@agimon-ai/doompi-core 0.0.1-alpha.100

package/dist/remoteRuntime.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"remoteRuntime.cjs","names":["REMOTE_HTTP_ROUTE","REMOTE_CHANNEL_ROUTE","pipeline","Readable","createRemoteAccessStore","path","createDevProxyStore","Hono","isPublicSessionMcpRoute","originVerdict","localOriginPolicy","isPublicPairingRoute","getCookie","DEVICE_COOKIE","isDevProxyPath","createRemoteAccess","createTunnelLauncher","WebSocketServer","createServer","parseProxyPath","parseDoomSocketPath","WebSocket","stepUpActionFor","STEP_UP_HEADER","DOOM_API_CALLER_LOCALITY_HEADER","DOOM_API_CALLER_DEVICE_ID_HEADER","DOOM_API_CALLER_STEP_UP_HEADER","isSessionMcpHostRoute"],"sources":["../src/server/remoteRuntime.ts"],"sourcesContent":["import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';\nimport path from 'node:path';\nimport { Readable } from 'node:stream';\nimport { pipeline } from 'node:stream/promises';\n\nimport { Hono } from 'hono';\nimport { getCookie } from 'hono/cookie';\nimport WebSocket, { WebSocketServer, type RawData } from 'ws';\n\nimport { DEVICE_COOKIE, REMOTE_CHANNEL_ROUTE, REMOTE_HTTP_ROUTE, STEP_UP_HEADER } from '../constants/remote';\nimport {\n  DOOM_API_CALLER_DEVICE_ID_HEADER,\n  DOOM_API_CALLER_LOCALITY_HEADER,\n  DOOM_API_CALLER_STEP_UP_HEADER,\n  parseDoomSocketPath,\n} from '../schemas/packageApi';\nimport { isDevProxyPath, parseProxyPath } from '../services/devProxyPolicy';\nimport { createDevProxyStore } from '../services/devProxyStore';\nimport { createRemoteAccess, type RemoteAccess } from '../services/remoteAccess';\nimport { createRemoteAccessStore } from '../services/remoteAccessStore';\nimport {\n  isPublicPairingRoute,\n  originVerdict,\n  type GuardListener,\n  localOriginPolicy,\n} from '../services/remoteGuardPolicy';\nimport { createTunnelLauncher, reapStaleTunnel } from '../services/tunnelProcess';\nimport { stepUpActionFor } from '../services/webauthnPolicy';\nimport { type TunnelLauncher } from '../types/remote';\nimport { registerDevProxyRoutes } from './devProxyRoutes';\nimport { relayDevProxySocket } from './devProxySocket';\nimport { registerRemoteRoutes } from './remoteRoutes';\nimport { isPublicSessionMcpRoute, isSessionMcpHostRoute } from './sessionMcpRoutes';\n\nconst MAX_REQUEST_BYTES = 8 * 1024 * 1024;\nconst TUNNEL_HEADERS_TIMEOUT_MS = 5_000;\nconst TUNNEL_REQUEST_TIMEOUT_MS = 10_000;\nconst TUNNEL_CONNECTION_LIMIT = 64;\nconst TUNNEL_REQUESTS_PER_SOCKET = 100;\nconst SEALED_HTTP_VERSION = 1;\nconst SEALED_HTTP_METHODS = new Set(['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE']);\n/** HMAC-authenticated peer routes are the only non-device tunnel APIs. */\nconst SESSION_PEER_INBOX_ROUTE = '/api/plugins/session-peer/inbox';\nconst VOICE_PEER_ROUTES = new Set(['/api/plugins/voice/peer', '/api/plugins/voice/peer-ownership']);\nconst FORBIDDEN_HEADERS = new Set([\n  'authorization',\n  'connection',\n  'content-length',\n  'cookie',\n  'forwarded',\n  'host',\n  'origin',\n  'transfer-encoding',\n  'upgrade',\n  'x-doompi-token',\n  'x-forwarded-for',\n  'x-forwarded-host',\n  'x-forwarded-proto',\n]);\n\ninterface SealedHttpRequest {\n  v: number;\n  method: string;\n  target: string;\n  headers: Array<[string, string]>;\n  body?: string;\n}\n\nfunction sealedRequest(value: unknown): SealedHttpRequest | undefined {\n  if (typeof value !== 'object' || value === null) return undefined;\n  const request = value as Partial<SealedHttpRequest>;\n  if (\n    request.v !== SEALED_HTTP_VERSION ||\n    typeof request.method !== 'string' ||\n    !SEALED_HTTP_METHODS.has(request.method) ||\n    typeof request.target !== 'string' ||\n    !request.target.startsWith('/') ||\n    request.target.startsWith('//') ||\n    request.target.includes('#') ||\n    !Array.isArray(request.headers) ||\n    !request.headers.every(\n      (header) => Array.isArray(header) && header.length === 2 && header.every((part) => typeof part === 'string'),\n    ) ||\n    (request.body !== undefined && typeof request.body !== 'string')\n  )\n    return undefined;\n  const parsed = new URL(request.target, 'http://doompi.local');\n  if (parsed.pathname === REMOTE_HTTP_ROUTE || parsed.pathname === REMOTE_CHANNEL_ROUTE) return undefined;\n  return request as SealedHttpRequest;\n}\n\nfunction decodedBody(value: string | undefined): Buffer | undefined {\n  if (value === undefined) return Buffer.alloc(0);\n  if (!/^(?:[A-Za-z\\d+/]{4})*(?:[A-Za-z\\d+/]{2}==|[A-Za-z\\d+/]{3}=)?$/u.test(value)) return undefined;\n  const body = Buffer.from(value, 'base64');\n  return body.toString('base64') === value ? body : undefined;\n}\n\ninterface ListenerBindings {\n  listener: GuardListener;\n  incoming?: IncomingMessage;\n  sealedDeviceId?: string;\n}\n\nexport interface RemoteRuntimeOptions {\n  homeDirectory: string;\n  registrationToken: string;\n  bundleTrust(): { publicKey: string; revision: number } | undefined;\n  onNotice(message: string): void;\n  /** The listener to which a sealed, authenticated request is forwarded. */\n  forward(request: Request): Promise<Response>;\n  connectProtocol(pathname: string): WebSocket;\n  launchTunnel?: TunnelLauncher;\n  /** Ports the host itself listens on, which a dev proxy target may never name. */\n  reservedPorts?: () => readonly (number | undefined)[];\n}\n\nexport interface RemoteRuntime {\n  readonly remote: RemoteAccess;\n  fetchLocal(request: Request): Promise<Response>;\n  close(): Promise<void>;\n}\n\nasync function readBody(request: IncomingMessage): Promise<Buffer> {\n  const chunks: Buffer[] = [];\n  let size = 0;\n  for await (const chunk of request) {\n    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);\n    size += bytes.byteLength;\n    if (size > MAX_REQUEST_BYTES) throw new Error('The tunnel request body is too large.');\n    chunks.push(bytes);\n  }\n  return Buffer.concat(chunks);\n}\n\nasync function writeResponse(response: ServerResponse, result: Response): Promise<void> {\n  response.writeHead(result.status, Object.fromEntries(result.headers.entries()));\n  if (result.body === null) {\n    response.end();\n    return;\n  }\n  await pipeline(Readable.fromWeb(result.body as import('node:stream/web').ReadableStream), response);\n}\n\n/** One global control plane and a second socket dedicated to public tunnel traffic. */\nexport function createRemoteRuntime(options: RemoteRuntimeOptions): RemoteRuntime {\n  const store = createRemoteAccessStore({\n    stateDir: path.join(options.homeDirectory, '.doompi', 'web'),\n    onNotice: (message) => options.onNotice(message),\n  });\n  reapStaleTunnel(store.directory, (message) => options.onNotice(message));\n  const devProxy = createDevProxyStore({ stateDir: store.directory, onNotice: (message) => options.onNotice(message) });\n  const app = new Hono<{ Bindings: ListenerBindings }>();\n  let remote: RemoteAccess;\n  let frontendOrigin: string | undefined;\n  app.use('*', async (context, next) => {\n    if (context.env.listener === 'local') return next();\n    const path = context.req.path;\n    const publicSessionMcp = isPublicSessionMcpRoute(context.req.method, path);\n    const publicSessionPeer = context.req.method === 'POST' && path === SESSION_PEER_INBOX_ROUTE;\n    const publicVoicePeer = context.req.method === 'POST' && VOICE_PEER_ROUTES.has(path);\n    const verdict = originVerdict({\n      listener: 'tunnel',\n      // Exact OAuth, MCP, and HMAC-authenticated peer routes authenticate at the\n      // application layer. Treat an absent Origin like a server-to-server read.