message\",\n      reqId: this.reqId,\n      data: encodeData(bytes),\n      binary: typeof data !== \"string\",\n    })\n  }\n\n  close(code: number = 1000, reason?: string): void {\n    if (this._readyState === \"closed\") return\n    if (this._readyState === \"open\") {\n      this._readyState = \"closing\"\n      this.sink.send({\n        t: \"ws_close\",\n        reqId: this.reqId,\n        code,\n        ...(reason ? { reason } : {}),\n      })\n    }\n    // Fire local close immediately so the caller's onClose handler\n    // runs without waiting for the daemon's echo. The daemon's later\n    // ws_close (if any) is dropped because routeIncoming has already\n    // removed us from wsByReq via __handleClose.\n    this.__handleClose(code, reason ?? \"\")\n  }\n\n  onMessage(\n    listener: (data: Buffer, isBinary: boolean) => void\n  ): () => void {\n    this.messageListeners.add(listener)\n    return () => this.messageListeners.delete(listener)\n  }\n\n  onClose(listener: (code: number, reason: string) => void): () => void {\n    this.closeListeners.add(listener)\n    return () => this.closeListeners.delete(listener)\n  }\n\n  onError(listener: (err: Error) => void): () => void {\n    this.errorListeners.add(listener)\n    return () => this.errorListeners.delete(listener)\n  }\n\n  __handleMessage(data: Buffer, isBinary: boolean): void {\n    if (this._readyState !== \"open\") return\n    for (const l of this.messageListeners) {\n      try {\n        l(data, isBinary)\n      } catch {\n        /* listener threw — don't let it tear down siblings */\n      }\n    }\n  }\n\n  __handleClose(code: number, reason: string): void {\n    if (this._readyState === \"closed\") return\n    this._readyState = \"closed\"\n    this.onCleanup()\n    for (const l of this.closeListeners) {\n      try {\n        l(code, reason)\n      } catch {\n        /* swallow */\n      }\n    }\n    this.messageListeners.clear()\n    this.closeListeners.clear()\n    this.errorListeners.clear()\n  }\n\n  __handleSinkClosed(): void {\n    if (this._readyState === \"closed\") return\n    for (const l of this.errorListeners) {\n      try {\n        l(new Error(\"Tunnel closed mid-WS.\"))\n      } catch {\n        /* swallow */\n      }\n    }\n    this.__handleClose(1006, \"tunnel_closed\")\n  }\n}\n","/**\n * Adapter from a WebSocket-shaped object to a `FrameSink`. Works with\n * both the browser-native WebSocket API and the `ws` library's server\n * sockets — anything with `send`, `close`, and `addEventListener`-style\n * `message`/`close` events.\n *\n * Why a duck-typed shape and not `import(\"ws\")`: the cli, the host,\n * and (eventually) browser hosts all need to wrap WS instances they\n * obtained themselves. Importing `ws` in this package would force\n * every consumer to install it even when running in environments\n * (Bun, Deno, browser) that ship native WebSocket.\n */\n\nimport { encodeFrame, parseFrame, type TunnelFrame } from \"./frames.js\"\nimport type { FrameSink } from \"./transport.js\"\n\nexport interface WebSocketLike {\n  send(data: string): void\n  close(code?: number, reason?: string): void\n  readyState: number\n  addEventListener(\n    event: \"message\",\n    handler: (ev: { data: string | ArrayBuffer | Buffer }) => void\n  ): void\n  addEventListener(event: \"close\", handler: () => void): void\n  addEventListener(event: \"error\", handler: (ev: { message?: string }) => void): void\n  removeEventListener(event: string, handler: (...args: never[]) => void): void\n}\n\nconst READY_OPEN = 1\n\nexport function wrapWebSocket(ws: WebSocketLike): FrameSink {\n  const frameHandlers = new Set<(frame: TunnelFrame) => void>()\n  const closeHandlers = new Set<(reason?: string) => void>()\n  let isOpen = ws.readyState === READY_OPEN\n\n  // The `ws` library delivers Buffer; the browser delivers string or\n  // ArrayBuffer. We coerce to string and parse — everything we send is\n  // JSON text, so non-text payloads are protocol violations and get\n  // dropped.\n  const onMessage = (ev: { data: string | ArrayBuffer | Buffer }): void => {\n    let text: string\n    if (typeof ev.data === \"string\") text = ev.data\n    else if (ev.data instanceof ArrayBuffer) text = Buffer.from(ev.data).toString(\"utf8\")\n    else text = (ev.data as Buffer).toString(\"utf8\")\n    const frame = parseFrame(text)\n    if (!frame) return\n    for (const h of frameHandlers) h(frame)\n  }\n\n  const onClose = (): void => {\n    if (!isOpen) return\n    isOpen = false\n    for (const h of closeHandlers) h(\"transport.closed\")\n    frameHandlers.clear()\n    closeHandlers.clear()\n  }\n\n  const onError = (ev: { message?: string }): void => {\n    if (!isOpen) return\n    isOpen = false\n    for (const h of closeHandlers) h(ev.message ?? \"transport.error\")\n    frameHandlers.clear()\n    closeHandlers.clear()\n  }\n\n  ws.addEventListener(\"message\", onMessage)\n  ws.addEventListener(\"close\", onClose)\n  ws.addEventListener(\"error\", onError)\n\n  return {\n    get isOpen() {\n      return isOpen\n    },\n    send(frame) {\n      if (!isOpen) return\n      try {\n        ws.send(encodeFrame(frame))\n      } catch {\n        // Send-on-closed-socket is a benign race; rely on the close\n        // handler to flip isOpen and let listeners drain naturally.\n      }\n    },\n    close(reason) {\n      if (!isOpen) return\n      try {\n        ws.close(1000, reason)\n      } catch {\n        // ignore\n      }\n    },\n    onFrame(handler) {\n      frameHandlers.add(handler)\n      return () => frameHandlers.delete(handler)\n    },\n    onClose(handler) {\n      closeHandlers.add(handler)\n      return () => closeHandlers.delete(handler)\n    },\n  }\n}\n"]}
+{"version":3,"sources":["../../src/tunnel/frames.ts","../../src/tunnel/server.ts","../../src/tunnel/client.ts","../../src/tunnel/ws-adapter.ts"],"names":[],"mappings":";;;;;;;;;;;;AAsDO,IAAM,cAAA,GAAiB;AA2Y9B,IAAM,WAAA,uBAAkB,GAAA,CAAsB;AAAA,EAC5C,OAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,eAAA;AAAA,EACA,oBAAA;AAAA,EACA,qBAAA;AAAA,EACA,SAAA;AAAA,EACA,aAAA;AAAA,EACA,YAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAC,CAAA;AAQM,SAAS,WAAW,GAAA,EAAiC;AAC1D,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IACE,CAAC,MAAA,IACD,OAAO,MAAA,KAAW,QAAA,IAClB,EAAE,GAAA,IAAO,MAAA,CAAA,IACT,OAAQ,MAAA,CAA0B,CAAA,KAAM,QAAA,EACxC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAK,MAAA,CAAyB,CAAA;AACpC,EAAA,IAAI,CAAC,WAAA,CAAY,GAAA,CAAI,CAAqB,GAAG,OAAO,IAAA;AACpD,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,YAAY,KAAA,EAA4B;AACtD,EAAA,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA;AAC7B;AAMO,SAAS,WAAW,KAAA,EAAoC;AAC7D,EAAA,MAAM,GAAA,GACJ,OAAO,KAAA,KAAU,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,KAAA,EAAO,MAAM,CAAA,GAAI,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA;AAC5E,EAAA,OAAO,GAAA,CAAI,SAAS,QAAQ,CAAA;AAC9B;AAEO,SAAS,WAAW,IAAA,EAAsB;AAC/C,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,IAAA,EAAM,QAAQ,CAAA;AACnC;ACvdO,IAAM,0BAAA,GAA6B;AAOnC,IAAM,+BAAA,GAAkC;AA2KxC,SAAS,mBAAmB,IAAA,EAAyC;AAC1E,EAAA,MAAM,QAAA,uBAAe,GAAA,EAA0B;AAE/C,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAwB;AAI7C,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAA+B;AACtD,EAAA,IAAI,MAAA,GAAS,KAAA;AAIb,EAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,IACb,CAAA,EAAG,OAAA;AAAA,IACH,OAAA,EAAS,cAAA;AAAA,IACT,YAAA,EAAc;AAAA,MACZ,GAAA,EAAK,KAAK,GAAA,KAAQ,IAAA;AAAA,MAClB,WAAW,IAAA,CAAK,cAAA,KAAmB,MAAA,IAAa,CAAC,CAAC,IAAA,CAAK,YAAA;AAAA,MACvD,GAAI,IAAA,CAAK,KAAA,IAAS,IAAA,CAAK,KAAA,CAAM,MAAA,GAAS,EAAE,KAAA,EAAO,IAAA,CAAK,KAAA,EAAM,GAAI;AAAC,KACjE;AAAA,IACA,OAAO,IAAA,CAAK,KAAA;AAAA,IACZ,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,YAAA;AAAA,MACN,OAAA,EAAS,aAAA;AAAA,MACT,UAAU,CAAA,EAAG,QAAA,EAAU,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA;AAAA,MACrC,aAAa,OAAA,CAAQ;AAAA;AACvB,GACD,CAAA;AAED,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,CAAC,KAAA,KAAU;AAC5C,IAAA,WAAA,CAAY,KAAK,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAQ;AAChC,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,MAAA,IAAA,CAAK,IAAA,CAAK,KAAK,EAAE,CAAA,EAAG,SAAS,IAAA,EAAM,UAAA,EAAY,SAAS,CAAA;AAAA,IAC1D,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AAED,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,MAAM;AACvC,IAAA,MAAA,GAAS,IAAA;AACT,IAAA,KAAA,MAAW,GAAG,KAAK,KAAK,QAAA,EAAU,KAAA,CAAM,KAAK,SAAS,CAAA;AACtD,IAAA,QAAA,CAAS,KAAA,EAAM;AACf,IAAA,KAAA,MAAW,GAAG,GAAG,CAAA,IAAK,QAAA,MAAc,IAAA,EAAK;AACzC,IAAA,QAAA,CAAS,KAAA,EAAM;AACf,IAAA,KAAA,MAAW,GAAG,EAAE,CAAA,IAAK,UAAA,EAAY;AAC/B,MAAA,IAAI;AACF,QAAA,EAAA,CAAG,KAAA,CAAM,MAAM,eAAe,CAAA;AAAA,MAChC,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,UAAA,CAAW,KAAA,EAAM;AACjB,IAAA,QAAA,EAAS;AACT,IAAA,QAAA,EAAS;AAAA,EACX,CAAC,CAAA;AAED,EAAA,eAAe,YAAY,KAAA,EAAmC;AAC5D,IAAA,QAAQ,MAAM,CAAA;AAAG,MACf,KAAK,OAAA;AACH,QAAA,MAAM,YAAY,KAAK,CAAA;AACvB,QAAA;AAAA,MACF,KAAK,OAAA,EAAS;AACZ,QAAA,MAAM,GAAA,GAAM,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACrC,QAAA,IAAI,GAAA,EAAK;AACP,UAAA,GAAA,CAAI,KAAA,CAAM,OAAO,IAAA,CAAK,KAAA,CAAM,MAAM,QAAQ,CAAA,CAAE,QAAA,CAAS,MAAM,CAAC,CAAA;AAC5D,UAAA;AAAA,QACF;AACA,QAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACvC,QAAA,IAAI,CAAC,KAAA,IAAS,CAAC,KAAA,CAAM,KAAA,EAAO;AAC1B,UAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,YACb,CAAA,EAAG,OAAA;AAAA,YACH,QAAQ,KAAA,CAAM,MAAA;AAAA,YACd,IAAA,EAAM,cAAA;AAAA,YACN,OAAA,EAAS,CAAA,cAAA,EAAiB,KAAA,CAAM,MAAM,CAAA,CAAA;AAAA,WACvC,CAAA;AACD,UAAA;AAAA,QACF;AACA,QAAA,KAAA,CAAM,MAAM,KAAA,CAAM,MAAA,CAAO,KAAK,KAAA,CAAM,IAAA,EAAM,QAAQ,CAAC,CAAA;AACnD,QAAA;AAAA,MACF;AAAA,MACA,KAAK,MAAA,EAAQ;AACX,QAAA,MAAM,GAAA,GAAM,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACrC,QAAA,IAAI,GAAA,EAAK;AACP,UAAA,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,MAAA,IAAU,SAAS,CAAA;AAClC,UAAA;AAAA,QACF;AACA,QAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACvC,QAAA,IAAI,CAAC,KAAA,EAAO;AACV,UAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,YACb,CAAA,EAAG,OAAA;AAAA,YACH,QAAQ,KAAA,CAAM,MAAA;AAAA,YACd,IAAA,EAAM,cAAA;AAAA,YACN,OAAA,EAAS,CAAA,cAAA,EAAiB,KAAA,CAAM,MAAM,CAAA,CAAA;AAAA,WACvC,CAAA;AACD,UAAA;AAAA,QACF;AACA,QAAA,KAAA,CAAM,IAAA,CAAM,KAAA,CAAM,MAAA,IAAyC,SAAS,CAAA;AACpE,QAAA;AAAA,MACF;AAAA,MACA,KAAK,QAAA,EAAU;AACb,QAAA,QAAA,CAAS,GAAA,CAAI,MAAM,MAAM,CAAA,EAAG,OAAO,KAAA,CAAM,IAAA,EAAM,MAAM,IAAI,CAAA;AACzD,QAAA;AAAA,MACF;AAAA,MACA,KAAK,cAAA;AAOH,QAAA,MAAM,kBAAkB,KAAK,CAAA;AAC7B,QAAA;AAAA,MACF,KAAK,SAAA;AACH,QAAA,MAAM,aAAa,KAAK,CAAA;AACxB,QAAA;AAAA,MACF,KAAK,YAAA,EAAc;AACjB,QAAA,MAAM,EAAA,GAAK,UAAA,CAAW,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AACrC,QAAA,IAAI,CAAC,EAAA,EAAI;AAIP,UAAA;AAAA,QACF;AACA,QAAA,IAAI;AACF,UAAA,EAAA,CAAG,IAAA,CAAK,UAAA,CAAW,KAAA,CAAM,IAAI,CAAA,EAAG,EAAE,MAAA,EAAQ,KAAA,CAAM,MAAA,KAAW,IAAA,EAAM,CAAA;AAAA,QACnE,SAAS,GAAA,EAAK;AACZ,UAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,UAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,YACb,CAAA,EAAG,UAAA;AAAA,YACH,OAAO,KAAA,CAAM,KAAA;AAAA,YACb,IAAA,EAAM,IAAA;AAAA,YACN,MAAA,EAAQ,gBAAgB,OAAO,CAAA;AAAA,WAChC,CAAA;AACD,UAAA,IAAI;AACF,YAAA,EAAA,CAAG,KAAA,CAAM,MAAM,aAAa,CAAA;AAAA,UAC9B,CAAA,CAAA,MAAQ;AAAA,UAER;AACA,UAAA,UAAA,CAAW,MAAA,CAAO,MAAM,KAAK,CAAA;AAAA,QAC/B;AACA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,UAAA,EAAY;AACf,QAAA,MAAM,EAAA,GAAK,UAAA,CAAW,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AACrC,QAAA,IAAI,CAAC,EAAA,EAAI;AACT,QAAA,UAAA,CAAW,MAAA,CAAO,MAAM,KAAK,CAAA;AAC7B,QAAA,IAAI;AACF,UAAA,EAAA,CAAG,KAAA,CAAM,KAAA,CAAM,IAAA,EAAM,KAAA,CAAM,MAAM,CAAA;AAAA,QACnC,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,MAAA;AACH,QAAA,IAAA,CAAK,IAAA,CAAK,KAAK,EAAE,CAAA,EAAG,QAAQ,KAAA,EAAO,KAAA,CAAM,OAAO,CAAA;AAChD,QAAA;AAAA,MACF,KAAK,gBAAA;AAMH,QAAA,IAAI;AACF,UAAA,IAAA,CAAK,eAAA,GAAkB;AAAA,YACrB,GAAI,MAAM,QAAA,KAAa,KAAA,CAAA,GAAY,EAAE,QAAA,EAAU,KAAA,CAAM,QAAA,EAAS,GAAI;AAAC,WACpE,CAAA;AAAA,QACH,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA;AAAA,MACF,KAAK,MAAA;AAAA,MACL,KAAK,OAAA;AAEH,QAAA;AAAA,MACF;AACE,QAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,UACb,CAAA,EAAG,OAAA;AAAA,UACH,IAAA,EAAM,eAAA;AAAA,UACN,OAAA,EAAS,CAAA,uCAAA,EAA2C,KAAA,CAAwB,CAAC,CAAA,CAAA;AAAA,SAC9E,CAAA;AAAA;AACL,EACF;AAEA,EAAA,eAAe,YAAY,GAAA,EAAgC;AACzD,IAAA,IAAI,MAAA,EAAQ;AACZ,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,GAAG,CAAA;AAAA,IACrC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,OAAA;AAAA,QACH,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,IAAA,EAAM,oBAAA;AAAA,QACN;AAAA,OACD,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,OAAA;AAAA,QACH,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,IAAA,EAAM,oBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACV,CAAA;AACD,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,QAAA,CAAS,GAAA,IAAO,IAAA,CAAK,QAAA,EAAU;AACjC,MAAA,IAAI,GAAA;AACJ,MAAA,IAAI;AACF,QAAA,GAAA,GAAM,KAAK,QAAA,CAAS;AAAA,UAClB,SAAS,QAAA,CAAS,OAAA;AAAA,UAClB,IAAA,EAAM,CAAC,GAAG,QAAA,CAAS,IAAI,CAAA;AAAA,UACvB,KAAK,QAAA,CAAS,GAAA;AAAA,UACd,KAAK,QAAA,CAAS,GAAA,GAAM,EAAE,GAAG,QAAA,CAAS,KAAI,GAAI,KAAA,CAAA;AAAA,UAC1C,IAAA,EAAM,SAAS,IAAA,IAAQ,EAAA;AAAA,UACvB,IAAA,EAAM,SAAS,IAAA,IAAQ;AAAA,SACxB,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,QAAA,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,EAAE,CAAA,EAAG,OAAA,EAAS,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,IAAA,EAAM,cAAA,EAAgB,OAAA,EAAS,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,QAAA,CAAS,GAAA,CAAI,GAAA,CAAI,MAAA,EAAQ,GAAG,CAAA;AAC5B,MAAA,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,EAAE,CAAA,EAAG,SAAA,EAAW,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,GAAA,EAAK,GAAA,CAAI,GAAA,EAAK,CAAA;AAEjE,MAAA,GAAA,CAAI,OAAO,CAAA,IAAA,KAAQ;AACjB,QAAA,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,EAAE,CAAA,EAAG,QAAA,EAAU,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,IAAA,EAAM,UAAA,CAAW,IAAI,CAAA,EAAG,CAAA;AAAA,MAC5E,CAAC,CAAA;AACD,MAAA,GAAA,CAAI,MAAA,CAAO,CAAC,EAAE,QAAA,EAAU,QAAO,KAAM;AACnC,QAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,UACb,CAAA,EAAG,MAAA;AAAA,UACH,QAAQ,GAAA,CAAI,MAAA;AAAA,UACZ,IAAA,EAAM,QAAA;AAAA,UACN,MAAA,EAAQ,MAAA,IAAU,IAAA,GAAO,MAAA,CAAO,MAAM,CAAA,GAAI;AAAA,SAC3C,CAAA;AACD,QAAA,QAAA,CAAS,MAAA,CAAO,IAAI,MAAM,CAAA;AAAA,MAC5B,CAAC,CAAA;AAED,MAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,QAAA,IAAI;AAGF,UAAA,IAAA,CAAK,cAAA,CAAe;AAAA,YAClB,QAAQ,GAAA,CAAI,MAAA;AAAA,YACZ,KAAA,EAAO,EAAE,GAAA,EAAK,GAAA,CAAI,GAAA,EAAI;AAAA,YACtB,OAAA,EAAS;AAAA,WACV,CAAA;AAAA,QACH,CAAA,CAAA,MAAQ;AAAA,QAAwB;AAAA,MAClC;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI;AACF,MAAA,KAAA,GAAQ,MAAM,QAAA,CAAS,OAAA,EAAS,CAAC,GAAG,QAAA,CAAS,IAAI,CAAA,EAAG;AAAA,QAClD,KAAK,QAAA,CAAS,GAAA;AAAA,QACd,GAAA,EAAK,EAAE,GAAG,OAAA,CAAQ,KAAK,GAAI,QAAA,CAAS,GAAA,IAAO,EAAC,EAAG;AAAA,QAC/C,KAAA,EAAO,CAAC,MAAA,EAAQ,MAAA,EAAQ,MAAM;AAAA;AAAA,OAE/B,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,OAAA;AAAA,QACH,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,IAAA,EAAM,cAAA;AAAA,QACN;AAAA,OACD,CAAA;AACD,MAAA;AAAA,IACF;AAEA,IAAA,QAAA,CAAS,GAAA,CAAI,GAAA,CAAI,MAAA,EAAQ,KAAK,CAAA;AAE9B,IAAA,IAAI,OAAO,KAAA,CAAM,GAAA,KAAQ,QAAA,EAAU;AACjC,MAAA,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,EAAE,CAAA,EAAG,SAAA,EAAW,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,GAAA,EAAK,KAAA,CAAM,GAAA,EAAK,CAAA;AAAA,IACrE,CAAA,MAAO;AAIL,MAAA,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,EAAE,CAAA,EAAG,SAAA,EAAW,QAAQ,GAAA,CAAI,MAAA,EAAQ,GAAA,EAAK,EAAA,EAAI,CAAA;AAAA,IAC9D;AAMA,IAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,cAAA,CAAe,EAAE,MAAA,EAAQ,GAAA,CAAI,QAAQ,KAAA,EAAO,OAAA,EAAS,UAAU,CAAA;AAAA,MACtE,SAAS,GAAA,EAAK;AAIZ,QAAA,OAAA,CAAQ,IAAA;AAAA,UACN,CAAA,qDAAA,EAAwD,GAAA,CAAI,MAAM,CAAA,EAAA,EAChE,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA;AAAA,SACF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,MAAM,CAAA,GAAiB;AAAA,QACrB,CAAA,EAAG,QAAA;AAAA,QACH,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,IAAA,EAAM,WAAW,KAAK;AAAA,OACxB;AACA,MAAA,IAAA,CAAK,IAAA,CAAK,KAAK,CAAC,CAAA;AAAA,IAClB,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,MAAM,CAAA,GAAiB;AAAA,QACrB,CAAA,EAAG,QAAA;AAAA,QACH,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,IAAA,EAAM,WAAW,KAAK;AAAA,OACxB;AACA,MAAA,IAAA,CAAK,IAAA,CAAK,KAAK,CAAC,CAAA;AAAA,IAClB,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACzB,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,OAAA;AAAA,QACH,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,IAAA,EAAM,aAAA;AAAA,QACN,SAAS,GAAA,CAAI;AAAA,OACd,CAAA;AAAA,IACH,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,MAAA,EAAQ,CAAC,IAAA,EAAM,MAAA,KAAW;AACjC,MAAA,MAAM,CAAA,GAAe;AAAA,QACnB,CAAA,EAAG,MAAA;AAAA,QACH,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,IAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAA,CAAK,IAAA,CAAK,KAAK,CAAC,CAAA;AAChB,MAAA,QAAA,CAAS,MAAA,CAAO,IAAI,MAAM,CAAA;AAAA,IAC5B,CAAC,CAAA;AAAA,EACH;AASA,EAAA,eAAe,aAAa,GAAA,EAAiC;AAC3D,IAAA,IAAI,MAAA,EAAQ;AACZ,IAAA,MAAM,MAAA,GAAS,CACb,MAAA,EACA,IAAA,EACA,OAAA,KACS;AACT,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,aAAA;AAAA,QACH,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,MAAA;AAAA,QACA,KAAA,EAAO,EAAE,IAAA,EAAM,OAAA;AAAQ,OACxB,CAAA;AAAA,IACH,CAAA;AACA,IAAA,IAAI,CAAC,IAAA,CAAK,cAAA,IAAkB,CAAC,KAAK,YAAA,EAAc;AAC9C,MAAA,MAAA;AAAA,QACE,GAAA;AAAA,QACA,4BAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA;AAAA,IACF;AACA,IAAA,IACE,CAAC,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,IACxB,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA,IACxB,GAAA,CAAI,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA,EACtB;AACA,MAAA,MAAA;AAAA,QACE,GAAA;AAAA,QACA,cAAA;AAAA,QACA,CAAA,sDAAA,EAAyD,IAAI,IAAI,CAAA,EAAA;AAAA,OACnE;AACA,MAAA;AAAA,IACF;AACA,IAAA,MAAM,UAAA,uBAAiB,GAAA,CAAI;AAAA,MACzB,YAAA;AAAA,MACA,SAAA;AAAA,MACA,uBAAA;AAAA,MACA,mBAAA;AAAA,MACA,0BAAA;AAAA,MACA,wBAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,MAAM,UAAkC,EAAC;AACzC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,QAAQ,GAAA,