@agimon-ai/doompi-core 0.0.1-alpha.70

package/dist/server/remoteRoutes.cjs

@@ -0,0 +1,386 @@
+const require_remote = require("../constants/remote.cjs");
+const require_index = require("../services/deviceSessions/index.cjs");
+const require_index$1 = require("../services/webauthnPolicy/index.cjs");
+const require_index$2 = require("../services/pairingPage/index.cjs");
+let node_crypto = require("node:crypto");
+let hono_cookie = require("hono/cookie");
+let hono_body_limit = require("hono/body-limit");
+let hono_http_exception = require("hono/http-exception");
+let hono_timeout = require("hono/timeout");
+//#region src/server/remoteRoutes.ts
+const NONCE_BYTES = 16;
+const BAD_REQUEST = 400;
+const FORBIDDEN = 403;
+const NOT_FOUND = 404;
+const CONFLICT = 409;
+const GONE = 410;
+const TOO_MANY = 429;
+const BAD_GATEWAY = 502;
+const UNAUTHORIZED = 401;
+const ACCEPTED = 202;
+const CREATED = 201;
+/** Trusted Cloudflare client address, used for display and public abuse throttling only. */
+const EDGE_IP_HEADER = "cf-connecting-ip";
+const PAYLOAD_TOO_LARGE = 413;
+const REQUEST_TIMEOUT = 408;
+const PUBLIC_REQUEST_CONCURRENCY = 8;
+const PUBLIC_REQUEST_TIMEOUT_MS = 5e3;
+const PAIRING_BODY_BYTES = 2048;
+const CHANNEL_BODY_BYTES = 4096;
+const PASSKEY_BEGIN_BODY_BYTES = 256;
+const PASSKEY_FINISH_BODY_BYTES = 65536;
+const CEREMONY_CALLER_COOKIE = "doompi_ceremony_caller";
+const CEREMONY_CALLER_TOKEN = /^[A-Za-z0-9_-]{22}$/u;
+const CEREMONY_CALLER_MAX_AGE_SECONDS = 600;
+const PUBLIC_BEGIN_LIMIT = 10;
+const PUBLIC_BEGIN_WINDOW_MS = 6e4;
+const PUBLIC_BEGIN_SOURCE_LIMIT = 1024;
+/** Fallback wait before a remote-initiated shutdown, when the raw response is not reachable. */
+const RESPONSE_FLUSH_GRACE_MS = 250;
+const CHANNEL_SCOPES = /* @__PURE__ */ new Set([
+	"session",
+	"protocol",
+	"http"
+]);
+function isChannelScope(value) {
+	return typeof value === "string" && CHANNEL_SCOPES.has(value);
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function readJson(context) {
+	try {
+		const body = await context.req.json();
+		return isRecord(body) ? body : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Runs an action once this response has reached the wire.
+*
+* Both callers tear down the listener carrying their own response, and the
+* difference between a confirmed answer and a socket error the caller cannot
+* distinguish from a failure is doing it in this order.
+*/
+function afterResponse(context, action) {
+	const outgoing = context.env.outgoing;
+	if (outgoing === void 0) {
+		setTimeout(action, RESPONSE_FLUSH_GRACE_MS);
+		return;
+	}
+	outgoing.once("finish", action);
+}
+/** What the credential is called in the device list; the user agent is the only hint available. */
+function labelFrom(context) {
+	return require_index.sanitizeUserAgent(context.req.header("user-agent"));
+}
+/**
+* Cloudflare's normalized client address on the tunnel listener, with the
+* actual socket peer as the fallback for local and direct requests.
+*
+* A local process can forge the Cloudflare header, but local processes are
+* already outside this internet-client throttle boundary. Cloudflare is the
+* trusted proxy and overwrites this header for public requests.
+*/
+function sourceAddressOf(context, listener) {
+	const socketPeer = context.env?.incoming?.socket?.remoteAddress;
+	if (listener !== "tunnel") return socketPeer;
+	const edgeAddress = require_index.sanitizeEdgeIp(context.req.header(EDGE_IP_HEADER));
+	return edgeAddress === "unknown" ? socketPeer : `cloudflare:${edgeAddress}`;
+}
+function limitedJsonBody(maxSize) {
+	return (0, hono_body_limit.bodyLimit)({
+		maxSize,
+		onError: (context) => context.json({ error: "The request body is too large." }, PAYLOAD_TOO_LARGE)
+	});
+}
+function createPublicRequestBudget(isLocal) {
+	let active = 0;
+	return async (context, next) => {
+		if (isLocal(context)) return next();
+		if (active >= PUBLIC_REQUEST_CONCURRENCY) {
+			context.header("Retry-After", "1");
+			return context.json({ error: "Too many public requests are already in progress." }, TOO_MANY);
+		}
+		active += 1;
+		try {
+			await next();
+		} finally {
+			active -= 1;
+		}
+	};
+}
+function createPublicBeginLimit() {
+	const windows = /* @__PURE__ */ new Map();
+	return (source) => {
+		const at = Date.now();
+		let window = windows.get(source);
+		if (window === void 0 || at - window.startedAt >= PUBLIC_BEGIN_WINDOW_MS) {
+			if (window === void 0 && windows.size >= PUBLIC_BEGIN_SOURCE_LIMIT) {
+				const oldest = windows.keys().next().value;
+				if (oldest !== void 0) windows.delete(oldest);
+			}
+			window = {
+				count: 0,
+				startedAt: at
+			};
+			windows.delete(source);
+			windows.set(source, window);
+		}
+		if (window.count >= PUBLIC_BEGIN_LIMIT) return false;
+		window.count += 1;
+		return true;
+	};
+}
+/**
+* Registers the pairing surface and the remote-access control plane.