\n      method: publicSessionMcp || publicSessionPeer || publicVoicePeer ? 'GET' : context.req.method,\n      isUpgrade: false,\n      origin: context.req.header('origin'),\n      host: context.req.header('host'),\n      local: localOriginPolicy(0),\n      tunnel: remote.tunnelPolicy(),\n    });\n    if (verdict !== 'allow') return context.json({ error: `Tunnel request refused: ${verdict}.` }, 403);\n    if (isPublicPairingRoute(context.req.method, path) || publicSessionMcp || publicSessionPeer || publicVoicePeer)\n      return next();\n    const device = remote.authorize(getCookie(context, DEVICE_COOKIE, 'host'));\n    if (device === undefined) return context.json({ error: 'This device is not paired.' }, 401);\n    if (context.env.sealedDeviceId === device) return next();\n    // A proxied dev site issues its own subresource requests and form posts, none of which can go\n    // through a gateway that seals whole JSON responses. The same predicate the proxy route uses\n    // refuses dot segments, so a path granted here cannot resolve into /api/.\n    if (isDevProxyPath(path)) return next();\n    if (context.req.method === 'POST' && (path === REMOTE_CHANNEL_ROUTE || path === REMOTE_HTTP_ROUTE)) return next();\n    if ((context.req.method === 'GET' || context.req.method === 'HEAD') && !path.startsWith('/api/')) return next();\n    return context.json({ error: 'Remote HTTP requests must use the sealed gateway.' }, 401);\n  });\n\n  remote = createRemoteAccess({\n    store,\n    launchTunnel:\n      options.launchTunnel ??\n      createTunnelLauncher({\n        stateDir: store.directory,\n        onNotice: (message) => options.onNotice(message),\n        onExit: (message) => {\n          options.onNotice(`remote access: ${message}`);\n          void remote.disable();\n        },\n      }),\n    bindListener: async () => {\n      const webSockets = new WebSocketServer({ noServer: true, maxPayload: MAX_REQUEST_BYTES });\n      const server = createServer((incoming, outgoing) => {\n        void (async () => {\n          const abort = new AbortController();\n          const disconnected = (): void => abort.abort();\n          incoming.once('aborted', disconnected);\n          outgoing.once('close', disconnected);\n          try {\n            const url = new URL(incoming.url ?? '/', `http://${incoming.headers.host ?? 'localhost'}`);\n            const headers = new Headers();\n            for (const [name, value] of Object.entries(incoming.headers))\n              if (value !== undefined) headers.set(name, Array.isArray(value) ? value.join(', ') : value);\n            const body = incoming.method === 'GET' || incoming.method === 'HEAD' ? undefined : await readBody(incoming);\n            const request = new Request(url, {\n              method: incoming.method,\n              headers,\n              signal: abort.signal,\n              ...(body === undefined ? {} : { body }),\n            });\n            await writeResponse(outgoing, await app.fetch(request, { listener: 'tunnel', incoming }));\n          } finally {\n            incoming.off('aborted', disconnected);\n            outgoing.off('close', disconnected);\n          }\n        })().catch((error: unknown) => {\n          options.onNotice(`tunnel request failed: ${String(error)}`);\n          if (!outgoing.headersSent) {\n            outgoing.writeHead(500, { 'content-type': 'application/json' });\n            outgoing.end(JSON.stringify({ error: 'The tunnel request failed.' }));\n          } else outgoing.destroy();\n        });\n      });\n      server.on('upgrade', (incoming, socket, head) => {\n        const url = new URL(incoming.url ?? '/', `http://${incoming.headers.host ?? 'localhost'}`);\n        const verdict = originVerdict({\n          listener: 'tunnel',\n          method: incoming.method ?? 'GET',\n          isUpgrade: true,\n          origin: incoming.headers.origin,\n          host: incoming.headers.host,\n          local: localOriginPolicy(0),\n          tunnel: remote.tunnelPolicy(),\n        });\n        const cookies = new Map(\n          (incoming.headers.cookie ?? '').split(';').map((part) => {\n            const at = part.indexOf('=');\n            return [part.slice(0, at).trim(), part.slice(at + 1).trim()];\n          }),\n        );\n        const device = remote.authorize(cookies.get(`__Host-${DEVICE_COOKIE}`));\n        // Hot module reload: a paired device's dev-site socket goes to the registered target.\n        if (isDevProxyPath(url.pathname) && verdict === 'allow' && device !== undefined) {\n          const parsed = parseProxyPath(url.pathname);\n          const target = parsed.kind === 'match' ? devProxy.find(parsed.name) : undefined;\n          if (parsed.kind !== 'match' || target === undefined) {\n            socket.write('HTTP/1.1 404 Not Found\\r\\n\\r\\n');\n            socket.destroy();\n            return;\n          }\n          webSockets.handleUpgrade(incoming, socket, head, (client) => {\n            const untrack = remote.trackSocket(device, (code, reason) => client.close(code, reason));\n            client.once('close', untrack);\n            relayDevProxySocket(client, {\n              port: target.port,\n              upstreamPath: `${parsed.upstreamPath}${url.search}`,\n              protocols: incoming.headers['sec-websocket-protocol'],\n              onNotice: (message) => options.onNotice(message),\n            });\n          });\n          return;\n        }\n        const channel = device === undefined ? undefined : remote.channelFor(device, 'protocol');\n        if (!parseDoomSocketPath(url.pathname) || verdict !== 'allow' || !device || !channel) {\n          socket.write('HTTP/1.1 403 Forbidden\\r\\n\\r\\n');\n          socket.destroy();\n          return;\n        }\n        webSockets.handleUpgrade(incoming, socket, head, (client) => {\n          let upstream: WebSocket;\n          try {\n            upstream = options.connectProtocol(url.pathname);\n          } catch (error) {\n            options.onNotice(`remote protocol could not connect: ${String(error)}`);\n            client.close(1011, 'protocol unavailable');\n            return;\n          }\n          const pending: Buffer[] = [];\n          let pendingBytes = 0;\n          let closed = false;\n          const untrack = remote.trackSocket(device, (code, reason) => client.close(code, reason));\n          const close = (): void => {\n            if (closed) return;\n            closed = true;\n            untrack();\n            client.close();\n            upstream.close();\n          };\n          client.on('message', (raw: RawData) => {\n            if (closed) return;\n            const bytes = Array.isArray(raw) ? Buffer.concat(raw) : Buffer.from(raw as Buffer);\n            let envelope: unknown;\n            try {\n              envelope = JSON.parse(bytes.toString('utf8')) as unknown;\n            } catch {\n              close();\n              return;\n            }\n            const opened = channel.open(envelope);\n            if (!opened.ok) {\n              close();\n              return;\n            }\n            const plain = Buffer.from(opened.plaintext);\n            if (upstream.readyState === WebSocket.OPEN) upstream.send(plain);\n            else {\n              pendingBytes += plain.byteLength;\n              if (pendingBytes > MAX_REQUEST_BYTES) close();\n              else pending.push(plain);\n            }\n          });\n          upstream.on('open', () => {\n            for (const bytes of pending) upstream.send(bytes);\n            pending.length = 0;\n            pendingBytes = 0;\n          });\n          upstream.on('message', (raw: RawData) => {\n            if (closed) return;\n            const plain = Array.isArray(raw) ? Buffer.concat(raw) : Buffer.from(raw as Buffer);\n            const sealed = channel.seal(plain);\n            if (!sealed.ok) {\n              close();\n              return;\n            }\n            client.send(Buffer.from(JSON.stringify(sealed.envelope)));\n          });\n          client.on('close', close);\n          client.on('error', close);\n          upstream.on('close', close);\n          upstream.on('error', (error) => {\n            options.onNotice(`remote protocol failed: ${error.message}`);\n            close();\n          });\n        });\n      });\n      server.headersTimeout = TUNNEL_HEADERS_TIMEOUT_MS;\n      server.requestTimeout = TUNNEL_REQUEST_TIMEOUT_MS;\n      server.maxConnections = TUNNEL_CONNECTION_LIMIT;\n      server.maxRequestsPerSocket = TUNNEL_REQUESTS_PER_SOCKET;\n      await new Promise<void>((resolve, reject) => {\n        server.once('error', reject);\n        server.listen(0, '127.0.0.1', resolve);\n      });\n      const address = server.address();\n      if (!address || typeof address === 'string') throw new Error('The tunnel listener has no TCP address.');\n      return {\n        port: address.port,\n        close: async () => {\n          for (const client of webSockets.clients) client.terminate();\n          webSockets.close();\n          server.closeAllConnections();\n          await new Promise<void>((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())));\n        },\n      };\n    },\n    bundleTrust: () => options.bundleTrust(),\n    onNotice: (message) => options.onNotice(message),\n  });\n  registerRemoteRoutes(app as unknown as Hono, {\n    remote,\n    listenerOf: (context) => (context.env as ListenerBindings).listener,\n  });\n  registerDevProxyRoutes(app as unknown as Hono, {\n    store: devProxy,\n    listenerOf: (context) => (context.env as ListenerBindings).listener,\n    // Read per call: the tunnel port exists only while remote access is on, and a target checked\n    // against a stale list could end up aimed at the cockpit itself.\n    reservedPorts: () => [\n      remote.tunnelPort(),\n      frontendOrigin === undefined ? undefined : Number(new URL(frontendOrigin).port),\n      ...(options.reservedPorts?.() ?? []),\n    ],\n    onNotice: (message) => options.onNotice(message),\n  });\n  app.post('/api/remote/frontend', async (context) => {\n    if (context.env.listener !== 'local')\n      return context.json({ error: 'This action is only available on the host.' }, 403);\n    if (context.req.header('x-doompi-web-registration') !== options.registrationToken)\n      return context.json({ error: 'The web presentation server was not authenticated.' }, 403);\n    let body: unknown;\n    try {\n      body = await context.req.json();\n    } catch {\n      return context.json({ error: 'A loopback web origin is required.' }, 400);\n    }\n    const origin = typeof body === 'object' && body !== null && 'origin' in body ? body.origin : undefined;\n    if (typeof origin !== 'string') return context.json({ error: 'A loopback web origin is required.' }, 400);\n    let parsed: URL;\n    try {\n      parsed = new URL(origin);\n    } catch {\n      return context.json({ error: 'The web origin is invalid.' }, 400);\n    }\n    if (\n      parsed.protocol !== 'http:' ||\n      !['127.0.0.1', 'localhost', '[::1]'].includes(parsed.hostname) ||\n      parsed.pathname !== '/' ||\n      parsed.search !== '' ||\n      parsed.hash !== '' ||\n      !parsed.port\n    )\n      return context.json({ error: 'The web origin must be a loopback HTTP listener.' }, 400);\n    frontendOrigin = parsed.origin;\n    return context.json({ ok: true });\n  });\n  app.post(REMOTE_HTTP_ROUTE, async (context) => {\n    const device = remote.authorize(getCookie(context, DEVICE_COOKIE, 'host'));\n    const channel = device === undefined ? undefined : remote.channelFor(device, 'http');\n    if (!device || !channel) return context.json({ error: 'A sealed paired device is required.' }, 401);\n    let envelope: unknown;\n    try {\n      envelope = await context.req.json();\n    } catch {\n      return context.json({ error: 'The sealed request envelope was malformed.' }, 400);\n    }\n    const opened = channel.open(envelope);\n    if (!opened.ok) return context.json({ error: `The sealed request was refused: ${opened.failure}.` }, 400);\n    let decoded: unknown;\n    try {\n      decoded = JSON.parse(new TextDecoder().decode(opened.plaintext)) as unknown;\n    } catch {\n      return context.json({ error: 'The sealed HTTP request was malformed.' }, 400);\n    }\n    const inner = sealedRequest(decoded);\n    const body = decodedBody(inner?.body);\n    if (!inner || !body) return context.json({ error: 'The sealed HTTP request was invalid.' }, 400);\n    const target = new URL(inner.target, 'http://doompi.local');\n    const headers = new Headers();\n    for (const [name, value] of inner.headers) {\n      const normalized = name.toLowerCase();\n      if (FORBIDDEN_HEADERS.has(normalized) || normalized.startsWith('sec-')) continue;\n      headers.append(name, value);\n    }\n    const action = stepUpActionFor(inner.method, target.pathname);\n    let stepUpDenied = false;\n    if (action && remote.stepUpRequired(action)) {\n      const assertion = headers.get(STEP_UP_HEADER);\n      let credential: unknown;\n      try {\n        credential = assertion ? JSON.parse(Buffer.from(assertion, 'base64url').toString('utf8')) : undefined;\n      } catch {\n        credential = undefined;\n      }\n      const ceremony = credential as { ceremonyId?: unknown; response?: unknown } | undefined;\n      if (\n        typeof ceremony?.ceremonyId !== 'string' ||\n        !(await remote.passkeys().finishStepUp(ceremony.ceremonyId, `device:${device}`, action, ceremony.response))\n      )\n        stepUpDenied = true;\n    }\n    headers.delete(STEP_UP_HEADER);\n    // Caller stamps are assigned after the sealed request is opened. They never\n    // originate from browser-controlled sealed headers.\n    headers.set(DOOM_API_CALLER_LOCALITY_HEADER, 'remote');\n    headers.set(DOOM_API_CALLER_DEVICE_ID_HEADER, device);\n    headers.set(DOOM_API_CALLER_STEP_UP_HEADER, action && remote.stepUpRequired(action) ? 'verified' : 'not-required');\n    let response: Response;\n    if (stepUpDenied) {\n      response = context.json({ error: 'This action needs a fresh passkey gesture.', action }, 401);\n    } else if (isSessionMcpHostRoute(target.pathname)) {\n      response = context.json({ error: 'Session MCP management is only available on the host.' }, 403);\n    } else {\n      const internal = new Request(target, {\n        method: inner.method,\n        headers,\n        ...