CAAI,OAAA,IAAW,EAAE,CAAA,EAAG;AACtD,MAAA,IAAI,UAAA,CAAW,GAAA,CAAI,CAAA,CAAE,WAAA,EAAa,CAAA,EAAG;AACrC,MAAA,OAAA,CAAQ,CAAC,CAAA,GAAI,CAAA;AAAA,IACf;AAKA,IAAA,IAAI,WAAW,IAAA,CAAK,YAAA;AACpB,IAAA,IAAI,IAAI,QAAA,EAAU;AAChB,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,iBAAA,GAAoB,IAAI,QAAQ,CAAA;AAC5D,MAAA,IAAI,CAAC,QAAA,EAAU;AACb,QAAA,MAAA;AAAA,UACE,GAAA;AAAA,UACA,qBAAA;AAAA,UACA,CAAA,+BAAA,EAAkC,IAAI,QAAQ,CAAA,EAAA;AAAA,SAChD;AACA,QAAA;AAAA,MACF;AACA,MAAA,QAAA,GAAW,QAAA;AAAA,IACb;AAIA,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,OAAA,CAAQ,gBAAA,EAAkB,SAAS,CAAA;AACzD,IAAA,MAAM,GAAA,GAAM,GAAG,IAAA,CAAK,OAAA,CAAQ,OAAO,EAAE,CAAC,CAAA,EAAG,GAAA,CAAI,IAAI,CAAA,CAAA;AAMjD,IAAA,MAAM,aAAA,GAAgB,KAAK,eAAA,IAAmB,0BAAA;AAC9C,IAAA,MAAM,SAAA,GAAY,IAAI,eAAA,EAAgB;AACtC,IAAA,IAAI,YAAA,GAAe,KAAA;AACnB,IAAA,IAAI,SAAA,GAAkD,IAAA;AACtD,IAAA,MAAM,WAAA,GAAc,KAAK,cAAA,CAAe;AAAA,MACtC,GAAA;AAAA,MACA,GAAI,GAAA,CAAI,SAAA,IAAa,GAAA,CAAI,SAAA,CAAU,MAAA,GAAS,CAAA,GACxC,EAAE,SAAA,EAAW,GAAA,CAAI,SAAA,EAAU,GAC3B,EAAC;AAAA,MACL,OAAA;AAAA,MACA,QAAQ,SAAA,CAAU;AAAA,KACnB,CAAA;AACD,IAAA,MAAM,cAAA,GAAiB,IAAI,OAAA,CAAe,CAAC,UAAU,GAAA,KAAQ;AAC3D,MAAA,SAAA,GAAY,WAAW,MAAM;AAC3B,QAAA,YAAA,GAAe,IAAA;AACf,QAAA,SAAA,CAAU,KAAA,CAAM,IAAI,KAAA,CAAM,iBAAiB,CAAC,CAAA;AAC5C,QAAA,GAAA,CAAI,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,aAAa,IAAI,CAAC,CAAA;AAAA,MACtE,GAAG,aAAa,CAAA;AAChB,MAAA,IAAI,OAAO,SAAA,KAAc,QAAA,EAAU,SAAA,CAAU,KAAA,EAAM;AAAA,IACrD,CAAC,CAAA;AAED,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,OAAA,CAAQ,IAAA,CAAK,CAAC,WAAA,EAAa,cAAc,CAAC,CAAA;AAAA,IAC7D,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,SAAA,eAAwB,SAAS,CAAA;AACrC,MAAA,IAAI,YAAA,EAAc;AAGhB,QAAA,WAAA,CAAY,IAAA;AAAA,UACV,CAAA,IAAA,KAAQ;AACN,YAAA,IAAI;AACF,cAAA,IAAA,CAAK,KAAA,CAAM,MAAM,cAAc,CAAA;AAAA,YACjC,CAAA,CAAA,MAAQ;AAAA,YAER;AAAA,UACF,CAAA;AAAA,UACA,MAAM;AAAA,UAAC;AAAA,SACT;AACA,QAAA,MAAA;AAAA,UACE,GAAA;AAAA,UACA,qBAAA;AAAA,UACA,mDAAmD,aAAa,CAAA,GAAA;AAAA,SAClE;AACA,QAAA;AAAA,MACF;AACA,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAG/D,MAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,KAAA,CAAM,mCAAmC,CAAA;AAC3D,MAAA,MAAM,MAAA,GAAS,IAAI,MAAA,CAAO,QAAA,CAAS,EAAE,CAAC,CAAA,EAAI,EAAE,CAAA,GAAI,GAAA;AAChD,MAAA,MAAA,CAAO,MAAA,EAAQ,sBAAsB,OAAO,CAAA;AAC5C,MAAA;AAAA,IACF;AACA,IAAA,IAAI,SAAA,eAAwB,SAAS,CAAA;AAErC,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,IAAI;AACF,QAAA,QAAA,CAAS,KAAA,CAAM,MAAM,eAAe,CAAA;AAAA,MACtC,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA;AAAA,IACF;AACA,IAAA,UAAA,CAAW,GAAA,CAAI,GAAA,CAAI,KAAA,EAAO,QAAQ,CAAA;AAClC,IAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,MACb,CAAA,EAAG,aAAA;AAAA,MACH,OAAO,GAAA,CAAI,KAAA;AAAA,MACX,MAAA,EAAQ,GAAA;AAAA,MACR,GAAI,SAAS,QAAA,GAAW,EAAE,UAAU,QAAA,CAAS,QAAA,KAAa;AAAC,KAC5D,CAAA;AAED,IAAA,QAAA,CAAS,SAAA,CAAU,CAAC,IAAA,EAAM,QAAA,KAAa;AACrC,MAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ;AACvB,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,YAAA;AAAA,QACH,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,IAAA,EAAM,WAAW,IAAI,CAAA;AAAA,QACrB,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH,CAAC,CAAA;AACD,IAAA,QAAA,CAAS,OAAA,CAAQ,CAAC,IAAA,EAAM,MAAA,KAAW;AACjC,MAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,GAAA,CAAI,KAAK,CAAA,EAAG;AAChC,MAAA,UAAA,CAAW,MAAA,CAAO,IAAI,KAAK,CAAA;AAC3B,MAAA,IAAI,IAAA,CAAK,KAAK,MAAA,EAAQ;AACpB,QAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,UACb,CAAA,EAAG,UAAA;AAAA,UACH,OAAO,GAAA,CAAI,KAAA;AAAA,UACX,IAAA;AAAA,UACA,GAAI,MAAA,GAAS,EAAE,MAAA,KAAW;AAAC,SAC5B,CAAA;AAAA,MACH;AAAA,IACF,CAAC,CAAA;AACD,IAAA,QAAA,CAAS,QAAQ,CAAA,GAAA,KAAO;AAGtB,MAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,GAAA,CAAI,KAAK,CAAA,EAAG;AAChC,MAAA,UAAA,CAAW,MAAA,CAAO,IAAI,KAAK,CAAA;AAC3B,MAAA,IAAI,IAAA,CAAK,KAAK,MAAA,EAAQ;AACpB,QAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,UACb,CAAA,EAAG,UAAA;AAAA,UACH,OAAO,GAAA,CAAI,KAAA;AAAA,UACX,IAAA,EAAM,IAAA;AAAA,UACN,MAAA,EAAQ,CAAA,gBAAA,EAAmB,GAAA,CAAI,OAAO,CAAA;AAAA,SACvC,CAAA;AAAA,MACH;AACA,MAAA,IAAI;AACF,QAAA,QAAA,CAAS,KAAA,CAAM,MAAM,gBAAgB,CAAA;AAAA,MACvC,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAEA,EAAA,eAAe,kBAAkB,GAAA,EAAsC;AACrE,IAAA,IAAI,MAAA,EAAQ;AACZ,IAAA,MAAM,OAAA,GAAU,CACd,OAAA,KAGS;AACT,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,eAAA;AAAA,QACH,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,GAAG;AAAA,OACiB,CAAA;AAAA,IACxB,CAAA;AAIA,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACtB,MAAA,OAAA,CAAQ;AAAA,QACN,MAAA,EAAQ,GAAA;AAAA,QACR,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,8BAAA;AAAA,UACN,OAAA,EACE;AAAA;AACJ,OACD,CAAA;AACD,MAAA;AAAA,IACF;AAKA,IAAA,IACE,CAAC,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,IACxB,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA,IACxB,GAAA,CAAI,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA,EACtB;AACA,MAAA,OAAA,CAAQ;AAAA,QACN,MAAA,EAAQ,GAAA;AAAA,QACR,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,cAAA;AAAA,UACN,OAAA,EAAS,CAAA,wDAAA,EAA2D,GAAA,CAAI,IAAI,CAAA,EAAA;AAAA;AAC9E,OACD,CAAA;AACD,MAAA;AAAA,IACF;AAIA,IAAA,MAAM,UAAA,uBAAiB,GAAA,CAAI;AAAA,MACzB,YAAA;AAAA,MACA,YAAA;AAAA,MACA,mBAAA;AAAA,MACA,SAAA;AAAA,MACA,oBAAA;AAAA,MACA,qBAAA;AAAA,MACA,IAAA;AAAA,MACA,SAAA;AAAA,MACA,MAAA;AAAA;AAAA,MACA;AAAA;AAAA,KACD,CAAA;AACD,IAAA,MAAM,UAAkC,EAAC;AACzC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,QAAQ,GAAA,CAAI,OAAA,IAAW,EAAE,CAAA,EAAG;AACtD,MAAA,IAAI,UAAA,CAAW,GAAA,CAAI,CAAA,CAAE,WAAA,EAAa,CAAA,EAAG;AACrC,MAAA,OAAA,CAAQ,CAAC,CAAA,GAAI,CAAA;AAAA,IACf;AAEA,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAA,CAAK,YAAA,CAAa,OAAA,CAAQ,OAAO,EAAE,CAAC,CAAA,EAAG,GAAA,CAAI,IAAI,CAAA,CAAA;AAC9D,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,SAAA,GACJ,GAAA,CAAI,SAAA,IACJ,IAAA,CAAK,oBAAA,IACL,+BAAA;AAOF,IAAA,IAAI,KAAA,GAA8C,UAAA;AAAA,MAChD,MAAM,WAAW,KAAA,EAAM;AAAA,MACvB;AAAA,KACF;AACA,IAAA,MAAM,aAAa,MAAM;AACvB,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,KAAA,GAAQ,IAAA;AAAA,MACV;AAAA,IACF,CAAA;AACA,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,QACnC,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,OAAA;AAAA,QACA,MACE,GAAA,CAAI,IAAA,KAAS,SAAY,KAAA,CAAA,GAAY,UAAA,CAAW,IAAI,IAAI,CAAA;AAAA,QAC1D,QAAQ,UAAA,CAAW;AAAA;AAAA;AAAA,OAGpB,CAAA;AACD,MAAA,MAAM,aAAqC,EAAC;AAC5C,MAAA,WAAA,CAAY,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAAQ;AAC1C,QAAA,IAAI,UAAA,CAAW,GAAA,CAAI,GAAA,CAAI,WAAA,EAAa,CAAA,EAAG;AACvC,QAAA,UAAA,CAAW,GAAG,CAAA,GAAI,KAAA;AAAA,MACpB,CAAC,CAAA;AAOD,MAAA,MAAM,WAAA,GAAA,CAAe,UAAA,CAAW,cAAc,CAAA,IAAK,IAAI,WAAA,EAAY;AACnE,MAAA,MAAM,WACJ,WAAA,CAAY,UAAA,CAAW,mBAAmB,CAAA,IAC1C,WAAA,CAAY,SAAS,sBAAsB,CAAA;AAE7C,MAAA,IAAI,QAAA,IAAY,YAAY,IAAA,EAAM;AAIhC,QAAA,UAAA,EAAW;AACX,QAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,UACb,CAAA,EAAG,oBAAA;AAAA,UACH,OAAO,GAAA,CAAI,KAAA;AAAA,UACX,QAAQ,WAAA,CAAY,MAAA;AAAA,UACpB,OAAA,EAAS;AAAA,SACV,CAAA;AACD,QAAA,MAAM,MAAA,GAAS,WAAA,CAAY,IAAA,CAAK,SAAA,EAAU;AAK1C,QAAA,MAAM,SAAS,IAAA,CAAK,uBAAA;AACpB,QAAA,MAAM,IAAA,0BAAc,MAAM,CAAA;AAE1B,QAAA,MAAM,YAAY,YAA+C;AAC/D,UAAA,IAAI,CAAC,MAAA,EAAQ,OAAO,MAAA,CAAO,IAAA,EAAK;AAChC,UAAA,IAAI,SAAA,GAAkD,IAAA;AACtD,UAAA,MAAM,IAAA,GAAO,IAAI,OAAA,CAAqB,CAAA,OAAA,KAAW;AAC/C,YAAA,SAAA,GAAY,UAAA,CAAW,MAAM,OAAA,CAAQ,IAAI,GAAG,MAAM,CAAA;AAClD,YAAA,IAAI,OAAO,SAAA,KAAc,QAAA,EAAU,SAAA,CAAU,KAAA,EAAM;AAAA,UACrD,CAAC,CAAA;AACD,UAAA,IAAI;AACF,YAAA,OAAO,MAAM,QAAQ,IAAA,CAAK,CAAC,OAAO,IAAA,EAAK,EAAG,IAAI,CAAC,CAAA;AAAA,UACjD,CAAA,SAAE;AACA,YAAA,IAAI,SAAA,eAAwB,SAAS,CAAA;AAAA,UACvC;AAAA,QACF,CAAA;AACA,QAAA,IAAI;AACF,UAAA,OAAO,IAAA,EAAM;AACX,YAAA,MAAM,KAAA,GAAQ,MAAM,SAAA,EAAU;AAC9B,YAAA,IAAI,UAAU,IAAA,EAAM;AAClB,cAAA,IAAI;AACF,gBAAA,MAAM,OAAO,MAAA,EAAO;AAAA,cACtB,CAAA,CAAA,MAAQ;AAAA,cAER;AACA,cAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,gBACb,CAAA,EAAG,qBAAA;AAAA,gBACH,OAAO,GAAA,CAAI,KAAA;AAAA,gBACX,GAAA,EAAK,IAAA;AAAA,gBACL,KAAA,EAAO;AAAA,kBACL,IAAA,EAAM,8BAAA;AAAA,kBACN,OAAA,EAAS,6BAA6B,MAAM,CAAA,GAAA;AAAA;AAC9C,eACD,CAAA;AACD,cAAA;AAAA,YACF;AACA,YAAA,MAAM,EAAE,KAAA,EAAO,IAAA,EAAK,GAAI,KAAA;AACxB,YAAA,IAAI,IAAA,EAAM;AACR,cAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,gBACb,CAAA,EAAG,qBAAA;AAAA,gBACH,OAAO,GAAA,CAAI,KAAA;AAAA,gBACX,GAAA,EAAK;AAAA,eACN,CAAA;AACD,cAAA;AAAA,YACF;AACA,YAAA,IAAI,KAAA,IAAS,KAAA,CAAM,UAAA,GAAa,CAAA,EAAG;AACjC,cAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,gBACb,CAAA,EAAG,qBAAA;AAAA,gBACH,OAAO,GAAA,CAAI,KAAA;AAAA,gBACX,IAAA,EAAM,UAAA,CAAW,MAAA,CAAO,IAAA,CAAK,KAAK,CAAC;AAAA,eACpC,CAAA;AAAA,YACH;AAGA,YAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ;AACrB,cAAA,IAAI;AACF,gBAAA,MAAM,OAAO,MAAA,EAAO;AAAA,cACtB,CAAA,CAAA,MAAQ;AAAA,cAER;AACA,cAAA;AAAA,YACF;AAAA,UACF;AAAA,QACF,SAAS,GAAA,EAAK;AACZ,UAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,UAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,YACb,CAAA,EAAG,qBAAA;AAAA,YACH,OAAO,GAAA,CAAI,KAAA;AAAA,YACX,GAAA,EAAK,IAAA;AAAA,YACL,KAAA,EAAO,EAAE,IAAA,EAAM,wBAAA,EAA0B,OAAA;AAAQ,WAClD,CAAA;AAAA,QACH;AACA,QAAA;AAAA,MACF;AAGA,MAAA,MAAM,MAAM,MAAA,CAAO,IAAA,CAAK,MAAM,WAAA,CAAY,aAAa,CAAA;AACvD,MAAA,OAAA,CAAQ;AAAA,QACN,QAAQ,WAAA,CAAY,MAAA;AAAA,QACpB,OAAA,EAAS,UAAA;AAAA,QACT,MAAM,GAAA,CAAI,MAAA,GAAS,CAAA,GAAI,UAAA,CAAW,GAAG,CAAA,GAAI;AAAA,OAC1C,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,IAAA,KAAS,YAAA;AACrD,MAAA,OAAA,CAAQ;AAAA,QACN,MAAA,EAAQ,UAAU,GAAA,GAAM,GAAA;AAAA,QACxB,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,UAAU,SAAA,GAAY,uBAAA;AAAA,UAC5B;AAAA;AACF,OACD,CAAA;AAAA,IACH,CAAA,SAAE;AACA,MAAA,UAAA,EAAW;AAAA,IACb;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,MAAM,KAAA,GAAQ;AACZ,MAAA,IAAI,MAAA,EAAQ;AACZ,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,KAAA,MAAW,GAAG,KAAK,KAAK,QAAA,EAAU,KAAA,CAAM,KAAK,SAAS,CAAA;AACtD,MAAA,QAAA,CAAS,KAAA,EAAM;AACf,MAAA,IAAA,CAAK,IAAA,CAAK,MAAM,cAAc,CAAA;AAAA,IAChC;AAAA,GACF;AACF;AC7xBO,SAAS,mBAAmB,IAAA,EAAyC;AAC1E,EAAA,MAAM,cAAA,GAAiB,KAAK,cAAA,IAAkB,GAAA;AAC9C,EAAA,IAAI,KAAA,GAA2B,IAAA;AAC/B,EAAA,IAAI,YAAA,GAA2C,IAAA;AAK/C,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAA6B;AACrD,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAGvB;AAwCF,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAyB;AAcjD,EAAA,MAAM,aAAA,uBAAoB,GAAA,EAAuB;AACjD,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAiC;AAErD,EAAA,MAAM,QAAA,GAAW,KAAK,IAAA,CAAK,OAAA,CAAQ,CAAC,KAAA,KAAU,aAAA,CAAc,KAAK,CAAC,CAAA;AAClE,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,MAAM;AACvC,IAAA,KAAA,MAAW,GAAG,IAAI,CAAA,IAAK,WAAA,OAAkB,kBAAA,EAAmB;AAC5D,IAAA,WAAA,CAAY,KAAA,EAAM;AAClB,IAAA,KAAA,MAAW,GAAG,CAAC,CAAA,IAAK,YAAA,EAAc;AAChC,MAAA,CAAA,CAAE,MAAA,CAAO,IAAI,KAAA,CAAM,uCAAuC,CAAC,CAAA;AAAA,IAC7D;AACA,IAAA,YAAA,CAAa,KAAA,EAAM;AACnB,IAAA,KAAA,MAAW,GAAG,CAAC,CAAA,IAAK,WAAA,EAAa;AAC/B,MAAA,YAAA,CAAa,EAAE,KAAK,CAAA;AACpB,MAAA,IAAI,CAAA,CAAE,SAAS,UAAA,EAAY;AACzB,QAAA,CAAA,CAAE,MAAA,CAAO,IAAI,KAAA,CAAM,6CAA6C,CAAC,CAAA;AAAA,MACnE,CAAA,MAAO;AAIL,QAAA,IAAI,CAAC,EAAE,WAAA,EAAa;AAClB,UAAA,CAAA,CAAE,MAAA,CAAO,IAAI,KAAA,CAAM,kDAAkD,CAAC,CAAA;AAAA,QACxE,CAAA,MAAA,IAAW,CAAA,CAAE,UAAA,IAAc,CAAC,EAAE,KAAA,EAAO;AACnC,UAAA,IAAI;AACF,YAAA,CAAA,CAAE,UAAA,CAAW,KAAA,CAAM,IAAI,KAAA,CAAM,2BAA2B,CAAC,CAAA;AAAA,UAC3D,CAAA,CAAA,MAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,IAAA,WAAA,CAAY,KAAA,EAAM;AAClB,IAAA,KAAA,MAAW,GAAG,CAAC,CAAA,IAAK,aAAA,EAAe;AACjC,MAAA,YAAA,CAAa,EAAE,KAAK,CAAA;AACpB,MAAA,CAAA,CAAE,MAAA,CAAO,IAAI,KAAA,CAAM,4CAA4C,CAAC,CAAA;AAAA,IAClE;AACA,IAAA,aAAA,CAAc,KAAA,EAAM;AACpB,IAAA,KAAA,MAAW,GAAG,IAAI,CAAA,IAAK,OAAA,EAAS;AAC9B,MAAA,IAAA,CAAK,kBAAA,EAAmB;AAAA,IAC1B;AACA,IAAA,OAAA,CAAQ,KAAA,EAAM;AACd,IAAA,QAAA,EAAS;AACT,IAAA,QAAA,EAAS;AAAA,EACX,CAAC,CAAA;AAED,EAAA,SAAS,cAAc,KAAA,EAA0B;AAC/C,IAAA,QAAQ,MAAM,CAAA;AAAG,MACf,KAAK,OAAA;AACH,QAAA,IAAI,KAAA,CAAM,YAAY,cAAA,EAAgB;AAIpC,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,qBAAA,EAAwB,KAAA,CAAM,OAAO,CAAA,qBAAA,EAAwB,cAAc,CAAA,CAAA;AAAA,WAC7E;AAAA,QACF;AACA,QAAA,KAAA,GAAQ,KAAA;AACR,QAAA;AAAA,MACF,KAAK,SAAA,EAAW;AACd,QAAA,MAAM,OAAA,GAAU,YAAA,CAAa,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AAC7C,QAAA,IAAI,OAAA,EAAS;AACX,UAAA,YAAA,CAAa,MAAA,CAAO,MAAM,MAAM,CAAA;AAChC,UAAA,OAAA,CAAQ,QAAQ,KAAK,CAAA;AAAA,QACvB;AACA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,QAAA,EAAU;AACb,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACzC,QAAA,IAAA,EAAM,YAAA,CAAa,UAAA,CAAY,KAAA,CAAsB,IAAI,CAAC,CAAA;AAC1D,QAAA;AAAA,MACF;AAAA,MACA,KAAK,QAAA,EAAU;AACb,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACzC,QAAA,IAAA,EAAM,YAAA,CAAa,UAAA,CAAY,KAAA,CAAsB,IAAI,CAAC,CAAA;AAC1D,QAAA;AAAA,MACF;AAAA,MACA,KAAK,MAAA,EAAQ;AACX,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACzC,QAAA,IAAA,EAAM,aAAa,KAAkB,CAAA;AACrC,QAAA,WAAA,CAAY,MAAA,CAAO,MAAM,MAAM,CAAA;AAC/B,QAAA;AAAA,MACF;AAAA,MACA,KAAK,OAAA,EAAS;AACZ,QAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,UAAA,MAAM,OAAA,GAAU,YAAA,CAAa,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AAC7C,UAAA,IAAI,OAAA,EAAS;AACX,YAAA,YAAA,CAAa,MAAA,CAAO,MAAM,MAAM,CAAA;AAChC,YAAA,OAAA,CAAQ,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,KAAA,CAAM,OAAO,CAAA,CAAE,CAAC,CAAA;AAC3D,YAAA;AAAA,UACF;AACA,UAAA,MAAM,IAAA,GAAO,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACzC,UAAA,IAAA,EAAM,WAAA,CAAY,IAAI,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,KAAA,CAAM,OAAO,CAAA,CAAE,CAAC,CAAA;AAC9D,UAAA;AAAA,QACF;AAIA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,eAAA,EAAiB;AAEpB,QAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AAC3C,QAAA,IAAI,CAAC,OAAA,EAAS;AACd,QAAA,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA;AAC9B,QAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,QAAA,MAAM,IAAA,GAAO,MAAM,IAAA,GAAO,UAAA,CAAW,MAAM,IAAI,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACjE,QAAA,IAAI,OAAA,CAAQ,SAAS,UAAA,EAAY;AAC/B,UAAA,OAAA,CAAQ,OAAA,CAAQ;AAAA,YACd,QAAQ,KAAA,CAAM,MAAA;AAAA,YACd,OAAA,EAAS,KAAA,CAAM,OAAA,IAAW,EAAC;AAAA,YAC3B,IAAA;AAAA,YACA,GAAI,MAAM,KAAA,GAAQ,EAAE,OAAO,KAAA,CAAM,KAAA,KAAU;AAAC,WAC7C,CAAA;AAAA,QACH,CAAA,MAAO;AAIL,UAAA,MAAM,MAAA,GAAS,IAAI,cAAA,CAA2B;AAAA,YAC5C,MAAM,UAAA,EAAY;AAChB,cAAA,IAAI,IAAA,CAAK,SAAS,CAAA,EAAG,UAAA,CAAW,QAAQ,IAAI,UAAA,CAAW,IAAI,CAAC,CAAA;AAC5D,cAAA,UAAA,CAAW,KAAA,EAAM;AAAA,YACnB;AAAA,WACD,CAAA;AACD,UAAA,OAAA,CAAQ,WAAA,CAAY;AAAA,YAClB,QAAQ,KAAA,CAAM,MAAA;AAAA,YACd,OAAA,EAAS,KAAA,CAAM,OAAA,IAAW,EAAC;AAAA,YAC3B,IAAA,EAAM;AAAA,WACP,CAAA;AAAA,QACH;AACA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,oBAAA,EAAsB;AACzB,QAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AAC3C,QAAA,IAAI,CAAC,OAAA,EAAS;AACd,QAAA,MAAM,OAAA,GAAU,KAAA,CAAM,OAAA,IAAW,EAAC;AAClC,QAAA,IAAI,OAAA,CAAQ,SAAS,QAAA,EAAU;AAI7B,UAAA,MAAM,MAAA,GAAS,IAAI,cAAA,CAA2B;AAAA,YAC5C,MAAM,UAAA,EAAY;AAChB,cAAA,OAAA,CAAQ,UAAA,GAAa,UAAA;AACrB,cAAA,KAAA,MAAW,KAAA,IAAS,QAAQ,aAAA,EAAe;AACzC,gBAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG,UAAA,CAAW,QAAQ,IAAI,UAAA,CAAW,KAAK,CAAC,CAAA;AAAA,cAChE;AACA,cAAA,OAAA,CAAQ,gBAAgB,EAAC;AAAA,YAC3B,CAAA;AAAA,YACA,QAAQ,MAAM;AAMZ,cAAA,IAAI,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,KAAK,MAAM,OAAA,EAAS;AAC5C,gBAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,gBAAA,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA;AAAA,cAChC;AAAA,YACF;AAAA,WACD,CAAA;AACD,UAAA,OAAA,CAAQ,WAAA,GAAc,IAAA;AAGtB,UAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,UAAA,OAAA,CAAQ,WAAA,CAAY;AAAA,YAClB,QAAQ,KAAA,CAAM,MAAA;AAAA,YACd,OAAA;AAAA,YACA,IAAA,EAAM;AAAA,WACP,CAAA;AAAA,QACH,CAAA,MAAO;AAGL,UAAA,OAAA,CAAQ,UAAA,GAAa,EAAE,MAAA,EAAQ,KAAA,CAAM,QAAQ,OAAA,EAAQ;AAAA,QACvD;AACA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,qBAAA,EAAuB;AAC1B,QAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AAC3C,QAAA,IAAI,CAAC,OAAA,EAAS;AACd,QAAA,MAAM,IAAA,GAAO,MAAM,IAAA,GAAO,UAAA,CAAW,MAAM,IAAI,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACjE,QAAA,IAAI,OAAA,CAAQ,SAAS,QAAA,EAAU;AAC7B,UAAA,IAAI,MAAM,KAAA,EAAO;AAEf,YAAA,IAAI;AACF,cAAA,OAAA,CAAQ,UAAA,EAAY,KAAA;AAAA,gBAClB,IAAI,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,KAAA,CAAM,KAAA,CAAM,OAAO,CAAA,CAAE;AAAA,eACzD;AAAA,YACF,CAAA,CAAA,MAAQ;AAAA,YAER;AACA,YAAA,OAAA,CAAQ,KAAA,GAAQ,IAAA;AAChB,YAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,YAAA,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA;AAC9B,YAAA;AAAA,UACF;AACA,UAAA,IAAI,QAAQ,UAAA,EAAY;AACtB,YAAA,IAAI,IAAA,CAAK,SAAS,CAAA,EAAG;AACnB,cAAA,IAAI;AACF,gBAAA,OAAA,CAAQ,UAAA,CAAW,OAAA,CAAQ,IAAI,UAAA,CAAW,IAAI,CAAC,CAAA;AAAA,cACjD,CAAA,CAAA,MAAQ;AAAA,cAER;AAAA,YACF;AACA,YAAA,IAAI,MAAM,GAAA,EAAK;AACb,cAAA,IAAI;AACF,gBAAA,OAAA,CAAQ,WAAW,KAAA,EAAM;AAAA,cAC3B,CAAA,CAAA,MAAQ;AAAA,cAER;AACA,cAAA,OAAA,CAAQ,KAAA,GAAQ,IAAA;AAChB,cAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,cAAA,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA;AAAA,YAChC;AAAA,UACF,CAAA,MAAO;AAEL,YAAA,IAAI,KAAK,MAAA,GAAS,CAAA,EAAG,OAAA,CAAQ,aAAA,CAAc,KAAK,IAAI,CAAA;AACpD,YAAA,IAAI,MAAM,GAAA,EAAK;AAGb,cAAA,OAAA,CAAQ,KAAA,GAAQ,IAAA;AAAA,YAClB;AAAA,UACF;AAAA,QACF,CAAA,MAAO;AAEL,UAAA,IAAI,KAAK,MAAA,GAAS,CAAA,EAAG,OAAA,CAAQ,YAAA,CAAa,KAAK,IAAI,CAAA;AACnD,UAAA,IAAI,MAAM,KAAA,EAAO;AACf,YAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,YAAA,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA;AAC9B,YAAA,MAAM,YAAA,GAAe,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA;AACvD,YAAA,OAAA,CAAQ,OAAA,CAAQ;AAAA,cACd,MAAA,EAAQ,OAAA,CAAQ,UAAA,EAAY,MAAA,IAAU,GAAA;AAAA,cACtC,OAAA,EAAS,OAAA,CAAQ,UAAA,EAAY,OAAA,IAAW,EAAC;AAAA,cACzC,IAAA,EAAM,YAAA;AAAA,cACN,OAAO,KAAA,CAAM;AAAA,aACd,CAAA;AACD,YAAA;AAAA,UACF;AACA,UAAA,IAAI,MAAM,GAAA,EAAK;AACb,YAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,YAAA,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA;AAC9B,YAAA,MAAM,YAAA,GAAe,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA;AACvD,YAAA,OAAA,CAAQ,OAAA,CAAQ;AAAA,cACd,MAAA,EAAQ,OAAA,CAAQ,UAAA,EAAY,MAAA,IAAU,GAAA;AAAA,cACtC,OAAA,EAAS,OAAA,CAAQ,UAAA,EAAY,OAAA,IAAW,EAAC;AAAA,cACzC,IAAA,EAAM;AAAA,aACP,CAAA;AAAA,UACH;AAAA,QACF;AACA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,aAAA,EAAe;AAClB,QAAA,MAAM,OAAA,GAAU,aAAA,CAAc,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AAC7C,QAAA,IAAI,CAAC,OAAA,EAAS;AACd,QAAA,aAAA,CAAc,MAAA,CAAO,MAAM,KAAK,CAAA;AAChC,QAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,QAAA,IAAI,KAAA,CAAM,KAAA,IAAS,KAAA,CAAM,MAAA,KAAW,GAAA,EAAK;AACvC,UAAA,MAAM,OAAO,KAAA,CAAM,KAAA,EAAO,IAAA,IAAQ,CAAA,KAAA,EAAQ,MAAM,MAAM,CAAA,CAAA;AACtD,UAAA,MAAM,MACJ,KAAA,CAAM,KAAA,EAAO,OAAA,IACb,CAAA,6BAAA,EAAgC,MAAM,MAAM,CAAA,CAAA;AAC9C,UAAA,OAAA,CAAQ,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,GAAG,EAAE,CAAC,CAAA;AAC3C,UAAA;AAAA,QACF;AACA,QAAA,MAAM,OAAO,IAAI,mBAAA;AAAA,UACf,KAAA,CAAM,KAAA;AAAA,UACN,MAAM,QAAA,IAAY,IAAA;AAAA,UAClB,IAAA,CAAK,IAAA;AAAA,UACL,MAAM,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,KAAK;AAAA,SAClC;AACA,QAAA,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,KAAA,EAAO,IAAI,CAAA;AAC7B,QAAA,OAAA,CAAQ,QAAQ,IAAI,CAAA;AACpB,QAAA;AAAA,MACF;AAAA,MACA,KAAK,YAAA,EAAc;AACjB,QAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AACpC,QAAA,IAAI,CAAC,IAAA,EAAM;AACX,QAAA,IAAA,CAAK,gBAAgB,UAAA,CAAW,KAAA,CAAM,IAAI,CAAA,EAAG,KAAA,CAAM,WAAW,IAAI,CAAA;AAClE,QAAA;AAAA,MACF;AAAA,MACA,KAAK,UAAA,EAAY;AAGf,QAAA,MAAM,OAAA,GAAU,aAAA,CAAc,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AAC7C,QAAA,IAAI,OAAA,EAAS;AACX,UAAA,aAAA,CAAc,MAAA,CAAO,MAAM,KAAK,CAAA;AAChC,UAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,UAAA,OAAA,CAAQ,MAAA;AAAA,YACN,IAAI,KAAA;AAAA,cACF,CAAA,+BAAA,EAAkC,KAAA,CAAM,IAAI,CAAA,EAAG,KAAA,CAAM,SAAS,CAAA,EAAA,EAAK,KAAA,CAAM,MAAM,CAAA,CAAA,GAAK,EAAE,CAAA,CAAA;AAAA;AACxF,WACF;AACA,UAAA;AAAA,QACF;AACA,QAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AACpC,QAAA,IAAI,IAAA,EAAM;AACR,UAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,KAAK,CAAA;AAC1B,UAAA,IAAA,CAAK,aAAA,CAAc,KAAA,CAAM,IAAA,EAAM,KAAA,CAAM,UAAU,EAAE,CAAA;AAAA,QACnD;AACA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,MAAA;AACH,QAAA,IAAA,CAAK,IAAA,CAAK,KAAK,EAAE,CAAA,EAAG,QAAQ,KAAA,EAAO,KAAA,CAAM,OAAO,CAAA;AAChD,QAAA;AAAA,MACF,KAAK,MAAA;AAAA,MACL,KAAK,OAAA;AAAA,MACL,KAAK,OAAA;AAAA,MACL,KAAK,MAAA;AAAA,MACL,KAAK,QAAA;AAAA,MACL,KAAK,cAAA;AAAA,MACL,KAAK,SAAA;AAEH,QAAA;AAAA;AACJ,EACF;AAEA,EAAA,OAAO;AAAA,IACL,KAAA,GAAQ;AACN,MAAA,IAAI,KAAA,EAAO,OAAO,OAAA,CAAQ,OAAA,CAAQ,KAAK,CAAA;AACvC,MAAA,IAAI,cAAc,OAAO,YAAA;AACzB,MAAA,YAAA,GAAe,IAAI,OAAA,CAAoB,CAAC,OAAA,EAAS,MAAA,KAAW;AAC1D,QAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,UAAA,MAAA;AAAA,YACE,IAAI,KAAA;AAAA,cACF,2CAA2C,cAAc,CAAA,GAAA;AAAA;AAC3D,WACF;AAAA,QACF,GAAG,cAAc,CAAA;AAEjB,QAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,CAAC,KAAA,KAAU;AACvC,UAAA,IAAI,KAAA,CAAM,MAAM,OAAA,EAAS;AACzB,UAAA,YAAA,CAAa,KAAK,CAAA;AAClB,UAAA,GAAA,EAAI;AACJ,UAAA,IAAI,KAAA,CAAM,YAAY,cAAA,EAAgB;AACpC,YAAA,MAAA;AAAA,cACE,IAAI,KAAA;AAAA,gBACF,CAAA,qBAAA,EAAwB,KAAA,CAAM,OAAO,CAAA,gBAAA,EAAmB,cAAc,CAAA,CAAA;AAAA;AACxE,aACF;AACA,YAAA;AAAA,UACF;AACA,UAAA,KAAA,GAAQ,KAAA;AACR,UAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,QACf,CAAC,CAAA;AAAA,MACH,CAAC,CAAA;AACD,MAAA,OAAO,YAAA;AAAA,IACT,CAAA;AAAA,IAEA,MAAM,KAAA,CAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAW;AACpC,MAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAA,CAAK,KAAA,EAAM;AAC7B,MAAA,IAAI,SAAA,EAAW,GAAA,IAAO,KAAA,EAAO,YAAA,CAAa,QAAQ,IAAA,EAAM;AACtD,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,eAAA,EAAkB,KAAA,EAAO,KAAA,IAAS,WAAW,CAAA,iCAAA;AAAA,SAC/C;AAAA,MACF;AACA,MAAA,MAAM,SAAS,UAAA,EAAW;AAC1B,MAAA,MAAM,GAAA,GAAkB;AAAA,QACtB,CAAA,EAAG,OAAA;AAAA,QACH,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA;AAAA,QACA,KAAK,SAAA,EAAW,GAAA;AAAA,QAChB,KAAK,SAAA,EAAW,GAAA;AAAA,QAChB,KAAK,SAAA,EAAW,GAAA;AAAA,QAChB,GAAI,SAAA,EAAW,GAAA,GAAM,EAAE,IAAA,EAAM,SAAA,CAAU,IAAA,IAAQ,EAAA,EAAI,IAAA,EAAM,SAAA,CAAU,IAAA,IAAQ,EAAA,KAAO;AAAC,OACrF;AACA,MAAA,MAAM,YAAA,GAAe,MAAM,IAAI,OAAA;AAAA,QAC7B,CAAC,SAAS,MAAA,KAAW;AACnB,UAAA,YAAA,CAAa,GAAA,CAAI,MAAA,EAAQ,EAAE,OAAA,EAAS,QAAQ,CAAA;AAC5C,UAAA,IAAA,CAAK,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,QACpB;AAAA,OACF;AACA,MAAA,MAAM,OAAO,IAAI,eAAA,CAAgB,QAAQ,YAAA,CAAa,GAAA,EAAK,KAAK,IAAI,CAAA;AACpE,MAAA,WAAA,CAAY,GAAA,CAAI,QAAQ,IAAI,CAAA;AAC5B,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IAEA,MAAM,YAAY,GAAA,EAAqD;AACrE,MAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAA,CAAK,KAAA,EAAM;AAC7B,MAAA,MAAM,QAAQ,UAAA,EAAW;AACzB,MAAA,MAAM,SAAA,GAAY,IAAI,SAAA,IAAa,GAAA;AACnC,MAAA,MAAM,IAAA,GACJ,GAAA,CAAI,IAAA,KAAS,MAAA,GACT,MAAA,GACA,UAAA;AAAA,QACE,OAAO,IAAI,IAAA,KAAS,QAAA,GAAW,IAAI,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,IAAI;AAAA,OAChE;AACN,MAAA,MAAM,KAAA,GAA0B;AAAA,QAC9B,CAAA,EAAG,cAAA;AAAA,QACH,KAAA;AAAA,QACA,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,GAAI,IAAI,OAAA,GAAU,EAAE,SAAS,GAAA,CAAI,OAAA,KAAY,EAAC;AAAA,QAC9C,GAAI,IAAA,KAAS,MAAA,GAAY,EAAE,IAAA,KAAS,EAAC;AAAA,QACrC;AAAA,OACF;AACA,MAAA,OAAO,IAAI,OAAA,CAA4B,CAAC,OAAA,EAAS,MAAA,KAAW;AAI1D,QAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,UAAA,WAAA,CAAY,OAAO,KAAK,CAAA;AACxB,UAAA,MAAA;AAAA,YACE,IAAI,KAAA;AAAA,cACF,CAAA,mBAAA,EAAsB,IAAI,MAAM,CAAA,CAAA,EAAI,IAAI,IAAI,CAAA,kBAAA,EAAqB,YAAY,GAAK,CAAA,GAAA;AAAA;AACpF,WACF;AAAA,QACF,CAAA,EAAG,YAAY,GAAK,CAAA;AACpB,QAAA,WAAA,CAAY,IAAI,KAAA,EAAO;AAAA,UACrB,IAAA,EAAM,UAAA;AAAA,UACN,OAAA;AAAA,UACA,MAAA;AAAA,UACA,KAAA;AAAA,UACA,UAAA,EAAY,IAAA;AAAA,UACZ,cAAc;AAAC,SAChB,CAAA;AACD,QAAA,IAAA,CAAK,IAAA,CAAK,KAAK,KAAK,CAAA;AAAA,MACtB,CAAC,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,MAAM,kBACJ,GAAA,EACmC;AACnC,MAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAA,CAAK,KAAA,EAAM;AAC7B,MAAA,MAAM,QAAQ,UAAA,EAAW;AAMzB,MAAA,MAAM,aAAA,GAAgB,IAAI,SAAA,IAAa,GAAA;AACvC,MAAA,MAAM,IAAA,GACJ,GAAA,CAAI,IAAA,KAAS,MAAA,GACT,MAAA,GACA,UAAA;AAAA,QACE,OAAO,IAAI,IAAA,KAAS,QAAA,GAAW,IAAI,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,IAAI;AAAA,OAChE;AAMN,MAAA,MAAM,KAAA,GAA0B;AAAA,QAC9B,CAAA,EAAG,cAAA;AAAA,QACH,KAAA;AAAA,QACA,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,GAAI,IAAI,OAAA,GAAU,EAAE,SAAS,GAAA,CAAI,OAAA,KAAY,EAAC;AAAA,QAC9C,GAAI,IAAA,KAAS,MAAA,GAAY,EAAE,IAAA,KAAS,EAAC;AAAA,QACrC,SAAA,EAAW,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK;AAAA;AAAA,OAC5B;AACA,MAAA,OAAO,IAAI,OAAA,CAAkC,CAAC,WAAA,EAAa,MAAA,KAAW;AACpE,QAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,UAAA,IAAI,WAAA,CAAY,GAAA,CAAI,KAAK,CAAA,EAAG;AAC1B,YAAA,WAAA,CAAY,OAAO,KAAK,CAAA;AACxB,YAAA,MAAA;AAAA,cACE,IAAI,KAAA;AAAA,gBACF,4BAA4B,GAAA,CAAI,MAAM,IAAI,GAAA,CAAI,IAAI,gCAAgC,aAAa,CAAA,GAAA;AAAA;AACjG,aACF;AAAA,UACF;AAAA,QACF,GAAG,aAAa,CAAA;AAChB,QAAA,WAAA,CAAY,IAAI,KAAA,EAAO;AAAA,UACrB,IAAA,EAAM,QAAA;AAAA,UACN,WAAA;AAAA,UACA,MAAA;AAAA,UACA,KAAA;AAAA,UACA,UAAA,EAAY,IAAA;AAAA,UACZ,eAAe,EAAC;AAAA,UAChB,WAAA,EAAa,KAAA;AAAA,UACb,KAAA,EAAO;AAAA,SACR,CAAA;AACD,QAAA,IAAA,CAAK,IAAA,CAAK,KAAK,KAAK,CAAA;AAAA,MACtB,CAAC,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,MAAM,iBACJ,GAAA,EAC0B;AAC1B,MAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,KAAA,EAAM;AAC3B,MAAA,IAAI,CAAA,CAAE,YAAA,CAAa,SAAA,KAAc,IAAA,EAAM;AACrC,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,eAAA,EAAkB,CAAA,CAAE,KAAA,IAAS,WAAW,CAAA,4FAAA;AAAA,SAC1C;AAAA,MACF;AACA,MAAA,MAAM,QAAQ,UAAA,EAAW;AACzB,MAAA,MAAM,SAAA,GAAY,IAAI,aAAA,IAAiB,GAAA;AACvC,MAAA,MAAM,KAAA,GAAqB;AAAA,QACzB,CAAA,EAAG,SAAA;AAAA,QACH,KAAA;AAAA,QACA,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,GAAI,IAAI,QAAA,GAAW,EAAE,UAAU,GAAA,CAAI,QAAA,KAAa,EAAC;AAAA,QACjD,GAAI,IAAI,OAAA,GAAU,EAAE,SAAS,GAAA,CAAI,OAAA,KAAY,EAAC;AAAA,QAC9C,GAAI,GAAA,CAAI,SAAA,IAAa,GAAA,CAAI,SAAA,CAAU,MAAA,GAAS,CAAA,GACxC,EAAE,SAAA,EAAW,GAAA,CAAI,SAAA,EAAU,GAC3B;AAAC,OACP;AACA,MAAA,OAAO,IAAI,OAAA,CAAyB,CAAC,OAAA,EAAS,MAAA,KAAW;AACvD,QAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,UAAA,IAAI,CAAC,aAAA,CAAc,GAAA,CAAI,KAAK,CAAA,EAAG;AAC/B,UAAA,aAAA,CAAc,OAAO,KAAK,CAAA;AAC1B,UAAA,MAAA;AAAA,YACE,IAAI,KAAA;AAAA,cACF,CAAA,wBAAA,EAA2B,GAAA,CAAI,IAAI,CAAA,qCAAA,EAAwC,SAAS,CAAA,GAAA;AAAA;AACtF,WACF;AAAA,QACF,GAAG,SAAS,CAAA;AACZ,QAAA,aAAA,CAAc,IAAI,KAAA,EAAO,EAAE,OAAA,EAAS,MAAA,EAAQ,OAAO,CAAA;AACnD,QAAA,IAAA,CAAK,IAAA,CAAK,KAAK,KAAK,CAAA;AAAA,MACtB,CAAC,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,MAAM,KAAA,GAAQ;AACZ,MAAA,IAAA,CAAK,IAAA,CAAK,MAAM,cAAc,CAAA;AAAA,IAChC;AAAA,GACF;AACF;AAOA,IAAM,eAAA,GAAN,cAA8B,YAAA,CAA2C;AAAA,EAC9D,MAAA;AAAA,EACT,GAAA;AAAA,EACS,KAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACQ,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EAEjB,WAAA,CAAY,MAAA,EAAgB,GAAA,EAAa,IAAA,EAAiB;AACxD,IAAA,KAAA,EAAM;AACN,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA,GAAM,CAAA,GAAI,GAAA,GAAM,IAAA;AAC3B,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAIZ,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,QAAA,CAAS,EAAE,IAAA,GAAO;AAAA,IAAC,GAAG,CAAA;AACxC,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,QAAA,CAAS,EAAE,IAAA,GAAO;AAAA,IAAC,GAAG,CAAA;AAGxC,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAI,QAAA,CAAS;AAAA,MACxB,KAAA,CAAM,KAAA,EAAwB,IAAA,EAAM,EAAA,EAAI;AACtC,QAAA,IAAA,CAAK,IAAA,CAAK;AAAA,UACR,CAAA,EAAG,OAAA;AAAA,UACH,MAAA;AAAA,UACA,IAAA,EAAM,WAAW,KAAK;AAAA,SACvB,CAAA;AACD,QAAA,EAAA,EAAG;AAAA,MACL,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,MAAM,EAAA,EAAI;AACR,QAAA,IAAA,CAAK,KAAK,EAAE,CAAA,EAAG,SAAS,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAC1C,QAAA,EAAA,EAAG;AAAA,MACL;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAEA,aAAa,GAAA,EAAmB;AAC9B,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,EACtB;AAAA,EAEA,aAAa,GAAA,EAAmB;AAC9B,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,EACtB;AAAA,EAEA,YAAY,GAAA,EAAkB;AAC5B,IAAA,IAAA,CAAK,IAAA,CAAK,SAAS,GAAG,CAAA;AAAA,EACxB;AAAA,EAEA,aAAa,KAAA,EAAwB;AACnC,IAAA,IAAI,KAAK,MAAA,EAAQ;AACjB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AACd,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,IAAI,CAAA;AACrB,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,IAAI,CAAA;AACrB,IAAA,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,KAAA,CAAM,IAAA,EAAM,MAAM,MAAM,CAAA;AAAA,EAC5C;AAAA,EAEA,kBAAA,GAA2B;AACzB,IAAA,IAAI,KAAK,MAAA,EAAQ;AACjB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AACd,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,IAAI,CAAA;AACrB,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,IAAI,CAAA;AACrB,IAAA,IAAA,CAAK,IAAA;AAAA,MACH,MAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA;AAAA,KACF;AAAA,EACF;AAAA,EAEA,IAAA,CAAK,SAAkC,SAAA,EAAoB;AACzD,IAAA,IAAI,IAAA,CAAK,QAAQ,OAAO,KAAA;AACxB,IAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,MACb,CAAA,EAAG,MAAA;AAAA,MACH,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,QAAQ,OAAO,MAAA,KAAW,QAAA,GAAW,MAAA,GAAS,MAAM,MAAM,CAAA;AAAA,KAC3D,CAAA;AACD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAA,CAAO,MAAc,IAAA,EAAoB;AACvC,IAAA,IAAI,KAAK,MAAA,EAAQ;AACjB,IAAA,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,EAAE,CAAA,EAAG,QAAA,EAAU,QAAQ,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,IAAA,EAAM,CAAA;AAAA,EACjE;AACF,CAAA;AAcA,IAAM,sBAAN,MAAqD;AAAA,EAC1C,QAAA;AAAA,EACD,WAAA,GAA6C,MAAA;AAAA,EACpC,KAAA;AAAA,EACA,IAAA;AAAA,EACA,SAAA;AAAA,EACA,gBAAA,uBAAuB,GAAA,EAEtC;AAAA,EACe,cAAA,uBAAqB,GAAA,EAEpC;AAAA,EACe,cAAA,uBAAqB,GAAA,EAA0B;AAAA,EAEhE,WAAA,CACE,KAAA,EACA,QAAA,EACA,IAAA,EACA,SAAA,EACA;AACA,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AAAA,EAEA,IAAI,UAAA,GAA4C;AAC9C,IAAA,OAAO,IAAA,CAAK,WAAA;AAAA,EACd;AAAA,EAEA,KAAK,IAAA,EAAiC;AACpC,IAAA,IAAI,IAAA,CAAK,gBAAgB,MAAA,EAAQ;AACjC,IAAA,MAAM,KAAA,GACJ,OAAO,IAAA,KAAS,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,IAAA,EAAM,MAAM,CAAA,GAAI,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AACzE,IAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,MACb,CAAA,EAAG,YAAA;AAAA,MACH,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,IAAA,EAAM,WAAW,KAAK,CAAA;AAAA,MACtB,MAAA,EAAQ,OAAO,IAAA,KAAS;AAAA,KACzB,CAAA;AAAA,EACH;AAAA,EAEA,KAAA,CAAM,IAAA,GAAe,GAAA,EAAM,MAAA,EAAuB;AAChD,IAAA,IAAI,IAAA,CAAK,gBAAgB,QAAA,EAAU;AACnC,IAAA,IAAI,IAAA,CAAK,gBAAgB,MAAA,EAAQ;AAC/B,MAAA,IAAA,CAAK,WAAA,GAAc,SAAA;AACnB,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,UAAA;AAAA,QACH,OAAO,IAAA,CAAK,KAAA;AAAA,QACZ,IAAA;AAAA,QACA,GAAI,MAAA,GAAS,EAAE,MAAA,KAAW;AAAC,OAC5B,CAAA;AAAA,IACH;AAKA,IAAA,IAAA,CAAK,aAAA,CAAc,IAAA,EAAM,MAAA,IAAU,EAAE,CAAA;AAAA,EACvC;AAAA,EAEA,UACE,QAAA,EACY;AACZ,IAAA,IAAA,CAAK,gBAAA,CAAiB,IAAI,QAAQ,CAAA;AAClC,IAAA,OAAO,MAAM,IAAA,CAAK,gBAAA,CAAiB,MAAA,CAAO,QAAQ,CAAA;AAAA,EACpD;AAAA,EAEA,QAAQ,QAAA,EAA8D;AACpE,IAAA,IAAA,CAAK,cAAA,CAAe,IAAI,QAAQ,CAAA;AAChC,IAAA,OAAO,MAAM,IAAA,CAAK,cAAA,CAAe,MAAA,CAAO,QAAQ,CAAA;AAAA,EAClD;AAAA,EAEA,QAAQ,QAAA,EAA4C;AAClD,IAAA,IAAA,CAAK,cAAA,CAAe,IAAI,QAAQ,CAAA;AAChC,IAAA,OAAO,MAAM,IAAA,CAAK,cAAA,CAAe,MAAA,CAAO,QAAQ,CAAA;AAAA,EAClD;AAAA,EAEA,eAAA,CAAgB,MAAc,QAAA,EAAyB;AACrD,IAAA,IAAI,IAAA,CAAK,gBAAgB,MAAA,EAAQ;AACjC,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,gBAAA,EAAkB;AACrC,MAAA,IAAI;AACF,QAAA,CAAA,CAAE,MAAM,QAAQ,CAAA;AAAA,MAClB,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA,EAEA,aAAA,CAAc,MAAc,MAAA,EAAsB;AAChD,IAAA,IAAI,IAAA,CAAK,gBAAgB,QAAA,EAAU;AACnC,IAAA,IAAA,CAAK,WAAA,GAAc,QAAA;AACnB,IAAA,IAAA,CAAK,SAAA,EAAU;AACf,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,cAAA,EAAgB;AACnC,MAAA,IAAI;AACF,QAAA,CAAA,CAAE,MAAM,MAAM,CAAA;AAAA,MAChB,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,CAAK,iBAAiB,KAAA,EAAM;AAC5B,IAAA,IAAA,CAAK,eAAe,KAAA,EAAM;AAC1B,IAAA,IAAA,CAAK,eAAe,KAAA,EAAM;AAAA,EAC5B;AAAA,EAEA,kBAAA,GAA2B;AACzB,IAAA,IAAI,IAAA,CAAK,gBAAgB,QAAA,EAAU;AACnC,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,cAAA,EAAgB;AACnC,MAAA,IAAI;AACF,QAAA,CAAA,CAAE,IAAI,KAAA,CAAM,uBAAuB,CAAC,CAAA;AAAA,MACtC,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,CAAK,aAAA,CAAc,MAAM,eAAe,CAAA;AAAA,EAC1C;AACF,CAAA;;;AC78BA,IAAM,UAAA,GAAa,CAAA;AAEZ,SAAS,cAAc,EAAA,EAA8B;AAC1D,EAAA,MAAM,aAAA,uBAAoB,GAAA,EAAkC;AAC5D,EAAA,MAAM,aAAA,uBAAoB,GAAA,EAA+B;AACzD,EAAA,IAAI,MAAA,GAAS,GAAG,UAAA,KAAe,UAAA;AAM/B,EAAA,MAAM,SAAA,GAAY,CAAC,EAAA,KAAsD;AACvE,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI,OAAO,EAAA,CAAG,IAAA,KAAS,QAAA,SAAiB,EAAA,CAAG,IAAA;AAAA,SAAA,IAClC,EAAA,CAAG,IAAA,YAAgB,WAAA,EAAa,IAAA,GAAO,MAAA,CAAO,KAAK,EAAA,CAAG,IAAI,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA;AAAA,SAC/E,IAAA,GAAQ,EAAA,CAAG,IAAA,CAAgB,QAAA,CAAS,MAAM,CAAA;AAC/C,IAAA,MAAM,KAAA,GAAQ,WAAW,IAAI,CAAA;AAC7B,IAAA,IAAI,CAAC,KAAA,EAAO;AACZ,IAAA,KAAA,MAAW,CAAA,IAAK,aAAA,EAAe,CAAA,CAAE,KAAK,CAAA;AAAA,EACxC,CAAA;AAEA,EAAA,MAAM,UAAU,MAAY;AAC1B,IAAA,IAAI,CAAC,MAAA,EAAQ;AACb,IAAA,MAAA,GAAS,KAAA;AACT,IAAA,KAAA,MAAW,CAAA,IAAK,aAAA,EAAe,CAAA,CAAE,kBAAkB,CAAA;AACnD,IAAA,aAAA,CAAc,KAAA,EAAM;AACpB,IAAA,aAAA,CAAc,KAAA,EAAM;AAAA,EACtB,CAAA;AAEA,EAAA,MAAM,OAAA,GAAU,CAAC,EAAA,KAAmC;AAClD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACb,IAAA,MAAA,GAAS,KAAA;AACT,IAAA,KAAA,MAAW,CAAA,IAAK,aAAA,EAAe,CAAA,CAAE,EAAA,CAAG,WAAW,iBAAiB,CAAA;AAChE,IAAA,aAAA,CAAc,KAAA,EAAM;AACpB,IAAA,aAAA,CAAc,KAAA,EAAM;AAAA,EACtB,CAAA;AAEA,EAAA,EAAA,CAAG,gBAAA,CAAiB,WAAW,SAAS,CAAA;AACxC,EAAA,EAAA,CAAG,gBAAA,CAAiB,SAAS,OAAO,CAAA;AACpC,EAAA,EAAA,CAAG,gBAAA,CAAiB,SAAS,OAAO,CAAA;AAEpC,EAAA,OAAO;AAAA,IACL,IAAI,MAAA,GAAS;AACX,MAAA,OAAO,MAAA;AAAA,IACT,CAAA;AAAA,IACA,KAAK,KAAA,EAAO;AACV,MAAA,IAAI,CAAC,MAAA,EAAQ;AACb,MAAA,IAAI;AACF,QAAA,EAAA,CAAG,IAAA,CAAK,WAAA,CAAY,KAAK,CAAC,CAAA;AAAA,MAC5B,CAAA,CAAA,MAAQ;AAAA,MAGR;AAAA,IACF,CAAA;AAAA,IACA,MAAM,MAAA,EAAQ;AACZ,MAAA,IAAI,CAAC,MAAA,EAAQ;AACb,MAAA,IAAI;AACF,QAAA,EAAA,CAAG,KAAA,CAAM,KAAM,MAAM,CAAA;AAAA,MACvB,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF,CAAA;AAAA,IACA,QAAQ,OAAA,EAAS;AACf,MAAA,aAAA,CAAc,IAAI,OAAO,CAAA;AACzB,MAAA,OAAO,MAAM,aAAA,CAAc,MAAA,CAAO,OAAO,CAAA;AAAA,IAC3C,CAAA;AAAA,IACA,QAAQ,OAAA,EAAS;AACf,MAAA,aAAA,CAAc,IAAI,OAAO,CAAA;AACzB,MAAA,OAAO,MAAM,aAAA,CAAc,MAAA,CAAO,OAAO,CAAA;AAAA,IAC3C;AAAA,GACF;AACF","file":"index.mjs","sourcesContent":["/**\n * Tunnel frame protocol — agentproto/tunnel/v1.\n *\n * Bidirectional, event-shaped frames over a single duplex transport\n * (typically a WebSocket). Each frame is one JSON object per message.\n * The protocol is deliberately NOT JSON-RPC: process I/O is a\n * continuous event stream, not a request/response pattern, so we drop\n * the `id` / response correlation and let the underlying child-process\n * lifecycle drive everything.\n *\n * # Roles\n *\n *   host    — the orchestrator (e.g. Guilde API). Sends `spawn`,\n *             `stdin`, `kill`, `resize`. Receives `stdout`, `stderr`,\n *             `exit`, `error`. Holds the ACP client; sees the duplex\n *             stream as a `ChildProcess`-shaped duck.\n *\n *   daemon  — the local executor (e.g. `agentproto serve` on a user's\n *             laptop). Receives spawn-side frames; spawns real\n *             subprocesses; relays I/O back. Owns the actual file\n *             system, environment, network egress.\n *\n * # Identifiers\n *\n *   execId  — host-chosen UUID per spawned process. Lets one tunnel\n *             multiplex many concurrent agent CLIs (one daemon serving\n *             several conversations).\n *\n * # Encoding\n *\n *   - Each WS message is one JSON object. Binary frames are not used;\n *     stdout/stdin payloads are base64-encoded utf-safe strings.\n *   - Why base64 and not raw text: claude-code & friends emit JSON-RPC\n *     ACP traffic over stdio. A child can also emit non-utf8 bytes\n *     (debug logs, terminal control codes when in TTY mode). Base64\n *     keeps the wire JSON-clean and bytewise-faithful.\n *   - All frames carry `t` (type) and a per-type payload. Versioning\n *     is per-tunnel via `hello.version`, not per-frame.\n *\n * # Lifecycle\n *\n *   1. Daemon connects to host's WS endpoint with bearer token.\n *   2. Daemon sends `hello { version, capabilities, label? }`.\n *   3. Host sends `spawn` for each child it wants on this daemon.\n *   4. Daemon spawns, replies with `spawned { execId, pid }` (or\n *      `error { execId, message }`).\n *   5. stdout/stderr/exit notifications flow daemon→host;\n *      stdin/resize/kill flow host→daemon.\n *   6. Either side can send `ping`; receiver MUST `pong` back. Used\n *      to detect half-open connections.\n *   7. On disconnect, daemon SHOULD kill all children associated with\n *      this tunnel (host can re-spawn after reconnect).