+*
+* Split by who may reach them, not by shape. The three pairing routes are the
+* only unauthenticated ones on the tunnel listener, so each is small, constant,
+* and echoes nothing from its request. The control plane is mostly local-only:
+* minting a code, approving, denying, and changing settings all stay at the
+* machine, because a device that can do them can make its own access permanent.
+* Turning remote access off and revoking a credential are allowed remotely, on
+* the grounds that a panic button is worth more from the phone than the desk.
+*/
+function registerRemoteRoutes(app, options) {
+	const { remote } = options;
+	const isLocal = (context) => options.listenerOf(context) === "local";
+	const localOnly = (context) => isLocal(context) ? void 0 : context.json({ error: "This action is only available on the host." }, FORBIDDEN);
+	const publicBudget = createPublicRequestBudget(isLocal);
+	const publicBeginAllowed = createPublicBeginLimit();
+	const publicDeadline = (0, hono_timeout.timeout)(PUBLIC_REQUEST_TIMEOUT_MS, () => new hono_http_exception.HTTPException(REQUEST_TIMEOUT, { res: Response.json({ error: "The public request timed out." }, { status: REQUEST_TIMEOUT }) }));
+	const authenticatedCeremonyCaller = (context) => {
+		const deviceId = context.env?.sealedDeviceId ?? remote.authorize((0, hono_cookie.getCookie)(context, "doompi_device", "host"));
+		return deviceId === void 0 ? "local" : `device:${deviceId}`;
+	};
+	const registrationCaller = (context) => {
+		const caller = authenticatedCeremonyCaller(context);
+		return isLocal(context) || caller !== "local" ? caller : void 0;
+	};
+	const publicCeremonyCaller = (context, create) => {
+		let token = (0, hono_cookie.getCookie)(context, CEREMONY_CALLER_COOKIE, "host");
+		if (token !== void 0 && !CEREMONY_CALLER_TOKEN.test(token)) token = void 0;
+		if (token === void 0 && create) token = (0, node_crypto.randomBytes)(16).toString("base64url");
+		if (token !== void 0 && create) (0, hono_cookie.setCookie)(context, CEREMONY_CALLER_COOKIE, token, {
+			prefix: "host",
+			httpOnly: true,
+			sameSite: "Strict",
+			maxAge: CEREMONY_CALLER_MAX_AGE_SECONDS
+		});
+		return token === void 0 ? void 0 : `public:${token}`;
+	};
+	app.get(require_remote.PAIRING_PAGE_ROUTE, (context) => {
+		const nonce = (0, node_crypto.randomBytes)(NONCE_BYTES).toString("base64");
+		const localTrust = options.listenerOf(context) === "local" ? remote.bundleTrust() : void 0;
+		return context.body(require_index$2.pairingPageHtml({
+			nonce,
+			...localTrust === void 0 ? {} : { localTrust }
+		}), 200, require_index$2.pairingPageHeaders(nonce));
+	});
+	app.post(require_remote.PAIRING_CLAIM_ROUTE, publicBudget, publicDeadline, limitedJsonBody(PAIRING_BODY_BYTES), async (context) => {
+		let body;
+		try {
+			body = await context.req.json();
+		} catch {
+			return context.json({ error: "The request body must be JSON." }, BAD_REQUEST);
+		}
+		if (!isRecord(body) || typeof body.code !== "string" || body.code === "") return context.json({ error: "A code string is required." }, BAD_REQUEST);
+		const outcome = remote.claim({
+			code: body.code,
+			userAgent: context.req.header("user-agent"),
+			edgeIp: context.req.header(EDGE_IP_HEADER),
+			sourceAddress: sourceAddressOf(context, options.listenerOf(context))
+		});
+		if (outcome.ok) return context.json({
+			requestId: outcome.requestId,
+			status: "pending"
+		}, ACCEPTED);
+		if (outcome.code === "unknown_code") return context.json({ error: "That code is not valid." }, GONE);
+		return context.json({ error: "Too many attempts." }, TOO_MANY);
+	});
+	app.get(require_remote.PAIRING_STATUS_ROUTE, (context) => {
+		const requestId = context.req.query(require_remote.PAIRING_STATUS_QUERY);
+		if (requestId === void 0) return context.json({ error: "A request id is required." }, BAD_REQUEST);
+		const status = remote.pairingStatus(requestId);
+		if (status === void 0) return context.json({ error: "No such pairing request." }, NOT_FOUND);
+		if (status !== "approved") return context.json({ status });
+		const redeemed = remote.redeem(requestId);
+		if (redeemed === void 0) return context.json({ status: "consumed" });
+		(0, hono_cookie.setCookie)(context, require_remote.DEVICE_COOKIE, redeemed.token, {
+			prefix: "host",
+			httpOnly: true,
+			sameSite: "Lax",
+			maxAge: redeemed.maxAgeSeconds
+		});
+		return context.json({
+			status: "approved",
+			bundleTrust: remote.bundleTrust(),
+			hostPublicKey: remote.channelPublicKey()
+		});
+	});
+	app.get(require_remote.REMOTE_API_ROUTE, (context) => {
+		const self = remote.authorize((0, hono_cookie.getCookie)(context, require_remote.DEVICE_COOKIE, "host"));
+		return context.json({ state: remote.state(self, isLocal(context)) });
+	});
+	app.post(`${require_remote.REMOTE_API_ROUTE}/enable`, async (context) => {