(inner.method === 'GET' || inner.method === 'HEAD' ? {} : { body }),\n      });\n      if (target.pathname === '/api/remote' || target.pathname.startsWith('/api/remote/')) {\n        headers.set('cookie', context.req.header('cookie') ?? '');\n        headers.set('host', context.req.header('host') ?? '');\n        headers.set('origin', context.req.header('origin') ?? '');\n        response = await app.fetch(new Request(internal, { headers }), {\n          listener: 'tunnel',\n          sealedDeviceId: device,\n        });\n      } else response = await options.forward(internal);\n    }\n    const responseBody = Buffer.from(await response.arrayBuffer());\n    const sealed = channel.seal(\n      new TextEncoder().encode(\n        JSON.stringify({\n          v: SEALED_HTTP_VERSION,\n          status: response.status,\n          headers: [...response.headers.entries()],\n          body: responseBody.toString('base64'),\n        }),\n      ),\n    );\n    return sealed.ok\n      ? context.json(sealed.envelope)\n      : context.json({ error: `The sealed response failed: ${sealed.failure}.` }, 503);\n  });\n  app.on(['POST', 'DELETE'], '*', async (context) => {\n    if (\n      !isPublicSessionMcpRoute(context.req.method, context.req.path) &&\n      !(context.req.method === 'POST' && context.req.path === SESSION_PEER_INBOX_ROUTE) &&\n      !(context.req.method === 'POST' && VOICE_PEER_ROUTES.has(context.req.path))\n    )\n      return context.notFound();\n    return options.forward(context.req.raw);\n  });\n  app.on(['GET', 'HEAD'], '*', async (context) => {\n    if (isPublicSessionMcpRoute(context.req.method, context.req.path)) return options.forward(context.req.raw);\n    if (context.req.path.startsWith('/api/')) return context.json({ error: 'Not found.' }, 404);\n    if (context.req.path === '/' && remote.authorize(getCookie(context, DEVICE_COOKIE, 'host')) === undefined)\n      return context.redirect('/pair');\n    if (context.req.path === '/bundle-manifest.json' || context.req.path.startsWith('/bundle-assets/')) {\n      const from = new URL(context.req.url);\n      return await options.forward(\n        new Request(new URL(`${from.pathname}${from.search}`, 'http://doompi.local'), {\n          method: context.req.method,\n        }),\n      );\n    }\n    if (!frontendOrigin) return context.json({ error: 'The web presentation server is unavailable.' }, 503);\n    const from = new URL(context.req.url);\n    const target = new URL(`${from.pathname}${from.search}`, frontendOrigin);\n    const result = await fetch(target, { method: context.req.method, redirect: 'manual' });\n    const headers = new Headers(result.headers);\n    headers.delete('set-cookie');\n    return new Response(result.body, { status: result.status, headers });\n  });\n\n  return {\n    remote,\n    fetchLocal: async (request) => app.fetch(request, { listener: 'local' }),\n    close: async () => remote.close(),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,MAAM,oBAAoB;AAC1B,MAAM,4BAA4B;AAClC,MAAM,4BAA4B;AAClC,MAAM,0BAA0B;AAChC,MAAM,6BAA6B;AACnC,MAAM,sBAAsB;AAC5B,MAAM,sCAAsB,IAAI,IAAI;CAAC;CAAO;CAAQ;CAAQ;CAAO;CAAS;AAAQ,CAAC;;AAErF,MAAM,2BAA2B;AACjC,MAAM,oCAAoB,IAAI,IAAI,CAAC,2BAA2B,mCAAmC,CAAC;AAClG,MAAM,oCAAoB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAUD,SAAS,cAAc,OAA+C;CACpE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO,KAAA;CACxD,MAAM,UAAU;CAChB,IACE,QAAQ,MAAM,uBACd,OAAO,QAAQ,WAAW,YAC1B,CAAC,oBAAoB,IAAI,QAAQ,MAAM,KACvC,OAAO,QAAQ,WAAW,YAC1B,CAAC,QAAQ,OAAO,WAAW,GAAG,KAC9B,QAAQ,OAAO,WAAW,IAAI,KAC9B,QAAQ,OAAO,SAAS,GAAG,KAC3B,CAAC,MAAM,QAAQ,QAAQ,OAAO,KAC9B,CAAC,QAAQ,QAAQ,OACd,WAAW,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,KAAK,OAAO,OAAO,SAAS,OAAO,SAAS,QAAQ,CAC7G,KACC,QAAQ,SAAS,KAAA,KAAa,OAAO,QAAQ,SAAS,UAEvD,OAAO,KAAA;CACT,MAAM,SAAS,IAAI,IAAI,QAAQ,QAAQ,qBAAqB;CAC5D,IAAI,OAAO,aAAaA,eAAAA,qBAAqB,OAAO,aAAaC,eAAAA,sBAAsB,OAAO,KAAA;CAC9F,OAAO;AACT;AAEA,SAAS,YAAY,OAA+C;CAClE,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,MAAM,CAAC;CAC9C,IAAI,CAAC,iEAAiE,KAAK,KAAK,GAAG,OAAO,KAAA;CAC1F,MAAM,OAAO,OAAO,KAAK,OAAO,QAAQ;CACxC,OAAO,KAAK,SAAS,QAAQ,MAAM,QAAQ,OAAO,KAAA;AACpD;AA2BA,eAAe,SAAS,SAA2C;CACjE,MAAM,SAAmB,CAAC;CAC1B,IAAI,OAAO;CACX,WAAW,MAAM,SAAS,SAAS;EACjC,MAAM,QAAQ,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK;EAChE,QAAQ,MAAM;EACd,IAAI,OAAO,mBAAmB,MAAM,IAAI,MAAM,uCAAuC;EACrF,OAAO,KAAK,KAAK;CACnB;CACA,OAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,eAAe,cAAc,UAA0B,QAAiC;CACtF,SAAS,UAAU,OAAO,QAAQ,OAAO,YAAY,OAAO,QAAQ,QAAQ,CAAC,CAAC;CAC9E,IAAI,OAAO,SAAS,MAAM;EACxB,SAAS,IAAI;EACb;CACF;CACA,OAAA,GAAMC,qBAAAA,SAAAA,CAASC,YAAAA,SAAS,QAAQ,OAAO,IAAgD,GAAG,QAAQ;AACpG;;AAGA,SAAgB,oBAAoB,SAA8C;CAChF,MAAM,QAAQC,gBAAAA,wBAAwB;EACpC,UAAUC,UAAAA,QAAK,KAAK,QAAQ,eAAe,WAAW,KAAK;EAC3D,WAAW,YAAY,QAAQ,SAAS,OAAO;CACjD,CAAC;CACD,gBAAA,gBAAgB,MAAM,YAAY,YAAY,QAAQ,SAAS,OAAO,CAAC;CACvE,MAAM,WAAWC,gBAAAA,oBAAoB;EAAE,UAAU,MAAM;EAAW,WAAW,YAAY,QAAQ,SAAS,OAAO;CAAE,CAAC;CACpH,MAAM,MAAM,IAAIC,KAAAA,KAAqC;CACrD,IAAI;CACJ,IAAI;CACJ,IAAI,IAAI,KAAK,OAAO,SAAS,SAAS;EACpC,IAAI,QAAQ,IAAI,aAAa,SAAS,OAAO,KAAK;EAClD,MAAM,OAAO,QAAQ,IAAI;EACzB,MAAM,mBAAmBC,yBAAAA,wBAAwB,QAAQ,IAAI,QAAQ,IAAI;EACzE,MAAM,oBAAoB,QAAQ,IAAI,WAAW,UAAU,SAAS;EACpE,MAAM,kBAAkB,QAAQ,IAAI,WAAW,UAAU,kBAAkB,IAAI,IAAI;EACnF,MAAM,UAAUC,gBAAAA,cAAc;GAC5B,UAAU;GAGV,QAAQ,oBAAoB,qBAAqB,kBAAkB,QAAQ,QAAQ,IAAI;GACvF,WAAW;GACX,QAAQ,QAAQ,IAAI,OAAO,QAAQ;GACnC,MAAM,QAAQ,IAAI,OAAO,MAAM;GAC/B,OAAOC,gBAAAA,kBAAkB,CAAC;GAC1B,QAAQ,OAAO,aAAa;EAC9B,CAAC;EACD,IAAI,YAAY,SAAS,OAAO,QAAQ,KAAK,EAAE,OAAO,2BAA2B,QAAQ,GAAG,GAAG,GAAG;EAClG,IAAIC,gBAAAA,qBAAqB,QAAQ,IAAI,QAAQ,IAAI,KAAK,oBAAoB,qBAAqB,iBAC7F,OAAO,KAAK;EACd,MAAM,SAAS,OAAO,WAAA,GAAUC,YAAAA,UAAAA,CAAU,SAASC,eAAAA,eAAe,MAAM,CAAC;EACzE,IAAI,WAAW,KAAA,GAAW,OAAO,QAAQ,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;EAC1F,IAAI,QAAQ,IAAI,mBAAmB,QAAQ,OAAO,KAAK;EAIvD,IAAIC,cAAAA,eAAe,IAAI,GAAG,OAAO,KAAK;EACtC,IAAI,QAAQ,IAAI,WAAW,WAAW,SAASb,eAAAA,wBAAwB,SAASD,eAAAA,oBAAoB,OAAO,KAAK;EAChH,KAAK,QAAQ,IAAI,WAAW,SAAS,QAAQ,IAAI,WAAW,WAAW,CAAC,KAAK,WAAW,OAAO,GAAG,OAAO,KAAK;EAC9G,OAAO,QAAQ,KAAK,EAAE,OAAO,oDAAoD,GAAG,GAAG;CACzF,CAAC;CAED,SAASe,gBAAAA,mBAAmB;EAC1B;EACA,cACE,QAAQ,gBACRC,gBAAAA,qBAAqB;GACnB,UAAU,MAAM;GAChB,WAAW,YAAY,QAAQ,SAAS,OAAO;GAC/C,SAAS,YAAY;IACnB,QAAQ,SAAS,kBAAkB,SAAS;IAC5C,OAAY,QAAQ;GACtB;EACF,CAAC;EACH,cAAc,YAAY;GACxB,MAAM,aAAa,IAAIC,GAAAA,gBAAgB;IAAE,UAAU;IAAM,YAAY;GAAkB,CAAC;GACxF,MAAM,UAAA,GAASC,UAAAA,aAAAA,EAAc,UAAU,aAAa;IAClD,CAAM,YAAY;KAChB,MAAM,QAAQ,IAAI,gBAAgB;KAClC,MAAM,qBAA2B,MAAM,MAAM;KAC7C,SAAS,KAAK,WAAW,YAAY;KACrC,SAAS,KAAK,SAAS,YAAY;KACnC,IAAI;MACF,MAAM,MAAM,IAAI,IAAI,SAAS,OAAO,KAAK,UAAU,SAAS,QAAQ,QAAQ,aAAa;MACzF,MAAM,UAAU,IAAI,QAAQ;MAC5B,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,SAAS,OAAO,GACzD,IAAI,UAAU,KAAA,GAAW,QAAQ,IAAI,MAAM,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK;MAC5F,MAAM,OAAO,SAAS,WAAW,SAAS,SAAS,WAAW,SAAS,KAAA,IAAY,MAAM,SAAS,QAAQ;MAC1G,MAAM,UAAU,IAAI,QAAQ,KAAK;OAC/B,QAAQ,SAAS;OACjB;OACA,QAAQ,MAAM;OACd,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;MACvC,CAAC;MACD,MAAM,cAAc,UAAU,MAAM,IAAI,MAAM,SAAS;OAAE,UAAU;OAAU;MAAS,CAAC,CAAC;KAC1F,UAAU;MACR,SAAS,IAAI,WAAW,YAAY;MACpC,SAAS,IAAI,SAAS,YAAY;KACpC;IACF,EAAA,CAAG,CAAC,CAAC,OAAO,UAAmB;KAC7B,QAAQ,SAAS,0BAA0B,OAAO,KAAK,GAAG;KAC1D,IAAI,CAAC,SAAS,aAAa;MACzB,SAAS,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;MAC9D,SAAS,IAAI,KAAK,UAAU,EAAE,OAAO,6BAA6B,CAAC,CAAC;KACtE,OAAO,SAAS,QAAQ;IAC1B,CAAC;GACH,CAAC;GACD,OAAO,GAAG,YAAY,UAAU,QAAQ,SAAS;IAC/C,MAAM,MAAM,IAAI,IAAI,SAAS,OAAO,KAAK,UAAU,SAAS,QAAQ,QAAQ,aAAa;IACzF,MAAM,UAAUT,gBAAAA,cAAc;KAC5B,UAAU;KACV,QAAQ,SAAS,UAAU;KAC3B,WAAW;KACX,QAAQ,SAAS,QAAQ;KACzB,MAAM,SAAS,QAAQ;KACvB,OAAOC,