\n */\n\nexport const TUNNEL_VERSION = \"agentproto/tunnel/v1\" as const\n\n// ─── host → daemon ──────────────────────────────────────────────\n\nexport interface SpawnFrame {\n  t: \"spawn\"\n  execId: string\n  command: string\n  args: readonly string[]\n  /**\n   * Working directory on the daemon side. Daemon SHOULD reject\n   * absolute paths that escape its declared `--root` (see\n   * `agentproto serve --root`); host MUST pass paths that exist\n   * on the daemon.\n   */\n  cwd?: string\n  /**\n   * Environment overrides. Daemon merges these atop its own\n   * process.env. Daemon MAY redact values from logs but MUST forward\n   * them verbatim into the child.\n   */\n  env?: Readonly<Record<string, string>>\n  /**\n   * When true, the daemon allocates a PTY instead of plain pipes.\n   * Required for binaries that detect `isTTY` (REPLs, claude\n   * interactive). When false (default), stdin/stdout/stderr are\n   * separate pipes — the right choice for ACP wrappers that speak\n   * line-delimited JSON-RPC.\n   */\n  pty?: boolean\n  /** Initial PTY column width. Ignored when `pty` is false. Default 80. */\n  cols?: number\n  /** Initial PTY row height. Ignored when `pty` is false. Default 24. */\n  rows?: number\n}\n\nexport interface StdinFrame {\n  t: \"stdin\"\n  execId: string\n  /** Base64-encoded payload bytes. Empty string is a no-op. */\n  data: string\n}\n\nexport interface KillFrame {\n  t: \"kill\"\n  execId: string\n  /** Default \"SIGTERM\". POSIX names; Windows daemons translate. */\n  signal?: string\n}\n\nexport interface ResizeFrame {\n  t: \"resize\"\n  execId: string\n  cols: number\n  rows: number\n}\n\n/**\n * Generic HTTP-over-tunnel request (HOST → DAEMON). Lets the host\n * proxy arbitrary HTTP traffic (MCP JSON-RPC today, anything tomorrow)\n * through the daemon's local network stack without exposing a public\n * URL. The daemon forwards to its configured \"http upstream\" (default:\n * its own gateway on `127.0.0.1:<port>`) and replies with an\n * `HttpResponseFrame` carrying the same `reqId`.\n */\nexport interface HttpRequestFrame {\n  t: \"http_request\"\n  /** Correlates the response. Host-chosen, MUST be unique per inflight request. */\n  reqId: string\n  /** HTTP method (GET / POST / PUT / DELETE / PATCH / OPTIONS). */\n  method: string\n  /** Path + querystring, e.g. `/mcp` or `/mcp?session=abc`.\n   *  Daemon prepends its upstream base. Absolute URLs are rejected. */\n  path: string\n  /** Forwarded request headers. Hop-by-hop headers (Connection,\n   *  Keep-Alive, Transfer-Encoding, Upgrade, Proxy-*) MUST be stripped\n   *  before forwarding; daemon SHOULD also drop them defensively. */\n  headers?: Readonly<Record<string, string>>\n  /** Base64-encoded request body. Omitted when no body. */\n  body?: string\n  /** Per-request timeout in ms. Daemon SHOULD enforce + reply with\n   *  `error: { code: \"timeout\" }` when exceeded. Default 30_000. */\n  timeoutMs?: number\n}\n\n/**\n * Generic HTTP-over-tunnel response (DAEMON → HOST). Mirrors\n * `HttpRequestFrame` — see its docs.\n *\n * Two-frame protocol:\n *   - SHORT RESPONSES (most HTTP): daemon emits a single `http_response`\n *     with body inline. The buffered `forwardHttp` resolves directly\n *     from this frame.\n *   - STREAMED RESPONSES (text/event-stream, long-lived chunked\n *     transfers, large downloads): daemon emits `http_response_head`\n *     first with status+headers, then one or more `http_response_chunk`\n *     frames, the last of which has `end: true`. The streaming\n *     `forwardHttpStream` builds a `ReadableStream` from the chunks.\n *\n * Hosts that only support the legacy buffered API can detect the\n * stream protocol by looking for `http_response_head` and either\n * pull the chunks into a buffer (compat) or refuse to handle.\n */\nexport interface HttpResponseFrame {\n  t: \"http_response\"\n  reqId: string\n  /** HTTP status code (e.g. 200, 404, 500). Set even on transport\n   *  failure (then `error` is also set and status SHOULD be 502/504). */\n  status: number\n  headers?: Readonly<Record<string, string>>\n  /** Base64-encoded response body. */\n  body?: string\n  /** Set when the daemon failed to complete the upstream call. */\n  error?: Readonly<{\n    code: string\n    message: string\n  }>\n}\n\n/**\n * Streaming HTTP response head (DAEMON → HOST). Sent ONCE per\n * streaming response, before any chunk frames. Carries status +\n * headers so the host can finalize the response shape (e.g. write\n * Content-Type) before any body bytes arrive.\n */\nexport interface HttpResponseHeadFrame {\n  t: \"http_response_head\"\n  reqId: string\n  status: number\n  headers?: Readonly<Record<string, string>>\n}\n\n/**\n * Streaming HTTP response body chunk (DAEMON → HOST). Each chunk\n * carries some bytes of the response body. The terminal chunk has\n * `end: true` and MAY include final bytes. An immediate `end: true`\n * with no data signals empty-body close.\n *\n * `error` set on a chunk frame indicates the daemon's upstream\n * failed mid-stream; host SHOULD propagate it as a stream error.\n */\nexport interface HttpResponseChunkFrame {\n  t: \"http_response_chunk\"\n  reqId: string\n  /** Base64-encoded chunk bytes. Omitted on pure end-of-stream\n   *  markers (those carry `end: true` only). */\n  data?: string\n  /** Set on the last chunk. After this frame the host SHOULD ignore\n   *  any further frames for this reqId. */\n  end?: boolean\n  /** Set when the upstream failed mid-stream. Host surfaces this as\n   *  a stream error and closes the readable. */\n  error?: Readonly<{\n    code: string\n    message: string\n  }>\n}\n\n// ─── daemon → host ──────────────────────────────────────────────\n\nexport interface HelloFrame {\n  t: \"hello\"\n  version: typeof TUNNEL_VERSION\n  /**\n   * Daemon-declared capabilities. Hosts MAY refuse to dispatch\n   * features the daemon hasn't claimed.\n   */\n  capabilities: Readonly<{\n    pty: boolean\n    /** Daemon can bridge browser-WS upgrades to its local upstream via\n     *  `ws_open` / `ws_message` / `ws_close`. Hosts MUST gate\n     *  `forwardWebSocket()` on this — older daemons ignore the frames. */\n    wsForward?: boolean\n    /**\n     * Identifiers of the capabilities the daemon serves — its registered\n     * agent adapters / tool surfaces. Lets a host that fronts several\n     * daemons enumerate and route by what each one can do, without a\n     * round-trip. Omitted by older daemons (host treats as \"unknown\",\n     * not \"none\"). Advisory: the authoritative surface is still the\n     * daemon's live `tools/list` over the HTTP relay.\n     */\n    tools?: ReadonlyArray<string>\n    /** Future: file-transfer, port-forward, etc. */\n  }>\n  /** User-friendly daemon label, surfaced in host UIs. */\n  label?: string\n  /** Daemon process info — diagnostics only, not authoritative. */\n  daemon?: Readonly<{\n    name: string\n    version: string\n    platform: string\n    nodeVersion?: string\n  }>\n}\n\nexport interface SpawnedFrame {\n  t: \"spawned\"\n  execId: string\n  pid: number\n}\n\nexport interface StdoutFrame {\n  t: \"stdout\"\n  execId: string\n  /** Base64-encoded payload bytes. */\n  data: string\n}\n\nexport interface StderrFrame {\n  t: \"stderr\"\n  execId: string\n  /** Base64-encoded payload bytes. */\n  data: string\n}\n\nexport interface ExitFrame {\n  t: \"exit\"\n  execId: string\n  /** Null when killed by signal. */\n  code: number | null\n  /** POSIX signal name when killed by signal; null otherwise. */\n  signal: string | null\n}\n\n// ─── either direction ───────────────────────────────────────────\n\nexport interface ErrorFrame {\n  t: \"error\"\n  /** Omitted for tunnel-level errors not tied to a specific exec. */\n  execId?: string\n  /** Stable machine-readable code, e.g. \"spawn_failed\", \"unknown_exec\". */\n  code: string\n  /** Human-readable diagnostic. */\n  message: string\n}\n\nexport interface PingFrame {\n  t: \"ping\"\n  /** Echoed verbatim in the matching pong. */\n  nonce: string\n}\n\nexport interface PongFrame {\n  t: \"pong\"\n  nonce: string\n}\n\n/**\n * HOST → DAEMON. Graceful drain signal sent during host rollover (e.g.\n * Kubernetes preStop). On receipt the daemon SHOULD:\n *   1. Stop accepting new in-flight work where it can.\n *   2. Close the WS cleanly (does not need to wait — host will follow\n *      up with a `close(1012, \"service_restart\")` ~2 s later as a\n *      hard backstop).\n *   3. Reconnect IMMEDIATELY without the usual exponential backoff —\n *      the host is mid-deploy, the new replica is already listening.\n *\n * Backward-compatible: daemons that don't know the frame just ignore\n * it (parseFrame returns null for unknown types). The host's close\n * then triggers the daemon's normal backoff loop — worst case ~30 s\n * reconnect gap instead of ~2 s with the handler.\n */\nexport interface ReconnectSoonFrame {\n  t: \"reconnect_soon\"\n  /** Hint of how long the host plans to wait before forcing close.\n   *  Optional — daemons MAY use it to decide whether to finish\n   *  in-flight work or close immediately. */\n  reasonMs?: number\n}\n\n// ─── WebSocket forwarding ───────────────────────────────────────\n//\n// Mirrors the HTTP-forwarding shape but for full-duplex upgrades.\n// The daemon opens a WS connection to its local upstream (typically\n// `ws://127.0.0.1:<port>${path}`), then proxies frames in both\n// directions. Each open is correlated by `reqId`.\n//\n// Capabilities: daemons MUST set `hello.capabilities.wsForward = true`\n// to opt in. Hosts that don't see it MUST NOT send `ws_open`. Older\n// daemons silently ignore unknown frames, so misrouted `ws_open` on a\n// non-capable daemon is benign (the host's open will time out).\n\n/**\n * HOST → DAEMON. Open a WS connection to the daemon's upstream.\n * Path semantics match `HttpRequestFrame` — absolute URLs rejected,\n * daemon prepends its `ws://<upstream>` base. Headers forwarded as-is\n * (cookies are typically NOT forwarded since the daemon's upstream is\n * loopback; cookie passthrough is opt-in via daemon config).\n */\nexport interface WsOpenFrame {\n  t: \"ws_open\"\n  /** Correlates every WS frame in both directions for this connection. */\n  reqId: string\n  /** Path + querystring on the daemon-local upstream, e.g.\n   *  `/sessions/abc/pty?cols=80&rows=24`. */\n  path: string\n  /** Optional registered upstream to dial instead of the daemon's\n   *  default gateway — a NAME the daemon resolves to a base URL (never\n   *  a URL itself, so the host can't point the daemon at an arbitrary\n   *  origin). Used to reach an imported local service (e.g. a browser\n   *  capability server) by alias. Absent ⇒ the daemon's own gateway. */\n  upstream?: string\n  /** Headers to set on the upstream WS request. Hop-by-hop headers\n   *  (Connection, Upgrade, Sec-WebSocket-*) MUST be stripped — the\n   *  daemon's `ws` client manages those. */\n  headers?: Readonly<Record<string, string>>\n  /** Subprotocols requested by the browser; forwarded to upstream. */\n  protocols?: readonly string[]\n}\n\n/**\n * DAEMON → HOST. Result of a `ws_open`. On success the upstream WS is\n * connected and frames can flow. On failure `error` is set; no further\n * frames for this `reqId` will arrive.\n */\nexport interface WsOpenAckFrame {\n  t: \"ws_open_ack\"\n  reqId: string\n  /** HTTP status from the upstream upgrade. 101 on success; 4xx/5xx\n   *  when the upstream refused the upgrade. */\n  status: number\n  /** Selected subprotocol, if any. */\n  protocol?: string\n  /** Set when the daemon couldn't open the upstream (DNS failure,\n   *  refused, timeout). Distinct from a clean upstream-side close,\n   *  which arrives as `ws_close`. */\n  error?: Readonly<{\n    code: string\n    message: string\n  }>\n}\n\n/**\n * Either direction. One application-level WS frame's payload. Text\n * frames carry UTF-8 bytes (`binary: false`); binary frames carry\n * arbitrary bytes (`binary: true`). The `data` field is base64-encoded\n * either way so the transport stays JSON.\n */\nexport interface WsMessageFrame {\n  t: \"ws_message\"\n  reqId: string\n  /** Base64-encoded WS frame payload. */\n  data: string\n  /** True for binary frames; false (or omitted) for text. */\n  binary?: boolean\n}\n\n/**\n * Either direction. Close the bridged WS connection. Includes the\n * close code (1000 normal, 1006 abnormal, etc.) and optional reason.\n * After sending or receiving this frame, neither side will send\n * further frames for `reqId`.\n */\nexport interface WsCloseFrame {\n  t: \"ws_close\"\n  reqId: string\n  /** WebSocket close code. */\n  code: number\n  reason?: string\n}\n\n// ─── union + guards ─────────────────────────────────────────────\n\nexport type HostToDaemonFrame =\n  | SpawnFrame\n  | StdinFrame\n  | KillFrame\n  | ResizeFrame\n  | HttpRequestFrame\n  | WsOpenFrame\n  | WsMessageFrame\n  | WsCloseFrame\n  | PingFrame\n  | PongFrame\n  | ErrorFrame\n  | ReconnectSoonFrame\n\nexport type DaemonToHostFrame =\n  | HelloFrame\n  | SpawnedFrame\n  | StdoutFrame\n  | StderrFrame\n  | ExitFrame\n  | HttpResponseFrame\n  | HttpResponseHeadFrame\n  | HttpResponseChunkFrame\n  | WsOpenAckFrame\n  | WsMessageFrame\n  | WsCloseFrame\n  | PingFrame\n  | PongFrame\n  | ErrorFrame\n\nexport type TunnelFrame = HostToDaemonFrame | DaemonToHostFrame\n\nconst KNOWN_TYPES = new Set<TunnelFrame[\"t\"]>([\n  \"spawn\",\n  \"stdin\",\n  \"kill\",\n  \"resize\",\n  \"http_request\",\n  \"http_response\",\n  \"http_response_head\",\n  \"http_response_chunk\",\n  \"ws_open\",\n  \"ws_open_ack\",\n  \"ws_message\",\n  \"ws_close\",\n  \"ping\",\n  \"pong\",\n  \"error\",\n  \"hello\",\n  \"spawned\",\n  \"stdout\",\n  \"stderr\",\n  \"exit\",\n  \"reconnect_soon\",\n])\n\n/**\n * Parse a raw WS message into a `TunnelFrame`. Returns null when the\n * payload isn't a valid frame — callers MUST handle null defensively\n * (typically: send an `error` frame and ignore). We don't throw so\n * one bad frame can't tear down the tunnel.\n */\nexport function parseFrame(raw: string): TunnelFrame | null {\n  let parsed: unknown\n  try {\n    parsed = JSON.parse(raw)\n  } catch {\n    return null\n  }\n  if (\n    !parsed ||\n    typeof parsed !== \"object\" ||\n    !(\"t\" in parsed) ||\n    typeof (parsed as { t: unknown }).t !== \"string\"\n  ) {\n    return null\n  }\n  const t = (parsed as { t: string }).t\n  if (!KNOWN_TYPES.has(t as TunnelFrame[\"t\"])) return null\n  return parsed as TunnelFrame\n}\n\nexport function encodeFrame(frame: TunnelFrame): string {\n  return JSON.stringify(frame)\n}\n\n/**\n * Encode raw bytes for an `stdin` / `stdout` / `stderr` frame's `data`\n * field. Centralised so both sides agree on the encoding.\n */\nexport function encodeData(bytes: Uint8Array | string): string {\n  const buf =\n    typeof bytes === \"string\" ? Buffer.from(bytes, \"utf8\") : Buffer.from(bytes)\n  return buf.toString(\"base64\")\n}\n\nexport function decodeData(data: string): Buffer {\n  return Buffer.from(data, \"base64\")\n}\n","/**\n * Tunnel server (daemon side).\n *\n * Sits on the local machine that actually owns the binaries (e.g. the\n * user's laptop running `agentproto serve`). Accepts spawn frames from\n * a remote host, spawns the requested child via node:child_process,\n * pipes stdio back as `stdout`/`stderr` frames, and reports lifecycle\n * via `spawned`/`exit`/`error`.\n *\n * Transport-agnostic: the caller passes a `FrameSink`. For WebSocket\n * callers, see `wrapWebSocket()` in ./ws-adapter.ts.\n *\n * Security: this process MUST refuse spawn requests by default unless\n * the caller installed an `authorize(spawn)` hook. We don't expose a\n * \"trust everything\" mode — every host integration is responsible for\n * deciding what the remote may exec. The hook gets the full SpawnFrame\n * and can mutate it (e.g. force `cwd` into a workspace) or reject.\n */\n\nimport { spawn, type ChildProcess } from \"node:child_process\"\nimport { hostname, platform } from \"node:os\"\nimport {\n  TUNNEL_VERSION,\n  decodeData,\n  encodeData,\n  encodeFrame,\n  parseFrame,\n  type ExitFrame,\n  type HttpRequestFrame,\n  type HttpResponseFrame,\n  type SpawnFrame,\n  type StderrFrame,\n  type StdoutFrame,\n  type TunnelFrame,\n  type WsOpenFrame,\n} from \"./frames.js\"\nimport type { FrameSink } from \"./transport.js\"\n\n/**\n * Default ceiling for an upstream WS dial. An upstream that accepts the TCP\n * connection but never completes (or rejects) the WebSocket upgrade would\n * otherwise leave the `ws_open` pending forever — the host never gets an ack or\n * a reject. Bounded so a hung upstream surfaces as a 504 instead.\n */\nexport const DEFAULT_WS_DIAL_TIMEOUT_MS = 10_000\n\n/**\n * Default ceiling for an `http_request` forward when the frame carries no\n * `timeoutMs`. Covers connect + buffered body (or connect + headers for a\n * stream, after which the bound is handed to `httpStreamIdleTimeoutMs`).\n */\nexport const DEFAULT_HTTP_FORWARD_TIMEOUT_MS = 30_000\n\nexport interface TunnelServerOptions {\n  sink: FrameSink\n  /**\n   * Authorization hook. Called for each `spawn` frame BEFORE the\n   * subprocess is created. Return the (possibly mutated) frame to\n   * proceed; throw or return null to reject. Rejection causes an\n   * `error` frame with code \"spawn_unauthorized\".\n   *\n   * No default — callers MUST decide. Pass `(req) => req` to allow\n   * everything (useful for tests; never for production).\n   */\n  authorize: (req: SpawnFrame) => SpawnFrame | null | Promise<SpawnFrame | null>\n  /**\n   * Upstream HTTP base URL for `http_request` frames. The daemon\n   * appends the frame's `path` and forwards. Typically the local\n   * gateway address — `http://127.0.0.1:18790`. When omitted, the\n   * daemon replies to any `http_request` with\n   * `error: { code: \"http_upstream_not_configured\" }`.