+		const refused = localOnly(context);
+		if (refused) return refused;
+		const outcome = await remote.enable();
+		if (!outcome.ok) return context.json({ error: outcome.error }, BAD_GATEWAY);
+		if (remote.handoverPending()) {
+			afterResponse(context, () => {
+				remote.commitHandover();
+			});
+			return context.json({
+				state: remote.state(void 0, true),
+				handingOver: true
+			}, ACCEPTED);
+		}
+		return context.json({ state: remote.state(void 0, true) });
+	});
+	app.post(`${require_remote.REMOTE_API_ROUTE}/disable`, async (context) => {
+		if (isLocal(context)) {
+			await remote.disable();
+			return context.json({ state: remote.state(void 0, true) });
+		}
+		afterResponse(context, () => void remote.disable());
+		return context.json({ status: "closing" }, ACCEPTED);
+	});
+	app.post(`${require_remote.REMOTE_API_ROUTE}/codes`, (context) => {
+		const refused = localOnly(context);
+		if (refused) return refused;
+		const minted = remote.mintPairing();
+		if (minted === void 0) return context.json({ error: "Remote access or signed bundle publication is unavailable." }, CONFLICT);
+		return context.json(minted, CREATED);
+	});
+	app.post(`${require_remote.REMOTE_API_ROUTE}/pairing/:id/approve`, (context) => {
+		const refused = localOnly(context);
+		if (refused) return refused;
+		const outcome = remote.approve(context.req.param("id"));
+		if (outcome === "approved") return context.json({ state: remote.state(void 0, true) });
+		if (outcome === "unknown") return context.json({ error: "No such pairing request." }, NOT_FOUND);
+		return context.json({ error: `That request is ${outcome}.` }, CONFLICT);
+	});
+	app.post(`${require_remote.REMOTE_API_ROUTE}/pairing/:id/deny`, (context) => {
+		const refused = localOnly(context);
+		if (refused) return refused;
+		const outcome = remote.deny(context.req.param("id"));
+		if (outcome === "denied") return context.json({ state: remote.state(void 0, true) });
+		if (outcome === "unknown") return context.json({ error: "No such pairing request." }, NOT_FOUND);
+		return context.json({ error: "That request is already settled." }, CONFLICT);
+	});
+	app.delete(`${require_remote.REMOTE_API_ROUTE}/devices/:id`, (context) => {
+		if (!remote.revokeDevice(context.req.param("id"))) return context.json({ error: "No such device." }, NOT_FOUND);
+		return context.json({ state: remote.state(void 0, isLocal(context)) });
+	});
+	app.get(`${require_remote.REMOTE_API_ROUTE}/passkeys`, (context) => {
+		const passkeys = remote.passkeys();
+		return context.json({
+			support: passkeys.support(),
+			credentials: passkeys.list().map(({ id, label, createdAt, lastUsedAt }) => ({
+				id,
+				label,
+				createdAt: new Date(createdAt).toISOString(),
+				lastUsedAt: new Date(lastUsedAt).toISOString()
+			}))
+		});
+	});
+	app.post(require_remote.PASSKEY_REGISTER_BEGIN_ROUTE, publicBudget, publicDeadline, limitedJsonBody(PASSKEY_BEGIN_BODY_BYTES), async (context) => {
+		const caller = registrationCaller(context);
+		if (caller === void 0) return context.json({ error: "This device is not paired." }, UNAUTHORIZED);
+		const begun = await remote.passkeys().beginRegistration(caller, labelFrom(context));
+		if (begun === void 0) return context.json({ error: remote.passkeys().support() }, CONFLICT);
+		return context.json(begun);
+	});
+	app.post(require_remote.PASSKEY_REGISTER_FINISH_ROUTE, publicBudget, publicDeadline, limitedJsonBody(PASSKEY_FINISH_BODY_BYTES), async (context) => {
+		const caller = registrationCaller(context);
+		if (caller === void 0) return context.json({ error: "This device is not paired." }, UNAUTHORIZED);
+		const body = await readJson(context);
+		if (body === void 0 || typeof body.ceremonyId !== "string" || !("response" in body)) return context.json({ error: "A ceremonyId and response are required." }, BAD_REQUEST);
+		const outcome = await remote.passkeys().finishRegistration(body.ceremonyId, caller, body.response, labelFrom(context));
+		if (!outcome.ok) return context.json({ error: outcome.error }, BAD_REQUEST);
+		return context.json({ id: outcome.id });
+	});
+	app.post(require_remote.PASSKEY_AUTH_BEGIN_ROUTE, publicBudget, publicDeadline, limitedJsonBody(PASSKEY_BEGIN_BODY_BYTES), async (context) => {
+		const listener = options.listenerOf(context);
+		const source = sourceAddressOf(context, listener) ?? "unknown";
+		if (listener === "tunnel" && !publicBeginAllowed(source)) {
+			context.header("Retry-After", "60");
+			return context.json({ error: "Too many passkey sign-in attempts. Try again shortly." }, TOO_MANY);
+		}
+		const caller = publicCeremonyCaller(context, true);
+		if (caller === void 0) return context.json({ error: "Could not start this sign-in." }, CONFLICT);
+		const begun = await remote.passkeys().beginAuthentication(caller);
+		if (begun === void 0) return context.json({ error: "Passkeys are unavailable." }, CONFLICT);