gBAAAA,kBAAkB,CAAC;KAC1B,QAAQ,OAAO,aAAa;IAC9B,CAAC;IACD,MAAM,UAAU,IAAI,KACjB,SAAS,QAAQ,UAAU,GAAA,CAAI,MAAM,GAAG,CAAC,CAAC,KAAK,SAAS;KACvD,MAAM,KAAK,KAAK,QAAQ,GAAG;KAC3B,OAAO,CAAC,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7D,CAAC,CACH;IACA,MAAM,SAAS,OAAO,UAAU,QAAQ,IAAI,UAAUG,eAAAA,eAAe,CAAC;IAEtE,IAAIC,cAAAA,eAAe,IAAI,QAAQ,KAAK,YAAY,WAAW,WAAW,KAAA,GAAW;KAC/E,MAAM,SAASK,cAAAA,eAAe,IAAI,QAAQ;KAC1C,MAAM,SAAS,OAAO,SAAS,UAAU,SAAS,KAAK,OAAO,IAAI,IAAI,KAAA;KACtE,IAAI,OAAO,SAAS,WAAW,WAAW,KAAA,GAAW;MACnD,OAAO,MAAM,gCAAgC;MAC7C,OAAO,QAAQ;MACf;KACF;KACA,WAAW,cAAc,UAAU,QAAQ,OAAO,WAAW;MAC3D,MAAM,UAAU,OAAO,YAAY,SAAS,MAAM,WAAW,OAAO,MAAM,MAAM,MAAM,CAAC;MACvF,OAAO,KAAK,SAAS,OAAO;MAC5B,uBAAA,oBAAoB,QAAQ;OAC1B,MAAM,OAAO;OACb,cAAc,GAAG,OAAO,eAAe,IAAI;OAC3C,WAAW,SAAS,QAAQ;OAC5B,WAAW,YAAY,QAAQ,SAAS,OAAO;MACjD,CAAC;KACH,CAAC;KACD;IACF;IACA,MAAM,UAAU,WAAW,KAAA,IAAY,KAAA,IAAY,OAAO,WAAW,QAAQ,UAAU;IACvF,IAAI,CAACC,mBAAAA,oBAAoB,IAAI,QAAQ,KAAK,YAAY,WAAW,CAAC,UAAU,CAAC,SAAS;KACpF,OAAO,MAAM,gCAAgC;KAC7C,OAAO,QAAQ;KACf;IACF;IACA,WAAW,cAAc,UAAU,QAAQ,OAAO,WAAW;KAC3D,IAAI;KACJ,IAAI;MACF,WAAW,QAAQ,gBAAgB,IAAI,QAAQ;KACjD,SAAS,OAAO;MACd,QAAQ,SAAS,sCAAsC,OAAO,KAAK,GAAG;MACtE,OAAO,MAAM,MAAM,sBAAsB;MACzC;KACF;KACA,MAAM,UAAoB,CAAC;KAC3B,IAAI,eAAe;KACnB,IAAI,SAAS;KACb,MAAM,UAAU,OAAO,YAAY,SAAS,MAAM,WAAW,OAAO,MAAM,MAAM,MAAM,CAAC;KACvF,MAAM,cAAoB;MACxB,IAAI,QAAQ;MACZ,SAAS;MACT,QAAQ;MACR,OAAO,MAAM;MACb,SAAS,MAAM;KACjB;KACA,OAAO,GAAG,YAAY,QAAiB;MACrC,IAAI,QAAQ;MACZ,MAAM,QAAQ,MAAM,QAAQ,GAAG,IAAI,OAAO,OAAO,GAAG,IAAI,OAAO,KAAK,GAAa;MACjF,IAAI;MACJ,IAAI;OACF,WAAW,KAAK,MAAM,MAAM,SAAS,MAAM,CAAC;MAC9C,QAAQ;OACN,MAAM;OACN;MACF;MACA,MAAM,SAAS,QAAQ,KAAK,QAAQ;MACpC,IAAI,CAAC,OAAO,IAAI;OACd,MAAM;OACN;MACF;MACA,MAAM,QAAQ,OAAO,KAAK,OAAO,SAAS;MAC1C,IAAI,SAAS,eAAeC,GAAAA,QAAU,MAAM,SAAS,KAAK,KAAK;WAC1D;OACH,gBAAgB,MAAM;OACtB,IAAI,eAAe,mBAAmB,MAAM;YACvC,QAAQ,KAAK,KAAK;MACzB;KACF,CAAC;KACD,SAAS,GAAG,cAAc;MACxB,KAAK,MAAM,SAAS,SAAS,SAAS,KAAK,KAAK;MAChD,QAAQ,SAAS;MACjB,eAAe;KACjB,CAAC;KACD,SAAS,GAAG,YAAY,QAAiB;MACvC,IAAI,QAAQ;MACZ,MAAM,QAAQ,MAAM,QAAQ,GAAG,IAAI,OAAO,OAAO,GAAG,IAAI,OAAO,KAAK,GAAa;MACjF,MAAM,SAAS,QAAQ,KAAK,KAAK;MACjC,IAAI,CAAC,OAAO,IAAI;OACd,MAAM;OACN;MACF;MACA,OAAO,KAAK,OAAO,KAAK,KAAK,UAAU,OAAO,QAAQ,CAAC,CAAC;KAC1D,CAAC;KACD,OAAO,GAAG,SAAS,KAAK;KACxB,OAAO,GAAG,SAAS,KAAK;KACxB,SAAS,GAAG,SAAS,KAAK;KAC1B,SAAS,GAAG,UAAU,UAAU;MAC9B,QAAQ,SAAS,2BAA2B,MAAM,SAAS;MAC3D,MAAM;KACR,CAAC;IACH,CAAC;GACH,CAAC;GACD,OAAO,iBAAiB;GACxB,OAAO,iBAAiB;GACxB,OAAO,iBAAiB;GACxB,OAAO,uBAAuB;GAC9B,MAAM,IAAI,SAAe,SAAS,WAAW;IAC3C,OAAO,KAAK,SAAS,MAAM;IAC3B,OAAO,OAAO,GAAG,aAAa,OAAO;GACvC,CAAC;GACD,MAAM,UAAU,OAAO,QAAQ;GAC/B,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU,MAAM,IAAI,MAAM,yCAAyC;GACtG,OAAO;IACL,MAAM,QAAQ;IACd,OAAO,YAAY;KACjB,KAAK,MAAM,UAAU,WAAW,SAAS,OAAO,UAAU;KAC1D,WAAW,MAAM;KACjB,OAAO,oBAAoB;KAC3B,MAAM,IAAI,SAAe,SAAS,WAAW,OAAO,OAAO,UAAW,QAAQ,OAAO,KAAK,IAAI,QAAQ,CAAE,CAAC;IAC3G;GACF;EACF;EACA,mBAAmB,QAAQ,YAAY;EACvC,WAAW,YAAY,QAAQ,SAAS,OAAO;CACjD,CAAC;CACD,qBAAA,qBAAqB,KAAwB;EAC3C;EACA,aAAa,YAAa,QAAQ,IAAyB;CAC7D,CAAC;CACD,uBAAA,uBAAuB,KAAwB;EAC7C,OAAO;EACP,aAAa,YAAa,QAAQ,IAAyB;EAG3D,qBAAqB;GACnB,OAAO,WAAW;GAClB,mBAAmB,KAAA,IAAY,KAAA,IAAY,OAAO,IAAI,IAAI,cAAc,CAAC,CAAC,IAAI;GAC9E,GAAI,QAAQ,gBAAgB,KAAK,CAAC;EACpC;EACA,WAAW,YAAY,QAAQ,SAAS,OAAO;CACjD,CAAC;CACD,IAAI,KAAK,wBAAwB,OAAO,YAAY;EAClD,IAAI,QAAQ,IAAI,aAAa,SAC3B,OAAO,QAAQ,KAAK,EAAE,OAAO,6CAA6C,GAAG,GAAG;EAClF,IAAI,QAAQ,IAAI,OAAO,2BAA2B,MAAM,QAAQ,mBAC9D,OAAO,QAAQ,KAAK,EAAE,OAAO,qDAAqD,GAAG,GAAG;EAC1F,IAAI;EACJ,IAAI;GACF,OAAO,MAAM,QAAQ,IAAI,KAAK;EAChC,QAAQ;GACN,OAAO,QAAQ,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;EAC1E;EACA,MAAM,SAAS,OAAO,SAAS,YAAY,SAAS,QAAQ,YAAY,OAAO,KAAK,SAAS,KAAA;EAC7F,IAAI,OAAO,WAAW,UAAU,OAAO,QAAQ,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;EACxG,IAAI;EACJ,IAAI;GACF,SAAS,IAAI,IAAI,MAAM;EACzB,QAAQ;GACN,OAAO,QAAQ,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;EAClE;EACA,IACE,OAAO,aAAa,WACpB,CAAC;GAAC;GAAa;GAAa;EAAO,CAAC,CAAC,SAAS,OAAO,QAAQ,KAC7D,OAAO,aAAa,OACpB,OAAO,WAAW,MAClB,OAAO,SAAS,MAChB,CAAC,OAAO,MAER,OAAO,QAAQ,KAAK,EAAE,OAAO,mDAAmD,GAAG,GAAG;EACxF,iBAAiB,OAAO;EACxB,OAAO,QAAQ,KAAK,EAAE,IAAI,KAAK,CAAC;CAClC,CAAC;CACD,IAAI,KAAKrB,eAAAA,mBAAmB,OAAO,YAAY;EAC7C,MAAM,SAAS,OAAO,WAAA,GAAUY,YAAAA,UAAAA,CAAU,SAASC,eAAAA,eAAe,MAAM,CAAC;EACzE,MAAM,UAAU,WAAW,KAAA,IAAY,KAAA,IAAY,OAAO,WAAW,QAAQ,MAAM;EACnF,IAAI,CAAC,UAAU,CAAC,SAAS,OAAO,QAAQ,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;EAClG,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,QAAQ,IAAI,KAAK;EACpC,QAAQ;GACN,OAAO,QAAQ,KAAK,EAAE,OAAO,6CAA6C,GAAG,GAAG;EAClF;EACA,MAAM,SAAS,QAAQ,KAAK,QAAQ;EACpC,IAAI,CAAC,OAAO,IAAI,OAAO,QAAQ,KAAK,EAAE,OAAO,mCAAmC,OAAO,QAAQ,GAAG,GAAG,GAAG;EACxG,IAAI;EACJ,IAAI;GACF,UAAU,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,SAAS,CAAC;EACjE,QAAQ;GACN,OAAO,QAAQ,KAAK,EAAE,OAAO,yCAAyC,GAAG,GAAG;EAC9E;EACA,MAAM,QAAQ,cAAc,OAAO;EACnC,MAAM,OAAO,YAAY,OAAO,IAAI;EACpC,IAAI,CAAC,SAAS,CAAC,MAAM,OAAO,QAAQ,KAAK,EAAE,OAAO,uCAAuC,GAAG,GAAG;EAC/F,MAAM,SAAS,IAAI,IAAI,MAAM,QAAQ,qBAAqB;EAC1D,MAAM,UAAU,IAAI,QAAQ;EAC5B,KAAK,MAAM,CAAC,MAAM,UAAU,MAAM,SAAS;GACzC,MAAM,aAAa,KAAK,YAAY;GACpC,IAAI,kBAAkB,IAAI,UAAU,KAAK,WAAW,WAAW,MAAM,GAAG;GACxE,QAAQ,OAAO,MAAM,KAAK;EAC5B;EACA,MAAM,SAASS,gBAAAA,gBAAgB,MAAM,QAAQ,OAAO,QAAQ;EAC5D,IAAI,eAAe;EACnB,IAAI,UAAU,OAAO,eAAe,MAAM,GAAG;GAC3C,MAAM,YAAY,QAAQ,IAAIC,eAAAA,cAAc;GAC5C,IAAI;GACJ,IAAI;IACF,aAAa,YAAY,KAAK,MAAM,OAAO,KAAK,WAAW,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC,IAAI,KAAA;GAC9F,QAAQ;IACN,aAAa,KAAA;GACf;GACA,MAAM,WAAW;GACjB,IACE,OAAO,UAAU,eAAe,YAChC,CAAE,MAAM,OAAO,SAAS,CAAC,CAAC,aAAa,SAAS,YAAY,UAAU,UAAU,QAAQ,SAAS,QAAQ,GAEzG,eAAe;EACnB;EACA,QAAQ,OAAOA,eAAAA,cAAc;EAG7B,QAAQ,IAAIC,mBAAAA,iCAAiC,QAAQ;EACrD,QAAQ,IAAIC,mBAAAA,kCAAkC,MAAM;EACpD,QAAQ,IAAIC,mBAAAA,gCAAgC,UAAU,OAAO,eAAe,MAAM,IAAI,aAAa,cAAc;EACjH,IAAI;EACJ,IAAI,cACF,WAAW,QAAQ,KAAK;GAAE,OAAO;GAA8C;EAAO,GAAG,GAAG;OACvF,IAAIC,yBAAAA,sBAAsB,OAAO,QAAQ,GAC9C,WAAW,QAAQ,KAAK,EAAE,OAAO,wDAAwD,GAAG,GAAG;OAC1F;GACL,MAAM,WAAW,IAAI,QAAQ,QAAQ;IACnC,QAAQ,MAAM;IACd;IACA,GAAI,MAAM,WAAW,SAAS,MAAM,WAAW,SAAS,CAAC,IAAI,EAAE,KAAK;GACtE,CAAC;GACD,IAAI,OAAO,aAAa,iBAAiB,OAAO,SAAS,WAAW,cAAc,GAAG;IACnF,QAAQ,IAAI,UAAU,QAAQ,IAAI,OAAO,QAAQ,KAAK,EAAE;IACxD,QAAQ,IAAI,QAAQ,QAAQ,IAAI,OAAO,MAAM,KAAK,EAAE;IACpD,QAAQ,IAAI,UAAU,QAAQ,IAAI,OAAO,QAAQ,KAAK,EAAE;IACxD,WAAW,MAAM,IAAI,MAAM,IAAI,QAAQ,UAAU,EAAE,QAAQ,CAAC,GAAG;KAC7D,UAAU;KACV,gBAAgB;IAClB,CAAC;GACH,OAAO,WAAW,MAAM,QAAQ,QAAQ,QAAQ;EAClD;EACA,MAAM,eAAe,OAAO,KAAK,MAAM,SAAS,YAAY,CAAC;EAC7D,MAAM,SAAS,QAAQ,KACrB,IAAI,YAAY,CAAC,CAAC,OAChB,KAAK,UAAU;GACb,GAAG;GACH,QAAQ,SAAS;GACjB,SAAS,CAAC,GAAG,SAAS,QAAQ,QAAQ,CAAC;GACvC,MAAM,aAAa,SAAS,QAAQ;EACtC,CAAC,CACH,CACF;EACA,OAAO,OAAO,KACV,QAAQ,KAAK,OAAO,QAAQ,IAC5B,QAAQ,KAAK,EAAE,OAAO,+BAA+B,OAAO,QAAQ,GAAG,GAAG,GAAG;CACnF,CAAC;CACD,IAAI,GAAG,CAAC,QAAQ,QAAQ,GAAG,KAAK,OAAO,YAAY;EACjD,IACE,CAACnB,yBAAAA,wBAAwB,QAAQ,IAAI,QAAQ,QAAQ,IAAI,IAAI,KAC7D,EAAE,QAAQ,IAAI,WAAW,UAAU,QAAQ,IAAI,SAAS,6BACxD,EAAE,QAAQ,IAAI,WAAW,UAAU,kBAAkB,IAAI,QAAQ,IAAI,IAAI,IAEzE,OAAO,QAAQ,SAAS;EAC1B,OAAO,QAAQ,QAAQ,QAAQ,IAAI,GAAG;CACxC,CAAC;CACD,IAAI,GAAG,CAAC,OAAO,MAAM,GAAG,KAAK,OAAO,YAAY;EAC9C,IAAIA,yBAAAA,wBAAwB,QAAQ,IAAI,QAAQ,QAAQ,IAAI,IAAI,GAAG,OAAO,QAAQ,QAAQ,QAAQ,IAAI,GAAG;EACzG,IAAI,QAAQ,IAAI,KAAK,WAAW,OAAO,GAAG,OAAO,QAAQ,KAAK,EAAE,OAAO,aAAa,GAAG,GAAG;EAC1F,IAAI,QAAQ,IAAI,SAAS,OAAO,OAAO,WAAA,GAAUI,YAAAA,UAAAA,CAAU,SAAA,iBAAwB,MAAM,CAAC,MAAM,KAAA,GAC9F,OAAO,QAAQ,SAAS,OAAO;EACjC,IAAI,QAAQ,IAAI,SAAS,2BAA2B,QAAQ,IAAI,KAAK,WAAW,iBAAiB,GAAG;GAClG,MAAM,OAAO,IAAI,IAAI,QAAQ,IAAI,GAAG;GACpC,OAAO,MAAM,QAAQ,QACnB,IAAI,QAAQ,IAAI,IAAI,GAAG,KAAK,WAAW,KAAK,UAAU,qBAAqB,GAAG,EAC5E,QAAQ,QAAQ,IAAI,OACtB,CAAC,CACH;EACF;EACA,IAAI,CAAC,gBAAgB,OAAO,QAAQ,KAAK,EAAE,OAAO,8CAA8C,GAAG,GAAG;EACtG,MAAM,OAAO,IAAI,IAAI,QAAQ,IAAI,GAAG;EACpC,MAAM,SAAS,IAAI,IAAI,GAAG,KAAK,WAAW,KAAK,UAAU,cAAc;EACvE,MAAM,SAAS,MAAM,MAAM,QAAQ;GAAE,QAAQ,QAAQ,IAAI;GAAQ,UAAU;EAAS,CAAC;EACrF,MAAM,UAAU,IAAI,QAAQ,OAAO,OAAO;EAC1C,QAAQ,OAAO,YAAY;EAC3B,OAAO,IAAI,SAAS,OAAO,MAAM;GAAE,QAAQ,OAAO;GAAQ;EAAQ,CAAC;CACrE,CAAC;CAED,OAAO;EACL;EACA,YAAY,OAAO,YAAY,IAAI,MAAM,SAAS,EAAE,UAAU,QAAQ,CAAC;EACvE,OAAO,YAAY,OAAO,MAAM;CAClC;AACF"}