\n   */\n  httpUpstream?: string\n  /**\n   * Default ceiling for an `http_request` forward (connect + buffered body, or\n   * connect + headers for a stream) when the frame carries no `timeoutMs`.\n   * Defaults to DEFAULT_HTTP_FORWARD_TIMEOUT_MS. Disarmed once a streaming\n   * response is detected — see `httpStreamIdleTimeoutMs` for the stream phase.\n   */\n  httpForwardTimeoutMs?: number\n  /**\n   * Idle ceiling between chunks of a STREAMING response (SSE / ndjson). A\n   * stalled upstream that sends headers then hangs forever between chunks would\n   * otherwise block indefinitely (the regular timeout is disarmed for streams,\n   * since they're long-lived by design). Counts time since the last byte and\n   * resets on every chunk, so a heartbeating stream is never cut. Omitted ⇒ no\n   * idle bound (current behaviour); set it to guard against silent stalls.\n   */\n  httpStreamIdleTimeoutMs?: number\n  /** User-friendly label sent in the hello frame. */\n  label?: string\n  /**\n   * Capability identifiers advertised in the hello frame — the agent\n   * adapters / tool surfaces this daemon serves (e.g. the gateway's\n   * registered adapter ids). Lets a multi-daemon host enumerate and\n   * route by capability without a round-trip. Omit to advertise none.\n   */\n  tools?: ReadonlyArray<string>\n  /**\n   * Whether this daemon advertises PTY support. Set to true only when\n   * `spawnPty` is also provided.\n   */\n  pty?: boolean\n  /**\n   * Factory for PTY-backed processes. When provided (and `pty: true`),\n   * spawn frames with `pty: true` use this instead of node:child_process.\n   * Injected from the CLI layer so the ACP package stays native-free.\n   */\n  spawnPty?: (opts: {\n    command: string\n    args: string[]\n    cwd?: string\n    env?: Record<string, string>\n    cols: number\n    rows: number\n  }) => PtyProcess\n  /**\n   * Optional hook fired once per successful spawn — after authorize\n   * passed and the ChildProcess has emitted its `spawn` event.\n   * Lets the daemon adopt this child into a higher-level registry\n   * (e.g. @agentproto/runtime's sessions registry, AIP-46) so the\n   * spawn shows up in /sessions, the LocalDaemonSessionsCard, and\n   * the CLI TUI alongside spawns originated locally.\n   *\n   * The hook is fire-and-forget — the tunnel doesn't await its\n   * return. Errors from the hook are swallowed so an observer\n   * registry hiccup never breaks the tunnel exchange.\n   */\n  onChildSpawned?: (info: {\n    execId: string\n    child: ChildProcess\n    request: SpawnFrame\n  }) => void\n  /**\n   * Optional hook fired when the host sends a `reconnect_soon` frame —\n   * graceful drain signal during host rollover. The daemon SHOULD\n   * close + reconnect immediately (skipping any backoff) so the new\n   * host replica picks it up. Default: ignore (the host follows up\n   * with `close(1012)` and the daemon's own reconnect supervisor\n   * handles it via normal backoff, ~30 s gap).\n   *\n   * Implementations typically call into their connection supervisor\n   * to mark the next reconnect as \"no-backoff\" then close the sink.\n   * `reasonMs` is the host's hint for how long it will wait before\n   * forcing close — daemons MAY use it to drain in-flight RPCs first.\n   */\n  onReconnectSoon?: (info: { reasonMs?: number }) => void\n  /**\n   * Factory that dials a WS connection to the local upstream. When\n   * provided (and `httpUpstream` is set), the daemon advertises\n   * `wsForward` capability and handles `ws_open` frames by piping the\n   * upstream WS through the tunnel. Injected so `@agentproto/acp`\n   * stays free of a hard `ws` dependency — the CLI provides this\n   * factory using its already-pulled-in `ws` package.\n   */\n  dialUpstreamWs?: (params: {\n    url: string\n    protocols?: readonly string[]\n    headers?: Readonly<Record<string, string>>\n    /**\n     * Aborted when the dial exceeds `wsDialTimeoutMs` (or the tunnel tears down\n     * mid-dial). A cooperating implementation SHOULD abort the in-flight upgrade\n     * and reject so the socket isn't left half-open; even if it doesn't, the\n     * server bounds the wait independently and rejects the `ws_open`.\n     */\n    signal?: AbortSignal\n  }) => Promise<UpstreamWebSocket>\n  /**\n   * Ceiling for `dialUpstreamWs` to resolve before the `ws_open` is rejected\n   * with 504 `upstream_ws_timeout`. Defaults to DEFAULT_WS_DIAL_TIMEOUT_MS.\n   */\n  wsDialTimeoutMs?: number\n  /**\n   * Resolve a named upstream (a `ws_open` frame's `upstream` field) to an\n   * HTTP base URL the daemon should dial instead of `httpUpstream`. Lets a\n   * host reach an imported local service by alias (e.g. a browser capability\n   * server) without ever naming a raw origin — the daemon owns the name→URL\n   * mapping. Return undefined for an unknown alias (the open is rejected).\n   * Omitted ⇒ every `ws_open` dials the default `httpUpstream`.\n   */\n  resolveWsUpstream?: (\n    upstream: string\n  ) => string | undefined | Promise<string | undefined>\n}\n\n/**\n * Minimal upstream WS surface — satisfied by the `ws` library's\n * client socket. Daemons supplying `dialUpstreamWs` resolve into\n * one of these as soon as the WS is OPEN. `protocol` is the\n * subprotocol negotiated by the upstream (empty string when none).\n */\nexport interface UpstreamWebSocket {\n  readonly protocol: string\n  /** Send a frame to the upstream. */\n  send(data: Buffer | string, opts: { binary: boolean }): void\n  /** Close the upstream connection. */\n  close(code?: number, reason?: string): void\n  /** Subscribe to inbound frames. */\n  onMessage(handler: (data: Buffer, isBinary: boolean) => void): void\n  /** Subscribe to upstream close. */\n  onClose(handler: (code: number, reason: string) => void): void\n  /** Subscribe to transport errors. */\n  onError(handler: (err: Error) => void): void\n}\n\n/** Minimal PTY process surface — satisfied by node-pty's IPty. */\nexport interface PtyProcess {\n  readonly pid: number\n  write(data: string): void\n  resize(cols: number, rows: number): void\n  kill(signal?: string): void\n  onData(handler: (data: string) => void): void\n  onExit(handler: (event: { exitCode: number; signal?: number }) => void): void\n}\n\nexport interface TunnelServer {\n  /** Currently-live execId → ChildProcess. Read-only diagnostic. */\n  readonly children: ReadonlyMap<string, ChildProcess>\n  /** Kill all live children and close the sink. */\n  close(): Promise<void>\n}\n\nexport function createTunnelServer(opts: TunnelServerOptions): TunnelServer {\n  const children = new Map<string, ChildProcess>()\n  // PTY-backed processes keyed by execId (separate from pipe-based children).\n  const ptyProcs = new Map<string, PtyProcess>()\n  // Per-reqId map of bridged upstream WS connections. Each entry's\n  // lifecycle starts at ws_open (we send open_ack on success) and ends\n  // at ws_close (either direction). On tunnel teardown we close all.\n  const upstreamWs = new Map<string, UpstreamWebSocket>()\n  let closed = false\n\n  // Greet the host immediately so it can fail fast on version\n  // mismatch before issuing spawns.\n  opts.sink.send({\n    t: \"hello\",\n    version: TUNNEL_VERSION,\n    capabilities: {\n      pty: opts.pty === true,\n      wsForward: opts.dialUpstreamWs !== undefined && !!opts.httpUpstream,\n      ...(opts.tools && opts.tools.length ? { tools: opts.tools } : {}),\n    },\n    label: opts.label,\n    daemon: {\n      name: \"agentproto\",\n      version: \"0.1.0-alpha\",\n      platform: `${platform()}/${hostname()}`,\n      nodeVersion: process.version,\n    },\n  })\n\n  const offFrame = opts.sink.onFrame((frame) => {\n    handleFrame(frame).catch((err) => {\n      const message = err instanceof Error ? err.message : String(err)\n      opts.sink.send({ t: \"error\", code: \"internal\", message })\n    })\n  })\n\n  const offClose = opts.sink.onClose(() => {\n    closed = true\n    for (const [, child] of children) child.kill(\"SIGTERM\")\n    children.clear()\n    for (const [, pty] of ptyProcs) pty.kill()\n    ptyProcs.clear()\n    for (const [, ws] of upstreamWs) {\n      try {\n        ws.close(1001, \"tunnel_closed\")\n      } catch {\n        /* socket may already be dead */\n      }\n    }\n    upstreamWs.clear()\n    offFrame()\n    offClose()\n  })\n\n  async function handleFrame(frame: TunnelFrame): Promise<void> {\n    switch (frame.t) {\n      case \"spawn\":\n        await handleSpawn(frame)\n        return\n      case \"stdin\": {\n        const pty = ptyProcs.get(frame.execId)\n        if (pty) {\n          pty.write(Buffer.from(frame.data, \"base64\").toString(\"utf8\"))\n          return\n        }\n        const child = children.get(frame.execId)\n        if (!child || !child.stdin) {\n          opts.sink.send({\n            t: \"error\",\n            execId: frame.execId,\n            code: \"unknown_exec\",\n            message: `No live exec '${frame.execId}'`,\n          })\n          return\n        }\n        child.stdin.write(Buffer.from(frame.data, \"base64\"))\n        return\n      }\n      case \"kill\": {\n        const pty = ptyProcs.get(frame.execId)\n        if (pty) {\n          pty.kill(frame.signal ?? \"SIGTERM\")\n          return\n        }\n        const child = children.get(frame.execId)\n        if (!child) {\n          opts.sink.send({\n            t: \"error\",\n            execId: frame.execId,\n            code: \"unknown_exec\",\n            message: `No live exec '${frame.execId}'`,\n          })\n          return\n        }\n        child.kill((frame.signal as NodeJS.Signals | undefined) ?? \"SIGTERM\")\n        return\n      }\n      case \"resize\": {\n        ptyProcs.get(frame.execId)?.resize(frame.cols, frame.rows)\n        return\n      }\n      case \"http_request\":\n        // Fire-and-forget — the handler emits its own http_response\n        // frame (or error). Errors that escape handleHttpRequest\n        // bubble to the outer .catch and become a generic `error`\n        // frame, but the per-request error path inside the handler\n        // produces an http_response with `error:` set, which is what\n        // the host's forwardHttp expects.\n        await handleHttpRequest(frame)\n        return\n      case \"ws_open\":\n        await handleWsOpen(frame)\n        return\n      case \"ws_message\": {\n        const ws = upstreamWs.get(frame.reqId)\n        if (!ws) {\n          // Stale frame for a closed bridge — silently drop. Sending\n          // an error frame would race with our own ws_close on the\n          // teardown path.\n          return\n        }\n        try {\n          ws.send(decodeData(frame.data), { binary: frame.binary === true })\n        } catch (err) {\n          const message = err instanceof Error ? err.message : String(err)\n          opts.sink.send({\n            t: \"ws_close\",\n            reqId: frame.reqId,\n            code: 1011,\n            reason: `send_failed: ${message}`,\n          })\n          try {\n            ws.close(1011, \"send_failed\")\n          } catch {\n            /* defensive */\n          }\n          upstreamWs.delete(frame.reqId)\n        }\n        return\n      }\n      case \"ws_close\": {\n        const ws = upstreamWs.get(frame.reqId)\n        if (!ws) return\n        upstreamWs.delete(frame.reqId)\n        try {\n          ws.close(frame.code, frame.reason)\n        } catch {\n          /* socket may already be dead */\n        }\n        return\n      }\n      case \"ping\":\n        opts.sink.send({ t: \"pong\", nonce: frame.nonce })\n        return\n      case \"reconnect_soon\":\n        // Host is shutting down this replica (e.g. k8s preStop). Fire\n        // the supervisor hook so the daemon CLI can drop the WS +\n        // reconnect without exponential backoff. We do NOT close the\n        // sink here — that's the supervisor's call (it may want to\n        // drain in-flight RPCs first using the `reasonMs` hint).\n        try {\n          opts.onReconnectSoon?.({\n            ...(frame.reasonMs !== undefined ? { reasonMs: frame.reasonMs } : {}),\n          })\n        } catch {\n          /* defensive — supervisor hook must never break the tunnel */\n        }\n        return\n      case \"pong\":\n      case \"error\":\n        // Daemon doesn't act on these; host-side concern.\n        return\n      default:\n        opts.sink.send({\n          t: \"error\",\n          code: \"unknown_frame\",\n          message: `Daemon received unexpected frame type '${(frame as { t: string }).t}'`,\n        })\n    }\n  }\n\n  async function handleSpawn(req: SpawnFrame): Promise<void> {\n    if (closed) return\n    let approved: SpawnFrame | null\n    try {\n      approved = await opts.authorize(req)\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err)\n      opts.sink.send({\n        t: \"error\",\n        execId: req.execId,\n        code: \"spawn_unauthorized\",\n        message,\n      })\n      return\n    }\n    if (!approved) {\n      opts.sink.send({\n        t: \"error\",\n        execId: req.execId,\n        code: \"spawn_unauthorized\",\n        message: \"Authorize hook rejected the spawn request.\",\n      })\n      return\n    }\n\n    // PTY path — use injected spawnPty factory when pty:true is requested.\n    if (approved.pty && opts.spawnPty) {\n      let pty: PtyProcess\n      try {\n        pty = opts.spawnPty({\n          command: approved.command,\n          args: [...approved.args],\n          cwd: approved.cwd,\n          env: approved.env ? { ...approved.env } : undefined,\n          cols: approved.cols ?? 80,\n          rows: approved.rows ?? 24,\n        })\n      } catch (err) {\n        const message = err instanceof Error ? err.message : String(err)\n        opts.sink.send({ t: \"error\", execId: req.execId, code: \"spawn_failed\", message })\n        return\n      }\n\n      ptyProcs.set(req.execId, pty)\n      opts.sink.send({ t: \"spawned\", execId: req.execId, pid: pty.pid })\n\n      pty.onData(data => {\n        opts.sink.send({ t: \"stdout\", execId: req.execId, data: encodeData(data) })\n      })\n      pty.onExit(({ exitCode, signal }) => {\n        opts.sink.send({\n          t: \"exit\",\n          execId: req.execId,\n          code: exitCode,\n          signal: signal != null ? String(signal) : null,\n        })\n        ptyProcs.delete(req.execId)\n      })\n\n      if (opts.onChildSpawned) {\n        try {\n          // PTY processes can't be adopted as ChildProcess — pass a no-op shim\n          // so the hook fires (for session visibility) without crashing.\n          opts.onChildSpawned({\n            execId: req.execId,\n            child: { pid: pty.pid } as unknown as ChildProcess,\n            request: approved,\n          })\n        } catch { /* fire-and-forget */ }\n      }\n      return\n    }\n\n    let child: ChildProcess\n    try {\n      child = spawn(approved.command, [...approved.args], {\n        cwd: approved.cwd,\n        env: { ...process.env, ...(approved.env ?? {}) },\n        stdio: [\"pipe\", \"pipe\", \"pipe\"],\n        // detached:false so SIGINT/SIGTERM on the daemon kills children too.\n      })\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err)\n      opts.sink.send({\n        t: \"error\",\n        execId: req.execId,\n        code: \"spawn_failed\",\n        message,\n      })\n      return\n    }\n\n    children.set(req.execId, child)\n\n    if (typeof child.pid === \"number\") {\n      opts.sink.send({ t: \"spawned\", execId: req.execId, pid: child.pid })\n    } else {\n      // Pid is null when spawn synchronously failed. The 'error'\n      // event below will fire with the real cause; we still report\n      // a placeholder spawned to keep the lifecycle predictable.\n      opts.sink.send({ t: \"spawned\", execId: req.execId, pid: -1 })\n    }\n\n    // Notify the higher-level registry (when wired) — this is what\n    // makes tunnel-driven spawns visible in the daemon's\n    // /sessions list alongside spawns originated locally. Errors\n    // from the observer never break the tunnel.\n    if (opts.onChildSpawned) {\n      try {\n        opts.onChildSpawned({ execId: req.execId, child, request: approved })\n      } catch (err) {\n        // Hook is fire-and-forget — log + continue.\n        // Use console.warn directly because tunnel server has no\n        // logger context.\n        console.warn(\n          `[tunnel-server] onChildSpawned hook threw for execId=${req.execId}: ${\n            err instanceof Error ? err.message : String(err)\n          }`\n        )\n      }\n    }\n\n    child.stdout?.on(\"data\", (chunk: Buffer) => {\n      const f: StdoutFrame = {\n        t: \"stdout\",\n        execId: req.execId,\n        data: encodeData(chunk),\n      }\n      opts.sink.send(f)\n    })\n    child.stderr?.on(\"data\", (chunk: Buffer) => {\n      const f: StderrFrame = {\n        t: \"stderr\",\n        execId: req.execId,\n        data: encodeData(chunk),\n      }\n      opts.sink.send(f)\n    })\n\n    child.on(\"error\", (err) => {\n      opts.sink.send({\n        t: \"error\",\n        execId: req.execId,\n        code: \"child_error\",\n        message: err.message,\n      })\n    })\n\n    child.on(\"exit\", (code, signal) => {\n      const f: ExitFrame = {\n        t: \"exit\",\n        execId: req.execId,\n        code,\n        signal,\n      }\n      opts.sink.send(f)\n      children.delete(req.execId)\n    })\n  }\n\n  /**\n   * Open a bridged WS connection to the local upstream. Same path-\n   * safety rules as `handleHttpRequest` (no absolute URLs, no `..`),\n   * same hop-by-hop header stripping. The `dialUpstreamWs` factory\n   * resolves to an `UpstreamWebSocket` once the upgrade is OPEN — we\n   * then emit `ws_open_ack` to the host and start piping frames.