+		return context.json(begun);
+	});
+	app.post(require_remote.PASSKEY_AUTH_FINISH_ROUTE, publicBudget, publicDeadline, limitedJsonBody(PASSKEY_FINISH_BODY_BYTES), async (context) => {
+		const body = await readJson(context);
+		if (body === void 0 || typeof body.ceremonyId !== "string" || !("response" in body)) return context.json({ error: "A ceremonyId and response are required." }, BAD_REQUEST);
+		const caller = publicCeremonyCaller(context, false);
+		if (caller === void 0) return context.json({ error: "That sign-in was not started by this browser." }, UNAUTHORIZED);
+		const outcome = await remote.passkeys().finishAuthentication(body.ceremonyId, caller, body.response);
+		if (!outcome.ok) return context.json({ error: outcome.error }, UNAUTHORIZED);
+		const hostPublicKey = remote.channelPublicKey();
+		if (hostPublicKey === void 0) return context.json({ error: "Sealed channels are unavailable." }, CONFLICT);
+		const session = remote.sessionForPasskey(outcome.credential.label);
+		(0, hono_cookie.setCookie)(context, require_remote.DEVICE_COOKIE, session.token, {
+			prefix: "host",
+			httpOnly: true,
+			sameSite: "Lax",
+			maxAge: session.maxAgeSeconds
+		});
+		return context.json({
+			ok: true,
+			hostPublicKey
+		});
+	});
+	app.delete(`${require_remote.REMOTE_API_ROUTE}/passkeys/:id`, (context) => {
+		const refused = localOnly(context);
+		if (refused) return refused;
+		if (!remote.passkeys().forget(context.req.param("id"))) return context.json({ error: "No such passkey." }, NOT_FOUND);
+		return context.json({ ok: true });
+	});
+	/** A challenge bound to one action, so it cannot be replayed to authorise another. */
+	app.post(`${require_remote.REMOTE_API_ROUTE}/challenge`, async (context) => {
+		const body = await readJson(context);
+		if (body === void 0 || !require_index$1.isStepUpAction(body.action)) return context.json({ error: "A known action is required." }, BAD_REQUEST);
+		const begun = await remote.passkeys().beginStepUp(authenticatedCeremonyCaller(context), body.action);
+		if (begun === void 0) return context.json({ error: "Passkeys are unavailable." }, CONFLICT);
+		return context.json(begun);
+	});
+	/**
+	* Completes the sealed channel for the calling device.
+	*
+	* Unsealed by necessity: this is the request that establishes sealing. It
+	* carries only a public key, which is safe for the relay to see, and needs the
+	* host key delivered by an approved QR or successful passkey sign-in.
+	*/
+	app.post(require_remote.REMOTE_CHANNEL_ROUTE, limitedJsonBody(CHANNEL_BODY_BYTES), async (context) => {
+		const device = remote.authorize((0, hono_cookie.getCookie)(context, require_remote.DEVICE_COOKIE, "host"));
+		if (device === void 0) return context.json({ error: "This device is not paired." }, UNAUTHORIZED);
+		const body = await readJson(context);
+		if (body === void 0 || typeof body.clientPublicKey !== "string" || !isChannelScope(body.scope)) return context.json({ error: "A clientPublicKey and known scope are required." }, BAD_REQUEST);
+		if (!remote.openChannel(device, body.scope, body.clientPublicKey)) return context.json({ error: "That key did not complete a fresh channel." }, BAD_REQUEST);
+		return context.json({ ok: true });
+	});
+	app.put(`${require_remote.REMOTE_API_ROUTE}/settings`, async (context) => {
+		const refused = localOnly(context);
+		if (refused) return refused;
+		let body;
+		try {
+			body = await context.req.json();
+		} catch {
+			return context.json({ error: "The request body must be JSON." }, BAD_REQUEST);
+		}
+		if (!isRecord(body)) return context.json({ error: "The settings must be an object." }, BAD_REQUEST);
+		const settings = remote.updateSettings(body);
+		return context.json({ settings });
+	});
+}
+//#endregion
+exports.registerRemoteRoutes = registerRemoteRoutes;
+
+//# sourceMappingURL=remoteRoutes.cjs.map

package/dist/server/remoteRoutes.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"remoteRoutes.cjs","names":["sanitizeUserAgent","sanitizeEdgeIp","bodyLimit","timeout","HTTPException","getCookie","randomBytes","PAIRING_PAGE_ROUTE","pairingPageHtml","pairingPageHeaders","PAIRING_CLAIM_ROUTE","PAIRING_STATUS_ROUTE","PAIRING_STATUS_QUERY","DEVICE_COOKIE","REMOTE_API_ROUTE","PASSKEY_REGISTER_BEGIN_ROUTE","PASSKEY_REGISTER_FINISH_ROUTE","PASSKEY_AUTH_BEGIN_ROUTE","PASSKEY_AUTH_FINISH_ROUTE","isStepUpAction","REMOTE_CHANNEL_ROUTE"],"sources":["../../src/server/remoteRoutes.