package/dist/remoteRuntime.d.mts

@@ -0,0 +1,28 @@
+import { TunnelLauncher } from "./src/types/remote.mjs";
+import { RemoteAccess } from "./src/services/remoteAccess/index.mjs";
+import WebSocket$1 from "ws";
+//#region src/server/remoteRuntime.d.ts
+export interface RemoteRuntimeOptions {
+  homeDirectory: string;
+  registrationToken: string;
+  bundleTrust(): {
+    publicKey: string;
+    revision: number;
+  } | undefined;
+  onNotice(message: string): void;
+  /** The listener to which a sealed, authenticated request is forwarded. */
+  forward(request: Request): Promise<Response>;
+  connectProtocol(pathname: string): WebSocket$1;
+  launchTunnel?: TunnelLauncher;
+  /** Ports the host itself listens on, which a dev proxy target may never name. */
+  reservedPorts?: () => readonly (number | undefined)[];
+}
+export interface RemoteRuntime {
+  readonly remote: RemoteAccess;
+  fetchLocal(request: Request): Promise<Response>;
+  close(): Promise<void>;
+}
+/** One global control plane and a second socket dedicated to public tunnel traffic. */
+export declare function createRemoteRuntime(options: RemoteRuntimeOptions): RemoteRuntime;
+//#endregion
+//# sourceMappingURL=remoteRuntime.d.mts.map

package/dist/remoteRuntime.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remoteRuntime.d.mts","names":[],"sources":["../src/server/remoteRuntime.ts"],"mappings":";;;;iBAwGiB;EACf;EACA;EACA;IAAiB;IAAmB;;EACpC,SAAS;;EAET,QAAQ,SAAS,UAAU,QAAQ;EACnC,gBAAgB,mBAAmB;EACnC,eAAe;;EAEf;;iBAGe;WACN,QAAQ;EACjB,WAAW,SAAS,UAAU,QAAQ;EACtC,SAAS;;;wBAyBK,oBAAoB,SAAS,uBAAuB"}

package/dist/remoteRuntime.mjs

@@ -0,0 +1,456 @@
+import { DOOM_API_CALLER_DEVICE_ID_HEADER, DOOM_API_CALLER_LOCALITY_HEADER, DOOM_API_CALLER_STEP_UP_HEADER, parseDoomSocketPath } from "./src/schemas/packageApi.mjs";
+import { isPublicSessionMcpRoute, isSessionMcpHostRoute } from "./src/server/sessionMcpRoutes.mjs";
+import { DEVICE_COOKIE, REMOTE_CHANNEL_ROUTE, REMOTE_HTTP_ROUTE, STEP_UP_HEADER } from "./src/constants/remote.mjs";
+import { isDevProxyPath, parseProxyPath } from "./src/services/devProxyPolicy/index.mjs";
+import { createDevProxyStore } from "./src/services/devProxyStore/index.mjs";
+import { isPublicPairingRoute, localOriginPolicy, originVerdict } from "./src/services/remoteGuardPolicy/index.mjs";
+import { stepUpActionFor } from "./src/services/webauthnPolicy/index.mjs";
+import { createRemoteAccess } from "./src/services/remoteAccess/index.mjs";
+import { createRemoteAccessStore } from "./src/services/remoteAccessStore/index.mjs";
+import { createTunnelLauncher, reapStaleTunnel } from "./src/services/tunnelProcess/index.mjs";
+import { registerDevProxyRoutes } from "./src/server/devProxyRoutes.mjs";
+import { relayDevProxySocket } from "./src/server/devProxySocket.mjs";
+import { registerRemoteRoutes } from "./src/server/remoteRoutes.mjs";
+import path from "node:path";
+import { createServer } from "node:http";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import WebSocket$1, { WebSocketServer } from "ws";
+import { Hono } from "hono";
+import { getCookie } from "hono/cookie";
+//#region src/server/remoteRuntime.ts
+const MAX_REQUEST_BYTES = 8388608;
+const TUNNEL_HEADERS_TIMEOUT_MS = 5e3;
+const TUNNEL_REQUEST_TIMEOUT_MS = 1e4;
+const TUNNEL_CONNECTION_LIMIT = 64;
+const TUNNEL_REQUESTS_PER_SOCKET = 100;
+const SEALED_HTTP_VERSION = 1;
+const SEALED_HTTP_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE"
+]);
+/** HMAC-authenticated peer routes are the only non-device tunnel APIs. */
+const SESSION_PEER_INBOX_ROUTE = "/api/plugins/session-peer/inbox";
+const VOICE_PEER_ROUTES = /* @__PURE__ */ new Set(["/api/plugins/voice/peer", "/api/plugins/voice/peer-ownership"]);
+const FORBIDDEN_HEADERS = /* @__PURE__ */ new Set([
+	"authorization",
+	"connection",
+	"content-length",
+	"cookie",
+	"forwarded",
+	"host",
+	"origin",
+	"transfer-encoding",
+	"upgrade",
+	"x-doompi-token",
+	"x-forwarded-for",
+	"x-forwarded-host",
+	"x-forwarded-proto"
+]);
+function sealedRequest(value) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const request = value;
+	if (request.v !== SEALED_HTTP_VERSION || typeof request.method !== "string" || !SEALED_HTTP_METHODS.has(request.method) || typeof request.target !== "string" || !request.target.startsWith("/") || request.target.startsWith("//") || request.target.includes("#") || !Array.isArray(request.headers) || !request.headers.every((header) => Array.isArray(header) && header.length === 2 && header.every((part) => typeof part === "string")) || request.body !== void 0 && typeof request.body !== "string") return void 0;
+	const parsed = new URL(request.target, "http://doompi.local");
+	if (parsed.pathname === REMOTE_HTTP_ROUTE || parsed.pathname === REMOTE_CHANNEL_ROUTE) return void 0;
+	return request;
+}
+function decodedBody(value) {
+	if (value === void 0) return Buffer.alloc(0);
+	if (!/^(?:[A-Za-z\d+/]{4})*(?:[A-Za-z\d+/]{2}==|[A-Za-z\d+/]{3}=)?$/u.test(value)) return void 0;
+	const body = Buffer.from(value, "base64");
+	return body.toString("base64") === value ? body : void 0;
+}
+async function readBody(request) {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of request) {
+		const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+		size += bytes.byteLength;
+		if (size > MAX_REQUEST_BYTES) throw new Error("The tunnel request body is too large.");
+		chunks.push(bytes);
+	}
+	return Buffer.concat(chunks);
+}
+async function writeResponse(response, result) {
+	response.writeHead(result.status, Object.fromEntries(result.headers.entries()));
+	if (result.body === null) {
+		response.end();
+		return;
+	}
+	await pipeline(Readable.fromWeb(result.body), response);
+}
+/** One global control plane and a second socket dedicated to public tunnel traffic. */
+function createRemoteRuntime(options) {
+	const store = createRemoteAccessStore({
+		stateDir: path.join(options.homeDirectory, ".doompi", "web"),
+		onNotice: (message) => options.onNotice(message)
+	});
+	reapStaleTunnel(store.directory, (message) => options.onNotice(message));
+	const devProxy = createDevProxyStore({
+		stateDir: store.directory,
+		onNotice: (message) => options.onNotice(message)
+	});
+	const app = new Hono();
+	let remote;
+	let frontendOrigin;
+	app.use("*", async (context, next) => {
+		if (context.env.listener === "local") return next();
+		const path = context.req.path;
+		const publicSessionMcp = isPublicSessionMcpRoute(context.req.method, path);
+		const publicSessionPeer = context.req.method === "POST" && path === SESSION_PEER_INBOX_ROUTE;
+		const publicVoicePeer = context.req.method === "POST" && VOICE_PEER_ROUTES.has(path);
+		const verdict = originVerdict({
+			listener: "tunnel",
+			method: publicSessionMcp || publicSessionPeer || publicVoicePeer ? "GET" : context.req.method,