\n   */\n  async function handleWsOpen(req: WsOpenFrame): Promise<void> {\n    if (closed) return\n    const reject = (\n      status: number,\n      code: string,\n      message: string\n    ): void => {\n      opts.sink.send({\n        t: \"ws_open_ack\",\n        reqId: req.reqId,\n        status,\n        error: { code, message },\n      })\n    }\n    if (!opts.dialUpstreamWs || !opts.httpUpstream) {\n      reject(\n        502,\n        \"ws_upstream_not_configured\",\n        \"Daemon does not support WS forwarding — start with `--upstream ws://…` (or upgrade).\"\n      )\n      return\n    }\n    if (\n      !req.path.startsWith(\"/\") ||\n      req.path.startsWith(\"//\") ||\n      req.path.includes(\"..\")\n    ) {\n      reject(\n        400,\n        \"invalid_path\",\n        `Daemon WS forward requires a safe relative path; got '${req.path}'.`\n      )\n      return\n    }\n    const HOP_BY_HOP = new Set([\n      \"connection\",\n      \"upgrade\",\n      \"sec-websocket-version\",\n      \"sec-websocket-key\",\n      \"sec-websocket-extensions\",\n      \"sec-websocket-protocol\",\n      \"host\",\n      \"content-length\",\n    ])\n    const headers: Record<string, string> = {}\n    for (const [k, v] of Object.entries(req.headers ?? {})) {\n      if (HOP_BY_HOP.has(k.toLowerCase())) continue\n      headers[k] = v\n    }\n    // Pick the HTTP base: a named upstream (resolved by the daemon to an\n    // imported service's origin) when the frame carries one, else the\n    // default gateway. The host names an alias, never a URL, so it can't\n    // steer the daemon at an arbitrary origin.\n    let httpBase = opts.httpUpstream\n    if (req.upstream) {\n      const resolved = await opts.resolveWsUpstream?.(req.upstream)\n      if (!resolved) {\n        reject(\n          502,\n          \"unknown_ws_upstream\",\n          `No WS upstream registered for '${req.upstream}'.`\n        )\n        return\n      }\n      httpBase = resolved\n    }\n    // Map the http upstream base to a ws scheme. The daemon's upstream\n    // is conventionally http://127.0.0.1:<port>; the same host accepts\n    // WS upgrades on the same port, so ws://… works.\n    const base = httpBase.replace(/^http(s?):\\/\\//, \"ws$1://\")\n    const url = `${base.replace(/\\/$/, \"\")}${req.path}`\n\n    // Bound the dial: a hung upstream that never finishes the upgrade must not\n    // strand the ws_open. Abort the dial (cooperating impls cancel the real\n    // socket) AND race the timeout independently, so even an impl that ignores\n    // the signal still yields a 504.\n    const dialTimeoutMs = opts.wsDialTimeoutMs ?? DEFAULT_WS_DIAL_TIMEOUT_MS\n    const dialAbort = new AbortController()\n    let dialTimedOut = false\n    let dialTimer: ReturnType<typeof setTimeout> | null = null\n    const dialPromise = opts.dialUpstreamWs({\n      url,\n      ...(req.protocols && req.protocols.length > 0\n        ? { protocols: req.protocols }\n        : {}),\n      headers,\n      signal: dialAbort.signal,\n    })\n    const timeoutPromise = new Promise<never>((_resolve, rej) => {\n      dialTimer = setTimeout(() => {\n        dialTimedOut = true\n        dialAbort.abort(new Error(\"ws_dial_timeout\"))\n        rej(new Error(`upstream WS dial timed out after ${dialTimeoutMs}ms`))\n      }, dialTimeoutMs)\n      if (typeof dialTimer !== \"number\") dialTimer.unref()\n    })\n\n    let upstream: UpstreamWebSocket\n    try {\n      upstream = await Promise.race([dialPromise, timeoutPromise])\n    } catch (err) {\n      if (dialTimer) clearTimeout(dialTimer)\n      if (dialTimedOut) {\n        // The timeout won the race. If the abandoned dial ever resolves, close\n        // the orphaned socket so it doesn't leak.\n        dialPromise.then(\n          sock => {\n            try {\n              sock.close(1001, \"dial_timeout\")\n            } catch {\n              /* defensive */\n            }\n          },\n          () => {},\n        )\n        reject(\n          504,\n          \"upstream_ws_timeout\",\n          `Upstream did not complete the WS upgrade within ${dialTimeoutMs}ms.`,\n        )\n        return\n      }\n      const message = err instanceof Error ? err.message : String(err)\n      // Try to extract an HTTP status from a `ws` error like\n      // `Unexpected server response: 404`.\n      const m = message.match(/Unexpected server response: (\\d+)/)\n      const status = m ? Number.parseInt(m[1]!, 10) : 502\n      reject(status, \"upstream_ws_failed\", message)\n      return\n    }\n    if (dialTimer) clearTimeout(dialTimer)\n    // Race: caller already abandoned us (tunnel closed mid-upgrade).\n    if (closed) {\n      try {\n        upstream.close(1001, \"tunnel_closed\")\n      } catch {\n        /* defensive */\n      }\n      return\n    }\n    upstreamWs.set(req.reqId, upstream)\n    opts.sink.send({\n      t: \"ws_open_ack\",\n      reqId: req.reqId,\n      status: 101,\n      ...(upstream.protocol ? { protocol: upstream.protocol } : {}),\n    })\n\n    upstream.onMessage((data, isBinary) => {\n      if (!opts.sink.isOpen) return\n      opts.sink.send({\n        t: \"ws_message\",\n        reqId: req.reqId,\n        data: encodeData(data),\n        binary: isBinary,\n      })\n    })\n    upstream.onClose((code, reason) => {\n      if (!upstreamWs.has(req.reqId)) return\n      upstreamWs.delete(req.reqId)\n      if (opts.sink.isOpen) {\n        opts.sink.send({\n          t: \"ws_close\",\n          reqId: req.reqId,\n          code,\n          ...(reason ? { reason } : {}),\n        })\n      }\n    })\n    upstream.onError(err => {\n      // Errors typically precede a close; emit a stable error code in\n      // the close frame so the host can distinguish from clean close.\n      if (!upstreamWs.has(req.reqId)) return\n      upstreamWs.delete(req.reqId)\n      if (opts.sink.isOpen) {\n        opts.sink.send({\n          t: \"ws_close\",\n          reqId: req.reqId,\n          code: 1011,\n          reason: `upstream_error: ${err.message}`,\n        })\n      }\n      try {\n        upstream.close(1011, \"upstream_error\")\n      } catch {\n        /* defensive */\n      }\n    })\n  }\n\n  async function handleHttpRequest(req: HttpRequestFrame): Promise<void> {\n    if (closed) return\n    const respond = (\n      partial:\n        | { status: number; headers?: HttpResponseFrame[\"headers\"]; body?: string }\n        | { error: HttpResponseFrame[\"error\"]; status: number }\n    ): void => {\n      opts.sink.send({\n        t: \"http_response\",\n        reqId: req.reqId,\n        ...partial,\n      } as HttpResponseFrame)\n    }\n\n    // Reject if no upstream is configured. Better explicit error\n    // than a confusing 502 from a missing fetch target.\n    if (!opts.httpUpstream) {\n      respond({\n        status: 502,\n        error: {\n          code: \"http_upstream_not_configured\",\n          message:\n            \"Daemon was not started with an http upstream — cannot forward HTTP frames.\",\n        },\n      })\n      return\n    }\n\n    // Path-only is required to keep the daemon from being a generic\n    // SSRF amplifier. Absolute URLs (including protocol-relative `//`)\n    // and parent-traversal are rejected. Querystrings are fine.\n    if (\n      !req.path.startsWith(\"/\") ||\n      req.path.startsWith(\"//\") ||\n      req.path.includes(\"..\")\n    ) {\n      respond({\n        status: 400,\n        error: {\n          code: \"invalid_path\",\n          message: `Daemon http forward requires a safe relative path; got '${req.path}'.`,\n        },\n      })\n      return\n    }\n\n    // Strip hop-by-hop headers defensively before forwarding —\n    // they're meaningful only to the previous transport hop.\n    const HOP_BY_HOP = new Set([\n      \"connection\",\n      \"keep-alive\",\n      \"transfer-encoding\",\n      \"upgrade\",\n      \"proxy-authenticate\",\n      \"proxy-authorization\",\n      \"te\",\n      \"trailer\",\n      \"host\", // upstream sets its own based on the URL\n      \"content-length\", // fetch recomputes\n    ])\n    const headers: Record<string, string> = {}\n    for (const [k, v] of Object.entries(req.headers ?? {})) {\n      if (HOP_BY_HOP.has(k.toLowerCase())) continue\n      headers[k] = v\n    }\n\n    const url = `${opts.httpUpstream.replace(/\\/$/, \"\")}${req.path}`\n    const controller = new AbortController()\n    const timeoutMs =\n      req.timeoutMs ??\n      opts.httpForwardTimeoutMs ??\n      DEFAULT_HTTP_FORWARD_TIMEOUT_MS\n    // For streaming responses (SSE / long-poll), the daemon-side\n    // request must NOT abort on the regular timeout — the stream is\n    // *meant* to be long-lived. We arm the timer initially, then\n    // disarm it as soon as we detect a streaming response so the\n    // stream can run indefinitely (the host enforces its own teardown\n    // via tunnel close / explicit cancel).\n    let timer: ReturnType<typeof setTimeout> | null = setTimeout(\n      () => controller.abort(),\n      timeoutMs\n    )\n    const clearTimer = () => {\n      if (timer) {\n        clearTimeout(timer)\n        timer = null\n      }\n    }\n    try {\n      const upstreamRes = await fetch(url, {\n        method: req.method,\n        headers,\n        body:\n          req.body === undefined ? undefined : decodeData(req.body),\n        signal: controller.signal,\n        // node fetch follows redirects by default — fine for MCP, the\n        // upstream gateway doesn't redirect anyway.\n      })\n      const outHeaders: Record<string, string> = {}\n      upstreamRes.headers.forEach((value, key) => {\n        if (HOP_BY_HOP.has(key.toLowerCase())) return\n        outHeaders[key] = value\n      })\n\n      // Streaming detection — SSE responses MUST go through the\n      // chunked-frame protocol so the host can pipe bytes to the\n      // browser in real time. Anything else stays on the buffered\n      // path for now (small JSON responses are simpler that way; we\n      // can widen streaming to all responses later once it's proven).\n      const contentType = (outHeaders[\"content-type\"] ?? \"\").toLowerCase()\n      const isStream =\n        contentType.startsWith(\"text/event-stream\") ||\n        contentType.includes(\"application/x-ndjson\")\n\n      if (isStream && upstreamRes.body) {\n        // Disarm the request-level timeout — SSE streams are\n        // long-lived by design. The host closing the tunnel (or the\n        // upstream closing its end) is what terminates us now.\n        clearTimer()\n        opts.sink.send({\n          t: \"http_response_head\",\n          reqId: req.reqId,\n          status: upstreamRes.status,\n          headers: outHeaders,\n        })\n        const reader = upstreamRes.body.getReader()\n        // Inter-chunk idle bound: the request timeout is disarmed for streams,\n        // so without this a stalled upstream (headers sent, then silence) hangs\n        // forever. The timer resets per chunk, so a heartbeating stream is never\n        // cut. `IDLE` is the sentinel for \"no byte arrived within the window\".\n        const idleMs = opts.httpStreamIdleTimeoutMs\n        const IDLE = Symbol(\"idle\")\n        type ReadResult = Awaited<ReturnType<typeof reader.read>>\n        const readChunk = async (): Promise<ReadResult | typeof IDLE> => {\n          if (!idleMs) return reader.read()\n          let idleTimer: ReturnType<typeof setTimeout> | null = null\n          const idle = new Promise<typeof IDLE>(resolve => {\n            idleTimer = setTimeout(() => resolve(IDLE), idleMs)\n            if (typeof idleTimer !== \"number\") idleTimer.unref()\n          })\n          try {\n            return await Promise.race([reader.read(), idle])\n          } finally {\n            if (idleTimer) clearTimeout(idleTimer)\n          }\n        }\n        try {\n          while (true) {\n            const chunk = await readChunk()\n            if (chunk === IDLE) {\n              try {\n                await reader.cancel()\n              } catch {\n                /* ignore */\n              }\n              opts.sink.send({\n                t: \"http_response_chunk\",\n                reqId: req.reqId,\n                end: true,\n                error: {\n                  code: \"upstream_stream_idle_timeout\",\n                  message: `No data from upstream for ${idleMs}ms.`,\n                },\n              })\n              return\n            }\n            const { value, done } = chunk\n            if (done) {\n              opts.sink.send({\n                t: \"http_response_chunk\",\n                reqId: req.reqId,\n                end: true,\n              })\n              return\n            }\n            if (value && value.byteLength > 0) {\n              opts.sink.send({\n                t: \"http_response_chunk\",\n                reqId: req.reqId,\n                data: encodeData(Buffer.from(value)),\n              })\n            }\n            // Stop streaming if the tunnel sink closed under us — no\n            // point feeding chunks into the void.\n            if (!opts.sink.isOpen) {\n              try {\n                await reader.cancel()\n              } catch {\n                /* ignore */\n              }\n              return\n            }\n          }\n        } catch (err) {\n          const message = err instanceof Error ? err.message : String(err)\n          opts.sink.send({\n            t: \"http_response_chunk\",\n            reqId: req.reqId,\n            end: true,\n            error: { code: \"upstream_stream_failed\", message },\n          })\n        }\n        return\n      }\n\n      // Buffered path (unchanged): small responses + non-SSE traffic.\n      const buf = Buffer.from(await upstreamRes.arrayBuffer())\n      respond({\n        status: upstreamRes.status,\n        headers: outHeaders,\n        body: buf.length > 0 ? encodeData(buf) : \"\",\n      })\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err)\n      const aborted = err instanceof Error && err.name === \"AbortError\"\n      respond({\n        status: aborted ? 504 : 502,\n        error: {\n          code: aborted ? \"timeout\" : \"upstream_fetch_failed\",\n          message,\n        },\n      })\n    } finally {\n      clearTimer()\n    }\n  }\n\n  return {\n    children,\n    async close() {\n      if (closed) return\n      closed = true\n      for (const [, child] of children) child.kill(\"SIGTERM\")\n      children.clear()\n      opts.sink.close(\"server.close\")\n    },\n  }\n}\n\n// Re-exports for convenience — server-only callers don't need to\n// reach into ./frames for these.\nexport { encodeFrame, parseFrame }\n","/**\n * Tunnel client (host side).\n *\n * Sits on the orchestrator (e.g. Guilde API). Speaks to a remote daemon\n * over a `FrameSink`. Exposes `spawn(command, args, opts)` that returns\n * an object shaped like Node's `ChildProcess` — same `.stdin` /\n * `.stdout` / `.stderr` / `.on('exit')` / `.kill()` surface. This lets\n * the existing ACP protocol arm drive remote subprocesses with zero\n * code changes; the arm thinks it's talking to a local child.\n *\n * The duck is intentionally minimal — only the methods the ACP arm\n * actually calls. If you need the full ChildProcess interface, wrap\n * this with a node:stream.Readable shim.\n */\n\nimport { EventEmitter } from \"node:events\"\nimport { Readable, Writable } from \"node:stream\"\nimport { randomUUID } from \"node:crypto\"\nimport {\n  TUNNEL_VERSION,\n  decodeData,\n  encodeData,\n  type ExitFrame,\n  type HelloFrame,\n  type HttpRequestFrame,\n  type HttpResponseFrame,\n  type SpawnFrame,\n  type SpawnedFrame,\n  type StderrFrame,\n  type StdoutFrame,\n  type TunnelFrame,\n  type WsOpenFrame,\n} from \"./frames.js\"\nimport type { FrameSink } from \"./transport.js\"\n\n/** Resolved response from `forwardHttp`. Mirrors `HttpResponseFrame`\n *  but with the body decoded back to a Buffer for the caller. */\nexport interface TunnelHttpResponse {\n  status: number\n  headers: Readonly<Record<string, string>>\n  body: Buffer\n  /** Set when the daemon failed to complete the upstream call. */\n  error?: Readonly<{\n    code: string\n    message: string\n  }>\n}\n\n/** Resolved response from `forwardHttpStream`. Body is a Web\n *  `ReadableStream<Uint8Array>` — consume it to receive chunks as\n *  they arrive from the daemon's upstream (SSE, long-poll, NDJSON).\n *  The stream closes when the daemon's upstream closes OR an upstream\n *  error occurs (surfaced as a stream error on the reader). */\nexport interface TunnelHttpStreamResponse {\n  status: number\n  headers: Readonly<Record<string, string>>\n  body: ReadableStream<Uint8Array>\n}\n\nexport interface TunnelHttpRequest {\n  method: string\n  path: string\n  headers?: Readonly<Record<string, string>>\n  body?: Buffer | Uint8Array | string\n  /** Per-request timeout in ms. Default 30_000. */\n  timeoutMs?: number\n}\n\nexport interface TunnelWebSocketOpenRequest {\n  /** Path + querystring on the daemon-local upstream. Daemon prepends\n   *  its `ws://<upstream>` base; absolute URLs are rejected. */\n  path: string\n  /** Optional registered upstream to dial instead of the daemon's default\n   *  gateway — a NAME the daemon resolves to a base URL (e.g. an imported\n   *  service alias). The host never names a raw origin. */\n  upstream?: string\n  /** Headers forwarded to the upstream upgrade. Hop-by-hop / Sec-* are\n   *  stripped by the daemon. Cookies are NOT forwarded unless the\n   *  daemon was started with `--upstream-cookies`. */\n  headers?: Readonly<Record<string, string>>\n  /** Subprotocols requested. Echoed in `protocol` on success. */\n  protocols?: readonly string[]\n  /** How long to wait for the upstream upgrade before erroring. The\n   *  message stream itself has no timeout (WS lives as long as either\n   *  end keeps it open). Default 30_000. */\n  openTimeoutMs?: number\n}\n\n/**\n * Bridged WS connection. Mirrors the surface of a browser WebSocket\n * minus URL/protocol bookkeeping — the host already chose those when\n * calling `forwardWebSocket`. Messages are typed as text (UTF-8 string)\n * or binary (Uint8Array); the bridge preserves the upstream's framing.