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto';\n\nimport type { Context, Hono, MiddlewareHandler } from 'hono';\nimport { bodyLimit } from 'hono/body-limit';\nimport { getCookie, setCookie } from 'hono/cookie';\nimport { HTTPException } from 'hono/http-exception';\nimport { timeout } from 'hono/timeout';\n\nimport {\n  DEVICE_COOKIE,\n  PAIRING_CLAIM_ROUTE,\n  PAIRING_PAGE_ROUTE,\n  PAIRING_STATUS_QUERY,\n  PAIRING_STATUS_ROUTE,\n  PASSKEY_AUTH_BEGIN_ROUTE,\n  PASSKEY_AUTH_FINISH_ROUTE,\n  PASSKEY_REGISTER_BEGIN_ROUTE,\n  PASSKEY_REGISTER_FINISH_ROUTE,\n  REMOTE_API_ROUTE,\n  REMOTE_CHANNEL_ROUTE,\n} from '../constants/remote';\nimport { sanitizeEdgeIp, sanitizeUserAgent } from '../services/deviceSessions';\nimport { pairingPageHeaders, pairingPageHtml } from '../services/pairingPage';\nimport type { RemoteAccess } from '../services/remoteAccess';\nimport type { GuardListener } from '../services/remoteGuardPolicy';\nimport { isStepUpAction } from '../services/webauthnPolicy';\nimport { type RemoteChannelScope } from '../types/remote';\n\nconst NONCE_BYTES = 16;\nconst BAD_REQUEST = 400;\nconst FORBIDDEN = 403;\nconst NOT_FOUND = 404;\nconst CONFLICT = 409;\nconst GONE = 410;\nconst TOO_MANY = 429;\nconst BAD_GATEWAY = 502;\nconst UNAUTHORIZED = 401;\nconst ACCEPTED = 202;\nconst CREATED = 201;\n/** Trusted Cloudflare client address, used for display and public abuse throttling only. */\nconst EDGE_IP_HEADER = 'cf-connecting-ip';\nconst PAYLOAD_TOO_LARGE = 413;\nconst REQUEST_TIMEOUT = 408;\nconst PUBLIC_REQUEST_CONCURRENCY = 8;\nconst PUBLIC_REQUEST_TIMEOUT_MS = 5000;\nconst PAIRING_BODY_BYTES = 2 * 1024;\nconst CHANNEL_BODY_BYTES = 4 * 1024;\nconst PASSKEY_BEGIN_BODY_BYTES = 256;\nconst PASSKEY_FINISH_BODY_BYTES = 64 * 1024;\nconst CEREMONY_CALLER_COOKIE = 'doompi_ceremony_caller';\nconst CEREMONY_CALLER_TOKEN = /^[A-Za-z0-9_-]{22}$/u;\nconst CEREMONY_CALLER_MAX_AGE_SECONDS = 10 * 60;\nconst PUBLIC_BEGIN_LIMIT = 10;\nconst PUBLIC_BEGIN_WINDOW_MS = 60_000;\nconst PUBLIC_BEGIN_SOURCE_LIMIT = 1024;\n/** Fallback wait before a remote-initiated shutdown, when the raw response is not reachable. */\nconst RESPONSE_FLUSH_GRACE_MS = 250;\nconst CHANNEL_SCOPES: ReadonlySet<RemoteChannelScope> = new Set(['session', 'protocol', 'http']);\n\ninterface NodeRequestBindings {\n  incoming?: { socket?: { remoteAddress?: string } };\n  sealedDeviceId?: string;\n}\n\nfunction isChannelScope(value: unknown): value is RemoteChannelScope {\n  return typeof value === 'string' && CHANNEL_SCOPES.has(value as RemoteChannelScope);\n}\n\nexport interface RemoteRoutesOptions {\n  remote: RemoteAccess;\n  /** Which listener a request arrived on, so control-plane routes can stay local. */\n  listenerOf: (context: Context) => GuardListener;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nasync function readJson(context: Context): Promise<Record<string, unknown> | undefined> {\n  try {\n    const body: unknown = await context.req.json();\n    return isRecord(body) ? body : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Runs an action once this response has reached the wire.\n *\n * Both callers tear down the listener carrying their own response, and the\n * difference between a confirmed answer and a socket error the caller cannot\n * distinguish from a failure is doing it in this order.\n */\nfunction afterResponse(context: Context, action: () => void): void {\n  const outgoing = (context.env as { outgoing?: { once: (event: string, listener: () => void) => void } }).outgoing;\n  if (outgoing === undefined) {\n    setTimeout(action, RESPONSE_FLUSH_GRACE_MS);\n    return;\n  }\n  outgoing.once('finish', action);\n}\n\n/** What the credential is called in the device list; the user agent is the only hint available. */\nfunction labelFrom(context: Context): string {\n  return sanitizeUserAgent(context.req.header('user-agent'));\n}\n\n/**\n * Cloudflare's normalized client address on the tunnel listener, with the\n * actual socket peer as the fallback for local and direct requests.\n *\n * A local process can forge the Cloudflare header, but local processes are\n * already outside this internet-client throttle boundary. Cloudflare is the\n * trusted proxy and overwrites this header for public requests.\n */\nfunction sourceAddressOf(context: Context, listener: GuardListener): string | undefined {\n  const socketPeer = (context.env as NodeRequestBindings | undefined)?.incoming?.socket?.remoteAddress;\n  if (listener !== 'tunnel') return socketPeer;\n  const edgeAddress = sanitizeEdgeIp(context.req.header(EDGE_IP_HEADER));\n  return edgeAddress === 'unknown' ? socketPeer : `cloudflare:${edgeAddress}`;\n}\n\nfunction limitedJsonBody(maxSize: number): MiddlewareHandler {\n  return bodyLimit({\n    maxSize,\n    onError: (context) => context.json({ error: 'The request body is too large.' }, PAYLOAD_TOO_LARGE),\n  });\n}\n\nfunction createPublicRequestBudget(isLocal: (context: Context) => boolean): MiddlewareHandler {\n  let active = 0;\n  return async (context, next) => {\n    if (isLocal(context)) return next();\n    if (active >= PUBLIC_REQUEST_CONCURRENCY) {\n      context.header('Retry-After', '1');\n      return context.json({ error: 'Too many public requests are already in progress.' }, TOO_MANY);\n    }\n    active += 1;\n    try {\n      await next();\n    } finally {\n      active -= 1;\n    }\n  };\n}\n\nfunction createPublicBeginLimit(): (source: string) => boolean {\n  const windows = new Map<string, { count: number; startedAt: number }>();\n  return (source) => {\n    const at = Date.now();\n    let window = windows.get(source);\n    if (window === undefined || at - window.startedAt >= PUBLIC_BEGIN_WINDOW_MS) {\n      if (window === undefined && windows.size >= PUBLIC_BEGIN_SOURCE_LIMIT) {\n        const oldest = windows.keys().next().value as string | undefined;\n        if (oldest !