+			isUpgrade: false,
+			origin: context.req.header("origin"),
+			host: context.req.header("host"),
+			local: localOriginPolicy(0),
+			tunnel: remote.tunnelPolicy()
+		});
+		if (verdict !== "allow") return context.json({ error: `Tunnel request refused: ${verdict}.` }, 403);
+		if (isPublicPairingRoute(context.req.method, path) || publicSessionMcp || publicSessionPeer || publicVoicePeer) return next();
+		const device = remote.authorize(getCookie(context, DEVICE_COOKIE, "host"));
+		if (device === void 0) return context.json({ error: "This device is not paired." }, 401);
+		if (context.env.sealedDeviceId === device) return next();
+		if (isDevProxyPath(path)) return next();
+		if (context.req.method === "POST" && (path === REMOTE_CHANNEL_ROUTE || path === REMOTE_HTTP_ROUTE)) return next();
+		if ((context.req.method === "GET" || context.req.method === "HEAD") && !path.startsWith("/api/")) return next();
+		return context.json({ error: "Remote HTTP requests must use the sealed gateway." }, 401);
+	});
+	remote = createRemoteAccess({
+		store,
+		launchTunnel: options.launchTunnel ?? createTunnelLauncher({
+			stateDir: store.directory,
+			onNotice: (message) => options.onNotice(message),
+			onExit: (message) => {
+				options.onNotice(`remote access: ${message}`);
+				remote.disable();
+			}
+		}),
+		bindListener: async () => {
+			const webSockets = new WebSocketServer({
+				noServer: true,
+				maxPayload: MAX_REQUEST_BYTES
+			});
+			const server = createServer((incoming, outgoing) => {
+				(async () => {
+					const abort = new AbortController();
+					const disconnected = () => abort.abort();
+					incoming.once("aborted", disconnected);
+					outgoing.once("close", disconnected);
+					try {
+						const url = new URL(incoming.url ?? "/", `http://${incoming.headers.host ?? "localhost"}`);
+						const headers = new Headers();
+						for (const [name, value] of Object.entries(incoming.headers)) if (value !== void 0) headers.set(name, Array.isArray(value) ? value.join(", ") : value);
+						const body = incoming.method === "GET" || incoming.method === "HEAD" ? void 0 : await readBody(incoming);
+						const request = new Request(url, {
+							method: incoming.method,
+							headers,
+							signal: abort.signal,
+							...body === void 0 ? {} : { body }
+						});
+						await writeResponse(outgoing, await app.fetch(request, {
+							listener: "tunnel",
+							incoming
+						}));
+					} finally {
+						incoming.off("aborted", disconnected);
+						outgoing.off("close", disconnected);
+					}
+				})().catch((error) => {
+					options.onNotice(`tunnel request failed: ${String(error)}`);
+					if (!outgoing.headersSent) {
+						outgoing.writeHead(500, { "content-type": "application/json" });
+						outgoing.end(JSON.stringify({ error: "The tunnel request failed." }));
+					} else outgoing.destroy();
+				});
+			});
+			server.on("upgrade", (incoming, socket, head) => {
+				const url = new URL(incoming.url ?? "/", `http://${incoming.headers.host ?? "localhost"}`);
+				const verdict = originVerdict({
+					listener: "tunnel",
+					method: incoming.method ?? "GET",
+					isUpgrade: true,
+					origin: incoming.headers.origin,
+					host: incoming.headers.host,
+					local: localOriginPolicy(0),
+					tunnel: remote.tunnelPolicy()
+				});
+				const cookies = new Map((incoming.headers.cookie ?? "").split(";").map((part) => {
+					const at = part.indexOf("=");
+					return [part.slice(0, at).trim(), part.slice(at + 1).trim()];
+				}));
+				const device = remote.authorize(cookies.get(`__Host-${DEVICE_COOKIE}`));
+				if (isDevProxyPath(url.pathname) && verdict === "allow" && device !== void 0) {
+					const parsed = parseProxyPath(url.pathname);
+					const target = parsed.kind === "match" ? devProxy.find(parsed.name) : void 0;
+					if (parsed.kind !== "match" || target === void 0) {
+						socket.write("HTTP/1.1 404 Not Found\r\n\r\n");
+						socket.destroy();
+						return;
+					}
+					webSockets.handleUpgrade(incoming, socket, head, (client) => {
+						const untrack = remote.trackSocket(device, (code, reason) => client.close(code, reason));
+						client.once("close", untrack);
+						relayDevProxySocket(client, {
+							port: target.port,
+							upstreamPath: `${parsed.upstreamPath}${url.search}`,
+							protocols: incoming.headers["sec-websocket-protocol"],
+							onNotice: (message) => options.onNotice(message)
+						});
+					});
+					return;
+				}
+				const channel = device === void 0 ? void 0 : remote.channelFor(device, "protocol");
+				if (!parseDoomSocketPath(url.pathname) || verdict !== "allow" || !device || !channel) {
+					socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
+					socket.destroy();
+					return;
+				}
+				webSockets.handleUpgrade(incoming, socket, head, (client) => {
+					let upstream;
+					try {
+						upstream = options.connectProtocol(url.pathname);
+					} catch (error) {
+						options.onNotice(`remote protocol could not connect: ${String(error)}`);
+						client.close(1011, "protocol unavailable");
+						return;
+					}
+					const pending = [];
+					let pendingBytes = 0;
+					let closed = false;
+					const untrack = remote.trackSocket(device, (code, reason) => client.close(code, reason));
+					const close = () => {
+						if (closed) return;
+						closed = true;
+						untrack();
+						client.close();
+						upstream.close();
+					};
+					client.on("message", (raw) => {
+						if (closed) return;
+						const bytes = Array.isArray(raw) ? Buffer.concat(raw) : Buffer.from(raw);
+						let envelope;
+						try {
+							envelope = JSON.parse(bytes.toString("utf8"));
+						} catch {
+							close();
+							return;
+						}
+						const opened = channel.open(envelope);
+						if (!opened.ok) {
+							close();
+							return;
+						}
+						const plain = Buffer.from(opened.plaintext);
+						if (upstream.readyState === WebSocket$1.OPEN) upstream.send(plain);
+						else {
+							pendingBytes += plain.byteLength;
+							if (pendingBytes > MAX_REQUEST_BYTES) close();
+							else pending.push(plain);
+						}
+					});
+					upstream.on("open", () => {
+						for (const bytes of pending) upstream.send(bytes);
+						pending.length = 0;
+						pendingBytes = 0;
+					});
+					upstream.on("message", (raw) => {
+						if (closed) return;
+						const plain = Array.isArray(raw) ? Buffer.concat(raw) : Buffer.from(raw);
+						const sealed = channel.seal(plain);
+						if (!sealed.ok) {
+							close();
+							return;
+						}
+						client.send(Buffer.from(JSON.stringify(sealed.envelope)));
+					});
+					client.on("close", close);
+					client.on("error", close);
+					upstream.on("close", close);
+					upstream.on("error", (error) => {
+						options.onNotice(`remote protocol failed: ${error.message}`);
+						close();
+					});
+				});
+			});
+			server.headersTimeout = TUNNEL_HEADERS_TIMEOUT_MS;
+			server.requestTimeout = TUNNEL_REQUEST_TIMEOUT_MS;
+			server.maxConnections = TUNNEL_CONNECTION_LIMIT;
+			server.maxRequestsPerSocket = TUNNEL_REQUESTS_PER_SOCKET;
+			await new Promise((resolve, reject) => {
+				server.once("error", reject);
+				server.listen(0, "127.0.0.1", resolve);
+			});
+			const address = server.address();
+			if (!address || typeof address === "string") throw new Error("The tunnel listener has no TCP address.");
+			return {