\n */\nexport interface TunnelWebSocket {\n  /** True until `close` runs in either direction. */\n  readonly readyState: \"open\" | \"closing\" | \"closed\"\n  /** Selected subprotocol from the upstream's upgrade response, if any. */\n  readonly protocol: string | null\n  /** Send a frame to the daemon's upstream. No-op when not open. */\n  send(data: string | Uint8Array): void\n  /** Initiate a clean close. Idempotent. */\n  close(code?: number, reason?: string): void\n  /** Subscribe to inbound frames. Returns an unsubscribe fn. */\n  onMessage(\n    listener: (data: Buffer, isBinary: boolean) => void\n  ): () => void\n  /** Subscribe to close. Fires exactly once (after either side closes\n   *  OR the tunnel itself drops). Returns an unsubscribe fn. */\n  onClose(listener: (code: number, reason: string) => void): () => void\n  /** Subscribe to transport-level errors. Closes follow shortly. */\n  onError(listener: (err: Error) => void): () => void\n}\n\nexport interface TunnelClientOptions {\n  sink: FrameSink\n  /**\n   * Reject the `spawn` call if the daemon hasn't sent its `hello`\n   * within this window. Defaults to 10s — generous for high-latency\n   * tunnels but fast enough that misconfigured daemons fail loudly.\n   */\n  helloTimeoutMs?: number\n}\n\nexport interface TunnelSpawnOptions {\n  cwd?: string\n  env?: Readonly<Record<string, string>>\n  /** Allocate a PTY on the daemon. Requires `hello.capabilities.pty`. */\n  pty?: boolean\n  /** Initial PTY column width (ignored when `pty` is false). Default 80. */\n  cols?: number\n  /** Initial PTY row height (ignored when `pty` is false). Default 24. */\n  rows?: number\n}\n\n/**\n * Minimal ChildProcess-shaped duck. Covers the surface our ACP arm\n * calls; expand only when a real consumer needs more.\n */\nexport interface TunnelChildProcess {\n  readonly execId: string\n  readonly pid: number | null\n  readonly stdin: Writable\n  readonly stdout: Readable\n  readonly stderr: Readable\n  /** \"exit\" → (code, signal). \"error\" → (Error). */\n  on(event: \"exit\", listener: (code: number | null, signal: string | null) => void): this\n  on(event: \"error\", listener: (err: Error) => void): this\n  kill(signal?: NodeJS.Signals | number): boolean\n  /** Send a terminal resize to the daemon. No-op if the exec isn't PTY-backed. */\n  resize(cols: number, rows: number): void\n}\n\nexport interface TunnelClient {\n  /**\n   * Resolves once the daemon has sent its `hello` frame, OR rejects\n   * with a tunnel-level error. Subsequent calls return the cached\n   * promise.\n   */\n  ready(): Promise<HelloFrame>\n  spawn(\n    command: string,\n    args: readonly string[],\n    opts?: TunnelSpawnOptions\n  ): Promise<TunnelChildProcess>\n  /**\n   * Forward an HTTP request through the tunnel to the daemon's\n   * configured upstream (typically `http://127.0.0.1:<port>`). The\n   * daemon completes the upstream call and replies with the response,\n   * which this promise resolves to. Rejects on tunnel-transport\n   * failure; the daemon-reported HTTP status (incl. 5xx) is returned\n   * in the resolved value.\n   *\n   * Streaming responses (text/event-stream, NDJSON) are buffered into\n   * the returned Buffer. For real streaming, use `forwardHttpStream`.\n   */\n  forwardHttp(req: TunnelHttpRequest): Promise<TunnelHttpResponse>\n  /**\n   * Stream an HTTP response through the tunnel. The promise resolves\n   * as soon as the response head (status + headers) arrives — the\n   * body chunks then flow through `body` (a ReadableStream) until the\n   * daemon's upstream closes. Required for SSE / NDJSON / long-poll\n   * upstreams where buffering until the end would defeat the point.\n   * For one-shot HTTP, prefer `forwardHttp`.\n   */\n  forwardHttpStream(req: TunnelHttpRequest): Promise<TunnelHttpStreamResponse>\n  /**\n   * Open a bridged WebSocket through the tunnel. The promise resolves\n   * once the daemon has completed the upstream upgrade; from that\n   * point messages flow via the returned `TunnelWebSocket`.\n   *\n   * Rejects on:\n   *   - missing `hello.capabilities.wsForward` — older daemon, no bridge\n   *   - upstream upgrade failure (4xx/5xx) — `cause` carries the status\n   *   - timeout waiting for `ws_open_ack`\n   */\n  forwardWebSocket(req: TunnelWebSocketOpenRequest): Promise<TunnelWebSocket>\n  close(): Promise<void>\n}\n\nexport function createTunnelClient(opts: TunnelClientOptions): TunnelClient {\n  const helloTimeoutMs = opts.helloTimeoutMs ?? 10_000\n  let hello: HelloFrame | null = null\n  let helloPromise: Promise<HelloFrame> | null = null\n\n  // Per-execId routing tables. We dispatch incoming frames to the\n  // right child duck by execId; spawn awaits its own `spawned` /\n  // `error` reply via these one-shot resolvers.\n  const childByExec = new Map<string, TunnelChildDuck>()\n  const spawnPending = new Map<\n    string,\n    { resolve: (frame: SpawnedFrame) => void; reject: (err: Error) => void }\n  >()\n\n  // Inflight HTTP forwards keyed by reqId. Each entry's mode depends\n  // on which API the caller used:\n  //   - \"buffered\": forwardHttp(). Resolves once the full body has\n  //     arrived (either as a single `http_response` frame, OR as\n  //     `http_response_head` + chunks that get concatenated here).\n  //   - \"stream\": forwardHttpStream(). Resolves on `http_response_head`\n  //     with a ReadableStream that's fed by subsequent chunk frames.\n  //     For backward-compat with daemons that emit a single\n  //     `http_response`, we synthesize a one-chunk stream + end.\n  // Either mode handles either server response shape — the daemon's\n  // streaming decision is purely server-side (Content-Type based), and\n  // the client adapts.\n  type HttpPending =\n    | {\n        mode: \"buffered\"\n        resolve: (resp: TunnelHttpResponse) => void\n        reject: (err: Error) => void\n        timer: ReturnType<typeof setTimeout>\n        // Set when daemon starts a chunked response.\n        streamHead: {\n          status: number\n          headers: Record<string, string>\n        } | null\n        streamChunks: Buffer[]\n      }\n    | {\n        mode: \"stream\"\n        resolveHead: (resp: TunnelHttpStreamResponse) => void\n        reject: (err: Error) => void\n        timer: ReturnType<typeof setTimeout>\n        // Set once the head arrives — drains pendingChunks into it.\n        controller: ReadableStreamDefaultController<Uint8Array> | null\n        pendingChunks: Buffer[]\n        headEmitted: boolean\n        // Goes true after `end: true` so a late close-of-tunnel doesn't\n        // try to error a closed controller.\n        ended: boolean\n      }\n  const httpPending = new Map<string, HttpPending>()\n\n  // Per-reqId routing for bridged WS connections. Lifecycle:\n  //   1. forwardWebSocket() inserts a `wsOpenPending` entry + sends ws_open\n  //   2. Daemon emits ws_open_ack → we resolve the open promise into a\n  //      TunnelWebSocketDuck, move it to `wsByReq`, drop the pending entry\n  //   3. Bidirectional ws_message frames route to the duck\n  //   4. ws_close in either direction tears the duck down + drops from the map\n  //   5. Tunnel close errors all open WSes with code 1006\n  type WsPending = {\n    resolve: (ws: TunnelWebSocket) => void\n    reject: (err: Error) => void\n    timer: ReturnType<typeof setTimeout>\n  }\n  const wsOpenPending = new Map<string, WsPending>()\n  const wsByReq = new Map<string, TunnelWebSocketDuck>()\n\n  const offFrame = opts.sink.onFrame((frame) => routeIncoming(frame))\n  const offClose = opts.sink.onClose(() => {\n    for (const [, duck] of childByExec) duck.__handleSinkClosed()\n    childByExec.clear()\n    for (const [, p] of spawnPending) {\n      p.reject(new Error(\"Tunnel closed before spawn completed.\"))\n    }\n    spawnPending.clear()\n    for (const [, p] of httpPending) {\n      clearTimeout(p.timer)\n      if (p.mode === \"buffered\") {\n        p.reject(new Error(\"Tunnel closed before HTTP response arrived.\"))\n      } else {\n        // For an active stream, error the controller so the consumer's\n        // reader.read() rejects instead of hanging forever. If the head\n        // hasn't been emitted yet, reject the head promise too.\n        if (!p.headEmitted) {\n          p.reject(new Error(\"Tunnel closed before HTTP response head arrived.\"))\n        } else if (p.controller && !p.ended) {\n          try {\n            p.controller.error(new Error(\"Tunnel closed mid-stream.\"))\n          } catch {\n            /* already closed */\n          }\n        }\n      }\n    }\n    httpPending.clear()\n    for (const [, p] of wsOpenPending) {\n      clearTimeout(p.timer)\n      p.reject(new Error(\"Tunnel closed before WS upgrade completed.\"))\n    }\n    wsOpenPending.clear()\n    for (const [, duck] of wsByReq) {\n      duck.__handleSinkClosed()\n    }\n    wsByReq.clear()\n    offFrame()\n    offClose()\n  })\n\n  function routeIncoming(frame: TunnelFrame): void {\n    switch (frame.t) {\n      case \"hello\":\n        if (frame.version !== TUNNEL_VERSION) {\n          // Mismatch — surface via the ready() rejection. We don't\n          // tear down the sink because the caller may want to\n          // negotiate a fallback.\n          throw new Error(\n            `Tunnel daemon speaks ${frame.version}; this client speaks ${TUNNEL_VERSION}.`\n          )\n        }\n        hello = frame\n        return\n      case \"spawned\": {\n        const pending = spawnPending.get(frame.execId)\n        if (pending) {\n          spawnPending.delete(frame.execId)\n          pending.resolve(frame)\n        }\n        return\n      }\n      case \"stdout\": {\n        const duck = childByExec.get(frame.execId)\n        duck?.__pushStdout(decodeData((frame as StdoutFrame).data))\n        return\n      }\n      case \"stderr\": {\n        const duck = childByExec.get(frame.execId)\n        duck?.__pushStderr(decodeData((frame as StderrFrame).data))\n        return\n      }\n      case \"exit\": {\n        const duck = childByExec.get(frame.execId)\n        duck?.__handleExit(frame as ExitFrame)\n        childByExec.delete(frame.execId)\n        return\n      }\n      case \"error\": {\n        if (frame.execId) {\n          const pending = spawnPending.get(frame.execId)\n          if (pending) {\n            spawnPending.delete(frame.execId)\n            pending.reject(new Error(`${frame.code}: ${frame.message}`))\n            return\n          }\n          const duck = childByExec.get(frame.execId)\n          duck?.__pushError(new Error(`${frame.code}: ${frame.message}`))\n          return\n        }\n        // Tunnel-level error: nowhere to surface it cleanly here.\n        // Callers that care should wrap the FrameSink and observe\n        // tunnel-error frames themselves.\n        return\n      }\n      case \"http_response\": {\n        // Buffered response from the daemon — single-frame body.\n        const pending = httpPending.get(frame.reqId)\n        if (!pending) return\n        httpPending.delete(frame.reqId)\n        clearTimeout(pending.timer)\n        const body = frame.body ? decodeData(frame.body) : Buffer.alloc(0)\n        if (pending.mode === \"buffered\") {\n          pending.resolve({\n            status: frame.status,\n            headers: frame.headers ?? {},\n            body,\n            ...(frame.error ? { error: frame.error } : {}),\n          })\n        } else {\n          // Caller asked for a stream but the daemon decided to send\n          // a single buffered response. Synthesize a one-chunk stream\n          // so the same consumer code path works.\n          const stream = new ReadableStream<Uint8Array>({\n            start(controller) {\n              if (body.length > 0) controller.enqueue(new Uint8Array(body))\n              controller.close()\n            },\n          })\n          pending.resolveHead({\n            status: frame.status,\n            headers: frame.headers ?? {},\n            body: stream,\n          })\n        }\n        return\n      }\n      case \"http_response_head\": {\n        const pending = httpPending.get(frame.reqId)\n        if (!pending) return\n        const headers = frame.headers ?? {}\n        if (pending.mode === \"stream\") {\n          // Wire a ReadableStream whose controller drains any chunks\n          // we've buffered while waiting for the head frame (rare —\n          // chunks shouldn't precede the head — but harmless).\n          const stream = new ReadableStream<Uint8Array>({\n            start(controller) {\n              pending.controller = controller\n              for (const chunk of pending.pendingChunks) {\n                if (chunk.length > 0) controller.enqueue(new Uint8Array(chunk))\n              }\n              pending.pendingChunks = []\n            },\n            cancel: () => {\n              // Consumer abandoned the stream — clean up the pending\n              // entry. We don't send a cancel frame to the daemon\n              // (the protocol doesn't define one), so the daemon will\n              // keep streaming until its upstream closes; we simply\n              // drop frames we still receive.\n              if (httpPending.get(frame.reqId) === pending) {\n                clearTimeout(pending.timer)\n                httpPending.delete(frame.reqId)\n              }\n            },\n          })\n          pending.headEmitted = true\n          // Stream is long-lived — disarm the buffered-mode timeout\n          // (it was a safety net for a stuck buffered response).\n          clearTimeout(pending.timer)\n          pending.resolveHead({\n            status: frame.status,\n            headers,\n            body: stream,\n          })\n        } else {\n          // Buffered caller, streaming server — start accumulating\n          // chunks; we'll resolve once `end: true` arrives.\n          pending.streamHead = { status: frame.status, headers }\n        }\n        return\n      }\n      case \"http_response_chunk\": {\n        const pending = httpPending.get(frame.reqId)\n        if (!pending) return\n        const data = frame.data ? decodeData(frame.data) : Buffer.alloc(0)\n        if (pending.mode === \"stream\") {\n          if (frame.error) {\n            // Upstream error mid-stream — surface it on the reader.\n            try {\n              pending.controller?.error(\n                new Error(`${frame.error.code}: ${frame.error.message}`)\n              )\n            } catch {\n              /* already closed */\n            }\n            pending.ended = true\n            clearTimeout(pending.timer)\n            httpPending.delete(frame.reqId)\n            return\n          }\n          if (pending.controller) {\n            if (data.length > 0) {\n              try {\n                pending.controller.enqueue(new Uint8Array(data))\n              } catch {\n                /* reader detached — drop */\n              }\n            }\n            if (frame.end) {\n              try {\n                pending.controller.close()\n              } catch {\n                /* already closed */\n              }\n              pending.ended = true\n              clearTimeout(pending.timer)\n              httpPending.delete(frame.reqId)\n            }\n          } else {\n            // Head hasn't been processed yet — buffer until it is.\n            if (data.length > 0) pending.pendingChunks.push(data)\n            if (frame.end) {\n              // Race: chunk-end before head. Defer closing until head\n              // creates the controller.\n              pending.ended = true\n            }\n          }\n        } else {\n          // Buffered mode — accumulate chunks; resolve on end.\n          if (data.length > 0) pending.streamChunks.push(data)\n          if (frame.error) {\n            clearTimeout(pending.timer)\n            httpPending.delete(frame.reqId)\n            const concatenated = Buffer.concat(pending.streamChunks)\n            pending.resolve({\n              status: pending.streamHead?.status ?? 502,\n              headers: pending.streamHead?.headers ?? {},\n              body: concatenated,\n              error: frame.error,\n            })\n            return\n          }\n          if (frame.end) {\n            clearTimeout(pending.timer)\n            httpPending.delete(frame.reqId)\n            const concatenated = Buffer.concat(pending.streamChunks)\n            pending.resolve({\n              status: pending.streamHead?.status ?? 200,\n              headers: pending.streamHead?.headers ?? {},\n              body: concatenated,\n            })\n          }\n        }\n        return\n      }\n      case \"ws_open_ack\": {\n        const pending = wsOpenPending.get(frame.reqId)\n        if (!pending) return\n        wsOpenPending.delete(frame.reqId)\n        clearTimeout(pending.timer)\n        if (frame.error || frame.status !== 101) {\n          const code = frame.error?.code ?? `http_${frame.status}`\n          const msg =\n            frame.error?.message ??\n            `Upstream WS upgrade returned ${frame.status}`\n          pending.reject(new Error(`${code}: ${msg}`))\n          return\n        }\n        const duck = new TunnelWebSocketDuck(\n          frame.reqId,\n          frame.protocol ?? null,\n          opts.sink,\n          () => wsByReq.delete(frame.reqId)\n        )\n        wsByReq.set(frame.reqId, duck)\n        pending.resolve(duck)\n        return\n      }\n      case \"ws_message\": {\n        const duck = wsByReq.get(frame.reqId)\n        if (!duck) return // stale frame after close — drop\n        duck.__handleMessage(decodeData(frame.data), frame.binary === true)\n        return\n      }\n      case \"ws_close\": {\n        // Resolve a pending open if the daemon closes before acking\n        // (e.g. upstream refused mid-upgrade and emitted close).