== undefined) windows.delete(oldest);\n      }\n      window = { count: 0, startedAt: at };\n      windows.delete(source);\n      windows.set(source, window);\n    }\n    if (window.count >= PUBLIC_BEGIN_LIMIT) return false;\n    window.count += 1;\n    return true;\n  };\n}\n\n/**\n * Registers the pairing surface and the remote-access control plane.\n *\n * Split by who may reach them, not by shape. The three pairing routes are the\n * only unauthenticated ones on the tunnel listener, so each is small, constant,\n * and echoes nothing from its request. The control plane is mostly local-only:\n * minting a code, approving, denying, and changing settings all stay at the\n * machine, because a device that can do them can make its own access permanent.\n * Turning remote access off and revoking a credential are allowed remotely, on\n * the grounds that a panic button is worth more from the phone than the desk.\n */\nexport function registerRemoteRoutes(app: Hono, options: RemoteRoutesOptions): void {\n  const { remote } = options;\n  const isLocal = (context: Context): boolean => options.listenerOf(context) === 'local';\n  const localOnly = (context: Context): Response | undefined =>\n    isLocal(context) ? undefined : context.json({ error: 'This action is only available on the host.' }, FORBIDDEN);\n  const publicBudget = createPublicRequestBudget(isLocal);\n  const publicBeginAllowed = createPublicBeginLimit();\n  const publicDeadline = timeout(\n    PUBLIC_REQUEST_TIMEOUT_MS,\n    () =>\n      new HTTPException(REQUEST_TIMEOUT, {\n        res: Response.json({ error: 'The public request timed out.' }, { status: REQUEST_TIMEOUT }),\n      }),\n  );\n  const authenticatedCeremonyCaller = (context: Context): string => {\n    const trusted = (context.env as NodeRequestBindings | undefined)?.sealedDeviceId;\n    const deviceId = trusted ?? remote.authorize(getCookie(context, DEVICE_COOKIE, 'host'));\n    return deviceId === undefined ? 'local' : `device:${deviceId}`;\n  };\n  const registrationCaller = (context: Context): string | undefined => {\n    const caller = authenticatedCeremonyCaller(context);\n    return isLocal(context) || caller !== 'local' ? caller : undefined;\n  };\n  const publicCeremonyCaller = (context: Context, create: boolean): string | undefined => {\n    let token = getCookie(context, CEREMONY_CALLER_COOKIE, 'host');\n    if (token !== undefined && !CEREMONY_CALLER_TOKEN.test(token)) token = undefined;\n    if (token === undefined && create) token = randomBytes(16).toString('base64url');\n    if (token !== undefined && create) {\n      setCookie(context, CEREMONY_CALLER_COOKIE, token, {\n        prefix: 'host',\n        httpOnly: true,\n        sameSite: 'Strict',\n        maxAge: CEREMONY_CALLER_MAX_AGE_SECONDS,\n      });\n    }\n    return token === undefined ? undefined : `public:${token}`;\n  };\n  app.get(PAIRING_PAGE_ROUTE, (context) => {\n    const nonce = randomBytes(NONCE_BYTES).toString('base64');\n    const localTrust = options.listenerOf(context) === 'local' ? remote.bundleTrust() : undefined;\n    return context.body(\n      pairingPageHtml({ nonce, ...(localTrust === undefined ? {} : { localTrust }) }),\n      200,\n      pairingPageHeaders(nonce),\n    );\n  });\n\n  app.post(PAIRING_CLAIM_ROUTE, publicBudget, publicDeadline, limitedJsonBody(PAIRING_BODY_BYTES), async (context) => {\n    let body: unknown;\n    try {\n      body = await context.req.json();\n    } catch {\n      return context.json({ error: 'The request body must be JSON.' }, BAD_REQUEST);\n    }\n    if (!isRecord(body) || typeof body.code !== 'string' || body.code === '') {\n      return context.json({ error: 'A code string is required.' }, BAD_REQUEST);\n    }\n    const outcome = remote.claim({\n      code: body.code,\n      userAgent: context.req.header('user-agent'),\n      edgeIp: context.req.header(EDGE_IP_HEADER),\n      sourceAddress: sourceAddressOf(context, options.listenerOf(context)),\n    });\n    if (outcome.ok) return context.json({ requestId: outcome.requestId, status: 'pending' }, ACCEPTED);\n    if (outcome.code === 'unknown_code') return context.json({ error: 'That code is not valid.' }, GONE);\n    return context.json({ error: 'Too many attempts.' }, TOO_MANY);\n  });\n\n  app.get(PAIRING_STATUS_ROUTE, (context) => {\n    const requestId = context.req.query(PAIRING_STATUS_QUERY);\n    if (requestId === undefined) return context.json({ error: 'A request id is required.' }, BAD_REQUEST);\n    const status = remote.pairingStatus(requestId);\n    if (status === undefined) return context.json({ error: 'No such pairing request.' }, NOT_FOUND);\n    if (status !