+				port: address.port,
+				close: async () => {
+					for (const client of webSockets.clients) client.terminate();
+					webSockets.close();
+					server.closeAllConnections();
+					await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+				}
+			};
+		},
+		bundleTrust: () => options.bundleTrust(),
+		onNotice: (message) => options.onNotice(message)
+	});
+	registerRemoteRoutes(app, {
+		remote,
+		listenerOf: (context) => context.env.listener
+	});
+	registerDevProxyRoutes(app, {
+		store: devProxy,
+		listenerOf: (context) => context.env.listener,
+		reservedPorts: () => [
+			remote.tunnelPort(),
+			frontendOrigin === void 0 ? void 0 : Number(new URL(frontendOrigin).port),
+			...options.reservedPorts?.() ?? []
+		],
+		onNotice: (message) => options.onNotice(message)
+	});
+	app.post("/api/remote/frontend", async (context) => {
+		if (context.env.listener !== "local") return context.json({ error: "This action is only available on the host." }, 403);
+		if (context.req.header("x-doompi-web-registration") !== options.registrationToken) return context.json({ error: "The web presentation server was not authenticated." }, 403);
+		let body;
+		try {
+			body = await context.req.json();
+		} catch {
+			return context.json({ error: "A loopback web origin is required." }, 400);
+		}
+		const origin = typeof body === "object" && body !== null && "origin" in body ? body.origin : void 0;
+		if (typeof origin !== "string") return context.json({ error: "A loopback web origin is required." }, 400);
+		let parsed;
+		try {
+			parsed = new URL(origin);
+		} catch {
+			return context.json({ error: "The web origin is invalid." }, 400);
+		}
+		if (parsed.protocol !== "http:" || ![
+			"127.0.0.1",
+			"localhost",
+			"[::1]"
+		].includes(parsed.hostname) || parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "" || !parsed.port) return context.json({ error: "The web origin must be a loopback HTTP listener." }, 400);
+		frontendOrigin = parsed.origin;
+		return context.json({ ok: true });
+	});
+	app.post(REMOTE_HTTP_ROUTE, async (context) => {
+		const device = remote.authorize(getCookie(context, DEVICE_COOKIE, "host"));
+		const channel = device === void 0 ? void 0 : remote.channelFor(device, "http");
+		if (!device || !channel) return context.json({ error: "A sealed paired device is required." }, 401);
+		let envelope;
+		try {
+			envelope = await context.req.json();
+		} catch {
+			return context.json({ error: "The sealed request envelope was malformed." }, 400);
+		}
+		const opened = channel.open(envelope);
+		if (!opened.ok) return context.json({ error: `The sealed request was refused: ${opened.failure}.` }, 400);
+		let decoded;
+		try {
+			decoded = JSON.parse(new TextDecoder().decode(opened.plaintext));
+		} catch {
+			return context.json({ error: "The sealed HTTP request was malformed." }, 400);
+		}
+		const inner = sealedRequest(decoded);
+		const body = decodedBody(inner?.body);
+		if (!inner || !body) return context.json({ error: "The sealed HTTP request was invalid." }, 400);
+		const target = new URL(inner.target, "http://doompi.local");
+		const headers = new Headers();
+		for (const [name, value] of inner.headers) {
+			const normalized = name.toLowerCase();
+			if (FORBIDDEN_HEADERS.has(normalized) || normalized.startsWith("sec-")) continue;
+			headers.append(name, value);
+		}
+		const action = stepUpActionFor(inner.method, target.pathname);
+		let stepUpDenied = false;
+		if (action && remote.stepUpRequired(action)) {
+			const assertion = headers.get(STEP_UP_HEADER);
+			let credential;
+			try {
+				credential = assertion ? JSON.parse(Buffer.from(assertion, "base64url").toString("utf8")) : void 0;
+			} catch {
+				credential = void 0;
+			}
+			const ceremony = credential;
+			if (typeof ceremony?.ceremonyId !== "string" || !await remote.passkeys().finishStepUp(ceremony.ceremonyId, `device:${device}`, action, ceremony.response)) stepUpDenied = true;
+		}
+		headers.delete(STEP_UP_HEADER);
+		headers.set(DOOM_API_CALLER_LOCALITY_HEADER, "remote");
+		headers.set(DOOM_API_CALLER_DEVICE_ID_HEADER, device);
+		headers.set(DOOM_API_CALLER_STEP_UP_HEADER, action && remote.stepUpRequired(action) ? "verified" : "not-required");
+		let response;
+		if (stepUpDenied) response = context.json({
+			error: "This action needs a fresh passkey gesture.",
+			action
+		}, 401);
+		else if (isSessionMcpHostRoute(target.pathname)) response = context.json({ error: "Session MCP management is only available on the host." }, 403);
+		else {
+			const internal = new Request(target, {
+				method: inner.method,
+				headers,
+				...inner.method === "GET" || inner.method === "HEAD" ? {} : { body }
+			});
+			if (target.pathname === "/api/remote" || target.pathname.startsWith("/api/remote/")) {
+				headers.set("cookie", context.req.header("cookie") ?? "");
+				headers.set("host", context.req.header("host") ?? "");
+				headers.set("origin", context.req.header("origin") ?? "");
+				response = await app.fetch(new Request(internal, { headers }), {
+					listener: "tunnel",
+					sealedDeviceId: device
+				});
+			} else response = await options.forward(internal);
+		}
+		const responseBody = Buffer.from(await response.arrayBuffer());
+		const sealed = channel.seal(new TextEncoder().encode(JSON.stringify({
+			v: SEALED_HTTP_VERSION,
+			status: response.status,
+			headers: [...response.headers.entries()],
+			body: responseBody.toString("base64")
+		})));
+		return sealed.ok ? context.json(sealed.envelope) : context.json({ error: `The sealed response failed: ${sealed.failure}.` }, 503);
+	});
+	app.on(["POST", "DELETE"], "*", async (context) => {
+		if (!isPublicSessionMcpRoute(context.req.method, context.req.path) && !(context.req.method === "POST" && context.req.path === SESSION_PEER_INBOX_ROUTE) && !(context.req.method === "POST" && VOICE_PEER_ROUTES.has(context.req.path))) return context.notFound();
+		return options.forward(context.req.raw);
+	});
+	app.on(["GET", "HEAD"], "*", async (context) => {
+		if (isPublicSessionMcpRoute(context.req.method, context.req.path)) return options.forward(context.req.raw);
+		if (context.req.path.startsWith("/api/")) return context.json({ error: "Not found." }, 404);
+		if (context.req.path === "/" && remote.authorize(getCookie(context, "doompi_device", "host")) === void 0) return context.redirect("/pair");
+		if (context.req.path === "/bundle-manifest.json" || context.req.path.startsWith("/bundle-assets/")) {
+			const from = new URL(context.req.url);
+			return await options.forward(new Request(new URL(`${from.pathname}${from.search}`, "http://doompi.local"), { method: context.req.method }));
+		}
+		if (!frontendOrigin) return context.json({ error: "The web presentation server is unavailable." }, 503);
+		const from = new URL(context.req.url);
+		const target = new URL(`${from.pathname}${from.search}`, frontendOrigin);
+		const result = await fetch(target, {
+			method: context.req.method,
+			redirect: "manual"
+		});
+		const headers = new Headers(result.headers);
+		headers.delete("set-cookie");
+		return new Response(result.body, {
+			status: result.status,
+			headers
+		});
+	});
+	return {
+		remote,
+		fetchLocal: async (request) => app.fetch(request, { listener: "local" }),
+		close: async () => remote.close()
+	};
+}
+//#endregion
+export { createRemoteRuntime };
+
+//# sourceMappingURL=remoteRuntime.mjs.map