\n        const pending = wsOpenPending.get(frame.reqId)\n        if (pending) {\n          wsOpenPending.delete(frame.reqId)\n          clearTimeout(pending.timer)\n          pending.reject(\n            new Error(\n              `WS closed before upgrade (code ${frame.code}${frame.reason ? `: ${frame.reason}` : \"\"})`\n            )\n          )\n          return\n        }\n        const duck = wsByReq.get(frame.reqId)\n        if (duck) {\n          wsByReq.delete(frame.reqId)\n          duck.__handleClose(frame.code, frame.reason ?? \"\")\n        }\n        return\n      }\n      case \"ping\":\n        opts.sink.send({ t: \"pong\", nonce: frame.nonce })\n        return\n      case \"pong\":\n      case \"spawn\":\n      case \"stdin\":\n      case \"kill\":\n      case \"resize\":\n      case \"http_request\":\n      case \"ws_open\":\n        // Not expected on the host side; ignore.\n        return\n    }\n  }\n\n  return {\n    ready() {\n      if (hello) return Promise.resolve(hello)\n      if (helloPromise) return helloPromise\n      helloPromise = new Promise<HelloFrame>((resolve, reject) => {\n        const timer = setTimeout(() => {\n          reject(\n            new Error(\n              `Tunnel daemon did not send hello within ${helloTimeoutMs}ms.`\n            )\n          )\n        }, helloTimeoutMs)\n        // Rebind sink listener so we resolve on the next hello.\n        const off = opts.sink.onFrame((frame) => {\n          if (frame.t !== \"hello\") return\n          clearTimeout(timer)\n          off()\n          if (frame.version !== TUNNEL_VERSION) {\n            reject(\n              new Error(\n                `Tunnel daemon speaks ${frame.version}; client speaks ${TUNNEL_VERSION}.`\n              )\n            )\n            return\n          }\n          hello = frame\n          resolve(frame)\n        })\n      })\n      return helloPromise\n    },\n\n    async spawn(command, args, spawnOpts) {\n      if (!hello) await this.ready()\n      if (spawnOpts?.pty && hello?.capabilities.pty !== true) {\n        throw new Error(\n          `Tunnel daemon '${hello?.label ?? \"(unnamed)\"}' does not advertise PTY support.`\n        )\n      }\n      const execId = randomUUID()\n      const req: SpawnFrame = {\n        t: \"spawn\",\n        execId,\n        command,\n        args,\n        cwd: spawnOpts?.cwd,\n        env: spawnOpts?.env,\n        pty: spawnOpts?.pty,\n        ...(spawnOpts?.pty ? { cols: spawnOpts.cols ?? 80, rows: spawnOpts.rows ?? 24 } : {}),\n      }\n      const spawnedFrame = await new Promise<SpawnedFrame>(\n        (resolve, reject) => {\n          spawnPending.set(execId, { resolve, reject })\n          opts.sink.send(req)\n        }\n      )\n      const duck = new TunnelChildDuck(execId, spawnedFrame.pid, opts.sink)\n      childByExec.set(execId, duck)\n      return duck\n    },\n\n    async forwardHttp(req: TunnelHttpRequest): Promise<TunnelHttpResponse> {\n      if (!hello) await this.ready()\n      const reqId = randomUUID()\n      const timeoutMs = req.timeoutMs ?? 30_000\n      const body =\n        req.body === undefined\n          ? undefined\n          : encodeData(\n              typeof req.body === \"string\" ? req.body : Buffer.from(req.body)\n            )\n      const frame: HttpRequestFrame = {\n        t: \"http_request\",\n        reqId,\n        method: req.method,\n        path: req.path,\n        ...(req.headers ? { headers: req.headers } : {}),\n        ...(body !== undefined ? { body } : {}),\n        timeoutMs,\n      }\n      return new Promise<TunnelHttpResponse>((resolve, reject) => {\n        // Belt-and-suspenders timeout: in addition to the daemon-side\n        // enforcement, we time out client-side at timeoutMs + 5s so a\n        // misbehaving daemon can't stall this promise forever.\n        const timer = setTimeout(() => {\n          httpPending.delete(reqId)\n          reject(\n            new Error(\n              `Tunnel forwardHttp(${req.method} ${req.path}) timed out after ${timeoutMs + 5_000}ms.`\n            )\n          )\n        }, timeoutMs + 5_000)\n        httpPending.set(reqId, {\n          mode: \"buffered\",\n          resolve,\n          reject,\n          timer,\n          streamHead: null,\n          streamChunks: [],\n        })\n        opts.sink.send(frame)\n      })\n    },\n\n    async forwardHttpStream(\n      req: TunnelHttpRequest\n    ): Promise<TunnelHttpStreamResponse> {\n      if (!hello) await this.ready()\n      const reqId = randomUUID()\n      // Streaming requests don't enforce a body-completion timeout —\n      // SSE / long-poll streams are *meant* to stay open. We do gate\n      // the HEAD on a generous-but-finite window so a daemon that\n      // silently drops the request still surfaces an error rather\n      // than hanging forever; once head arrives, the timer is cleared.\n      const headTimeoutMs = req.timeoutMs ?? 30_000\n      const body =\n        req.body === undefined\n          ? undefined\n          : encodeData(\n              typeof req.body === \"string\" ? req.body : Buffer.from(req.body)\n            )\n      // Daemon-side request timeout: pass a very large number so the\n      // daemon doesn't kill its own fetch before the stream completes.\n      // Daemon detects SSE content-type and disarms its timer anyway,\n      // but for non-SSE callers using forwardHttpStream this keeps\n      // things safe.\n      const frame: HttpRequestFrame = {\n        t: \"http_request\",\n        reqId,\n        method: req.method,\n        path: req.path,\n        ...(req.headers ? { headers: req.headers } : {}),\n        ...(body !== undefined ? { body } : {}),\n        timeoutMs: 24 * 60 * 60 * 1000, // 24h — effectively \"forever\"\n      }\n      return new Promise<TunnelHttpStreamResponse>((resolveHead, reject) => {\n        const timer = setTimeout(() => {\n          if (httpPending.has(reqId)) {\n            httpPending.delete(reqId)\n            reject(\n              new Error(\n                `Tunnel forwardHttpStream(${req.method} ${req.path}) head did not arrive within ${headTimeoutMs}ms.`\n              )\n            )\n          }\n        }, headTimeoutMs)\n        httpPending.set(reqId, {\n          mode: \"stream\",\n          resolveHead,\n          reject,\n          timer,\n          controller: null,\n          pendingChunks: [],\n          headEmitted: false,\n          ended: false,\n        })\n        opts.sink.send(frame)\n      })\n    },\n\n    async forwardWebSocket(\n      req: TunnelWebSocketOpenRequest\n    ): Promise<TunnelWebSocket> {\n      const h = await this.ready()\n      if (h.capabilities.wsForward !== true) {\n        throw new Error(\n          `Tunnel daemon '${h.label ?? \"(unnamed)\"}' does not advertise wsForward capability. Update the daemon to forward browser WS upgrades.`\n        )\n      }\n      const reqId = randomUUID()\n      const timeoutMs = req.openTimeoutMs ?? 30_000\n      const frame: WsOpenFrame = {\n        t: \"ws_open\",\n        reqId,\n        path: req.path,\n        ...(req.upstream ? { upstream: req.upstream } : {}),\n        ...(req.headers ? { headers: req.headers } : {}),\n        ...(req.protocols && req.protocols.length > 0\n          ? { protocols: req.protocols }\n          : {}),\n      }\n      return new Promise<TunnelWebSocket>((resolve, reject) => {\n        const timer = setTimeout(() => {\n          if (!wsOpenPending.has(reqId)) return\n          wsOpenPending.delete(reqId)\n          reject(\n            new Error(\n              `Tunnel forwardWebSocket(${req.path}) did not receive ws_open_ack within ${timeoutMs}ms.`\n            )\n          )\n        }, timeoutMs)\n        wsOpenPending.set(reqId, { resolve, reject, timer })\n        opts.sink.send(frame)\n      })\n    },\n\n    async close() {\n      opts.sink.close(\"client.close\")\n    },\n  }\n}\n\n/**\n * Internal ChildProcess duck. Public methods mirror the subset of\n * Node's ChildProcess that our ACP arm calls; double-underscored\n * methods are control hooks for the client.\n */\nclass TunnelChildDuck extends EventEmitter implements TunnelChildProcess {\n  readonly execId: string\n  pid: number | null\n  readonly stdin: Writable\n  readonly stdout: Readable\n  readonly stderr: Readable\n  private readonly sink: FrameSink\n  private exited = false\n\n  constructor(execId: string, pid: number, sink: FrameSink) {\n    super()\n    this.execId = execId\n    this.pid = pid > 0 ? pid : null\n    this.sink = sink\n\n    // stdout / stderr are passive Readables — consumers attach\n    // listeners and we push() data as it arrives.\n    this.stdout = new Readable({ read() {} })\n    this.stderr = new Readable({ read() {} })\n\n    // stdin is a Writable that converts each chunk to a `stdin` frame.\n    this.stdin = new Writable({\n      write(chunk: Buffer | string, _enc, cb) {\n        sink.send({\n          t: \"stdin\",\n          execId,\n          data: encodeData(chunk),\n        })\n        cb()\n      },\n      // Sending an empty stdin frame on `final` mirrors the local\n      // semantics of closing a child's stdin (signal EOF). Daemons\n      // ignore empty payloads, so this is safe even if the child\n      // doesn't care about EOF.\n      final(cb) {\n        sink.send({ t: \"stdin\", execId, data: \"\" })\n        cb()\n      },\n    })\n  }\n\n  __pushStdout(buf: Buffer): void {\n    this.stdout.push(buf)\n  }\n\n  __pushStderr(buf: Buffer): void {\n    this.stderr.push(buf)\n  }\n\n  __pushError(err: Error): void {\n    this.emit(\"error\", err)\n  }\n\n  __handleExit(frame: ExitFrame): void {\n    if (this.exited) return\n    this.exited = true\n    this.stdout.push(null)\n    this.stderr.push(null)\n    this.emit(\"exit\", frame.code, frame.signal)\n  }\n\n  __handleSinkClosed(): void {\n    if (this.exited) return\n    this.exited = true\n    this.stdout.push(null)\n    this.stderr.push(null)\n    this.emit(\n      \"exit\",\n      null,\n      \"SIGHUP\" // surrogate signal — the tunnel went away\n    )\n  }\n\n  kill(signal: NodeJS.Signals | number = \"SIGTERM\"): boolean {\n    if (this.exited) return false\n    this.sink.send({\n      t: \"kill\",\n      execId: this.execId,\n      signal: typeof signal === \"string\" ? signal : `SIG${signal}`,\n    })\n    return true\n  }\n\n  resize(cols: number, rows: number): void {\n    if (this.exited) return\n    this.sink.send({ t: \"resize\", execId: this.execId, cols, rows })\n  }\n}\n\n/**\n * Internal duck for a bridged WS. Mirrors the `TunnelWebSocket`\n * interface; double-underscored methods are control hooks called by\n * the client's frame router.\n *\n * Listener semantics:\n *   - `onMessage` fires for every `ws_message` frame routed here\n *   - `onClose` fires exactly once, either when the daemon emits\n *     `ws_close`, when the caller calls `.close()`, or when the\n *     underlying tunnel disappears (with code 1006 in that case)\n *   - `onError` fires for transport-level errors; close follows\n */\nclass TunnelWebSocketDuck implements TunnelWebSocket {\n  readonly protocol: string | null\n  private _readyState: \"open\" | \"closing\" | \"closed\" = \"open\"\n  private readonly reqId: string\n  private readonly sink: FrameSink\n  private readonly onCleanup: () => void\n  private readonly messageListeners = new Set<\n    (data: Buffer, isBinary: boolean) => void\n  >()\n  private readonly closeListeners = new Set<\n    (code: number, reason: string) => void\n  >()\n  private readonly errorListeners = new Set<(err: Error) => void>()\n\n  constructor(\n    reqId: string,\n    protocol: string | null,\n    sink: FrameSink,\n    onCleanup: () => void\n  ) {\n    this.reqId = reqId\n    this.protocol = protocol\n    this.sink = sink\n    this.onCleanup = onCleanup\n  }\n\n  get readyState(): \"open\" | \"closing\" | \"closed\" {\n    return this._readyState\n  }\n\n  send(data: string | Uint8Array): void {\n    if (this._readyState !== \"open\") return\n    const bytes =\n      typeof data === \"string\" ? Buffer.from(data, \"utf8\") : Buffer.from(data)\n    this.sink.send({\n      t: \"ws_message\",\n      reqId: this.reqId,\n      data: encodeData(bytes),\n      binary: typeof data !== \"string\",\n    })\n  }\n\n  close(code: number = 1000, reason?: string): void {\n    if (this._readyState === \"closed\") return\n    if (this._readyState === \"open\") {\n      this._readyState = \"closing\"\n      this.sink.send({\n        t: \"ws_close\",\n        reqId: this.reqId,\n        code,\n        ...(reason ? { reason } : {}),\n      })\n    }\n    // Fire local close immediately so the caller's onClose handler\n    // runs without waiting for the daemon's echo. The daemon's later\n    // ws_close (if any) is dropped because routeIncoming has already\n    // removed us from wsByReq via __handleClose.\n    this.__handleClose(code, reason ?? \"\")\n  }\n\n  onMessage(\n    listener: (data: Buffer, isBinary: boolean) => void\n  ): () => void {\n    this.messageListeners.add(listener)\n    return () => this.messageListeners.delete(listener)\n  }\n\n  onClose(listener: (code: number, reason: string) => void): () => void {\n    this.closeListeners.add(listener)\n    return () => this.closeListeners.delete(listener)\n  }\n\n  onError(listener: (err: Error) => void): () => void {\n    this.errorListeners.add(listener)\n    return () => this.errorListeners.delete(listener)\n  }\n\n  __handleMessage(data: Buffer, isBinary: boolean): void {\n    if (this._readyState !== \"open\") return\n    for (const l of this.messageListeners) {\n      try {\n        l(data, isBinary)\n      } catch {\n        /* listener threw — don't let it tear down siblings */\n      }\n    }\n  }\n\n  __handleClose(code: number, reason: string): void {\n    if (this._readyState === \"closed\") return\n    this._readyState = \"closed\"\n    this.onCleanup()\n    for (const l of this.closeListeners) {\n      try {\n        l(code, reason)\n      } catch {\n        /* swallow */\n      }\n    }\n    this.messageListeners.clear()\n    this.closeListeners.clear()\n    this.errorListeners.clear()\n  }\n\n  __handleSinkClosed(): void {\n    if (this._readyState === \"closed\") return\n    for (const l of this.errorListeners) {\n      try {\n        l(new Error(\"Tunnel closed mid-WS.\"))\n      } catch {\n        /* swallow */\n      }\n    }\n    this.__handleClose(1006, \"tunnel_closed\")\n  }\n}\n","/**\n * Adapter from a WebSocket-shaped object to a `FrameSink`. Works with\n * both the browser-native WebSocket API and the `ws` library's server\n * sockets — anything with `send`, `close`, and `addEventListener`-style\n * `message`/`close` events.\n *\n * Why a duck-typed shape and not `import(\"ws\")`: the cli, the host,\n * and (eventually) browser hosts all need to wrap WS instances they\n * obtained themselves. Importing `ws` in this package would force\n * every consumer to install it even when running in environments\n * (Bun, Deno, browser) that ship native WebSocket.\n */\n\nimport { encodeFrame, parseFrame, type TunnelFrame } from \"./frames.js\"\nimport type { FrameSink } from \"./transport.js\"\n\nexport interface WebSocketLike {\n  send(data: string): void\n  close(code?: number, reason?: string): void\n  readyState: number\n  addEventListener(\n    event: \"message\",\n    handler: (ev: { data: string | ArrayBuffer | Buffer }) => void\n  ): void\n  addEventListener(event: \"close\", handler: () => void): void\n  addEventListener(event: \"error\", handler: (ev: { message?: string }) => void): void\n  removeEventListener(event: string, handler: (...args: never[]) => void): void\n}\n\nconst READY_OPEN = 1\n\nexport function wrapWebSocket(ws: WebSocketLike): FrameSink {\n  const frameHandlers = new Set<(frame: TunnelFrame) => void>()\n  const closeHandlers = new Set<(reason?: string) => void>()\n  let isOpen = ws.readyState === READY_OPEN\n\n  // The `ws` library delivers Buffer; the browser delivers string or\n  // ArrayBuffer. We coerce to string and parse — everything we send is\n  // JSON text, so non-text payloads are protocol violations and get\n  // dropped.\n  const onMessage = (ev: { data: string | ArrayBuffer | Buffer }): void => {\n    let text: string\n    if (typeof ev.data === \"string\") text = ev.data\n    else if (ev.data instanceof ArrayBuffer) text = Buffer.from(ev.data).toString(\"utf8\")\n    else text = (ev.data as Buffer).toString(\"utf8\")\n    const frame = parseFrame(text)\n    if (!frame) return\n    for (const h of frameHandlers) h(frame)\n  }\n\n  const onClose = (): void => {\n    if (!isOpen) return\n    isOpen = false\n    for (const h of closeHandlers) h(\"transport.closed\")\n    frameHandlers.clear()\n    closeHandlers.clear()\n  }\n\n  const onError = (ev: { message?: string }): void => {\n    if (!isOpen) return\n    isOpen = false\n    for (const h of closeHandlers) h(ev.message ?? \"transport.error\")\n    frameHandlers.clear()\n    closeHandlers.clear()\n  }\n\n  ws.addEventListener(\"message\", onMessage)\n  ws.addEventListener(\"close\", onClose)\n  ws.addEventListener(\"error\", onError)\n\n  return {\n    get isOpen() {\n      return isOpen\n    },\n    send(frame) {\n      if (!isOpen) return\n      try {\n        ws.send(encodeFrame(frame))\n      } catch {\n        // Send-on-closed-socket is a benign race; rely on the close\n        // handler to flip isOpen and let listeners drain naturally.\n      }\n    },\n    close(reason) {\n      if (!isOpen) return\n      try {\n        ws.close(1000, reason)\n      } catch {\n        // ignore\n      }\n    },\n    onFrame(handler) {\n      frameHandlers.add(handler)\n      return () => frameHandlers.delete(handler)\n    },\n    onClose(handler) {\n      closeHandlers.add(handler)\n      return () => closeHandlers.delete(handler)\n    },\n  }\n}\n"]}