== 'approved') return context.json({ status });\n    const redeemed = remote.redeem(requestId);\n    if (redeemed === undefined) return context.json({ status: 'consumed' });\n    // Secure is a constant, never derived. cloudflared terminates TLS at the\n    // edge and forwards plaintext, so the request scheme here is http and\n    // x-forwarded-proto is attacker-controllable; hono's host prefix hardcodes\n    // Secure, Path=/ and no Domain, and throws if they are contradicted.\n    setCookie(context, DEVICE_COOKIE, redeemed.token, {\n      prefix: 'host',\n      httpOnly: true,\n      sameSite: 'Lax',\n      maxAge: redeemed.maxAgeSeconds,\n    });\n    return context.json({\n      status: 'approved',\n      bundleTrust: remote.bundleTrust(),\n      hostPublicKey: remote.channelPublicKey(),\n    });\n  });\n\n  app.get(REMOTE_API_ROUTE, (context) => {\n    // So a remote caller's own row can be marked \"this device\" and it cannot\n    // revoke itself by accident while hunting for a stale one.\n    const self = remote.authorize(getCookie(context, DEVICE_COOKIE, 'host'));\n    return context.json({ state: remote.state(self, isLocal(context)) });\n  });\n\n  app.post(`${REMOTE_API_ROUTE}/enable`, async (context) => {\n    const refused = localOnly(context);\n    if (refused) return refused;\n    const outcome = await remote.enable();\n    if (!outcome.ok) return context.json({ error: outcome.error }, BAD_GATEWAY);\n    // A contained cockpit answers here and moves afterwards, so the browser\n    // learns the handover started before the server it asked goes away.\n    if (remote.handoverPending()) {\n      afterResponse(context, () => {\n        remote.commitHandover();\n      });\n      return context.json({ state: remote.state(undefined, true), handingOver: true }, ACCEPTED);\n    }\n    return context.json({ state: remote.state(undefined, true) });\n  });\n\n  // Deliberately reachable from a paired device: this is the panic button.\n  app.post(`${REMOTE_API_ROUTE}/disable`, async (context) => {\n    if (isLocal(context)) {\n      await remote.disable();\n      return context.json({ state: remote.state(undefined, true) });\n    }\n    // Switching off from the phone tears down the listener carrying this very\n    // response.\n    afterResponse(context, () => void remote.disable());\n    return context.json({ status: 'closing' }, ACCEPTED);\n  });\n\n  app.post(`${REMOTE_API_ROUTE}/codes`, (context) => {\n    const refused = localOnly(context);\n    if (refused) return refused;\n    const minted = remote.mintPairing();\n    if (minted === undefined)\n      return context.json({ error: 'Remote access or signed bundle publication is unavailable.' }, CONFLICT);\n    return context.json(minted, CREATED);\n  });\n\n  app.post(`${REMOTE_API_ROUTE}/pairing/:id/approve`, (context) => {\n    const refused = localOnly(context);\n    if (refused) return refused;\n    const outcome = remote.approve(context.req.param('id'));\n    if (outcome === 'approved') return context.json({ state: remote.state(undefined, true) });\n    if (outcome === 'unknown') return context.json({ error: 'No such pairing request.' }, NOT_FOUND);\n    return context.json({ error: `That request is ${outcome}.` }, CONFLICT);\n  });\n\n  app.post(`${REMOTE_API_ROUTE}/pairing/:id/deny`, (context) => {\n    const refused = localOnly(context);\n    if (refused) return refused;\n    const outcome = remote.deny(context.req.param('id'));\n    if (outcome === 'denied') return context.json({ state: remote.state(undefined, true) });\n    if (outcome === 'unknown') return context.json({ error: 'No such pairing request.' }, NOT_FOUND);\n    return context.json({ error: 'That request is already settled.' }, CONFLICT);\n  });\n\n  app.delete(`${REMOTE_API_ROUTE}/devices/:id`, (context) => {\n    if (!remote.revokeDevice(context.req.param('id'))) {\n      return context.json({ error: 'No such device.' }, NOT_FOUND);\n    }\n    return context.json({ state: remote.state(undefined, isLocal(context)) });\n  });\n\n  // Registration is direct so the approved phone can enrol before opening the\n  // cockpit. On the tunnel listener, the device cookie remains mandatory.\n  app.get(`${REMOTE_API_ROUTE}/passkeys`, (context) => {\n    const passkeys = remote.passkeys();\n    return context.json({\n      support: passkeys.support(),\n      credentials: passkeys.list().map(({ id, label, createdAt, lastUsedAt }) => ({\n        id,\n        label,\n        createdAt: new Date(createdAt).toISOString(),\n        lastUsedAt: new Date(lastUsedAt).toISOString(),\n      })),\n    });\n  });\n\n  app.post(\n    PASSKEY_REGISTER_BEGIN_ROUTE,\n    publicBudget,\n    publicDeadline,\n    limitedJsonBody(PASSKEY_BEGIN_BODY_BYTES),\n    async (context) => {\n      const caller = registrationCaller(context);\n      if (caller === undefined) return context.json({ error: 'This device is not paired.' }, UNAUTHORIZED);\n      const begun = await remote.passkeys().beginRegistration(caller, labelFrom(context));\n      if (begun === undefined) return context.json({ error: remote.passkeys().support() }, CONFLICT);\n      return context.json(begun);\n    },\n  );\n\n  app.post(\n    PASSKEY_REGISTER_FINISH_ROUTE,\n    publicBudget,\n    publicDeadline,\n    limitedJsonBody(PASSKEY_FINISH_BODY_BYTES),\n    async (context) => {\n      const caller = registrationCaller(context);\n      if (caller === undefined) return context.json({ error: 'This device is not paired.' }, UNAUTHORIZED);\n      const body = await readJson(context);\n      if (body === undefined || typeof body.ceremonyId !== 'string' || !('response' in body)) {\n        return context.json({ error: 'A ceremonyId and response are required.' }, BAD_REQUEST);\n      }\n      const outcome = await remote\n        .passkeys()\n        .finishRegistration(body.ceremonyId, caller, body.response, labelFrom(context));\n      if (!outcome.ok) return context.json({ error: outcome.error }, BAD_REQUEST);\n      return context.json({ id: outcome.id });\n    },\n  );\n\n  // Sign-in is reachable unauthenticated on purpose: proving a registered\n  // passkey is how a returning device gets a session without another QR.\n  app.post(\n    PASSKEY_AUTH_BEGIN_ROUTE,\n    publicBudget,\n    publicDeadline,\n    limitedJsonBody(PASSKEY_BEGIN_BODY_BYTES),\n    async (context) => {\n      const listener = options.listenerOf(context);\n      const source = sourceAddressOf(context, listener) ?? 'unknown';\n      if (listener === 'tunnel' && !publicBeginAllowed(source)) {\n        context.header('Retry-After', '60');\n        return context.json({ error: 'Too many passkey sign-in attempts. Try again shortly.' }, TOO_MANY);\n      }\n      const caller = publicCeremonyCaller(context, true);\n      if (caller === undefined) return context.json({ error: 'Could not start this sign-in.' }, CONFLICT);\n      const begun = await remote.passkeys().beginAuthentication(caller);\n      if (begun === undefined) return context.json({ error: 'Passkeys are unavailable.' }, CONFLICT);\n      return context.json(begun);\n    },\n  );\n\n  app.post(\n    PASSKEY_AUTH_FINISH_ROUTE,\n    publicBudget,\n    publicDeadline,\n    limitedJsonBody(PASSKEY_FINISH_BODY_BYTES),\n    async (context) => {\n      const body = await readJson(context);\n      if (body === undefined || typeof body.ceremonyId !== 'string' || !('response' in body)) {\n        return context.json({ error: 'A ceremonyId and response are required.' }, BAD_REQUEST);\n      }\n      const caller = publicCeremonyCaller(context, false);\n      if (caller === undefined)\n        return context.json({ error: 'That sign-in was not started by this browser.' }, UNAUTHORIZED);\n      const outcome = await remote.passkeys().finishAuthentication(body.ceremonyId, caller, body.response);\n      if (!outcome.ok) return context.json({ error: outcome.error }, UNAUTHORIZED);\n      const hostPublicKey = remote.channelPublicKey();\n      if (hostPublicKey === undefined) return context.json({ error: 'Sealed channels are unavailable.' }, CONFLICT);\n      const session = remote.sessionForPasskey(outcome.credential.label);\n      setCookie(context, DEVICE_COOKIE, session.token, {\n        prefix: 'host',\n        httpOnly: true,\n        sameSite: 'Lax',\n        maxAge: session.maxAgeSeconds,\n      });\n      return context.json({ ok: true, hostPublicKey });\n    },\n  );\n\n  app.delete(`${REMOTE_API_ROUTE}/passkeys/:id`, (context) => {\n    const refused = localOnly(context);\n    if (refused) return refused;\n    if (!remote.passkeys().forget(context.req.param('id'))) {\n      return context.json({ error: 'No such passkey.' }, NOT_FOUND);\n    }\n    return context.json({ ok: true });\n  });\n\n  /** A challenge bound to one action, so it cannot be replayed to authorise another. */\n  app.post(`${REMOTE_API_ROUTE}/challenge`, async (context) => {\n    const body = await readJson(context);\n    if (body === undefined || !isStepUpAction(body.action)) {\n      return context.json({ error: 'A known action is required.' }, BAD_REQUEST);\n    }\n    const begun = await remote.passkeys().beginStepUp(authenticatedCeremonyCaller(context), body.action);\n    if (begun === undefined) return context.json({ error: 'Passkeys are unavailable.' }, CONFLICT);\n    return context.json(begun);\n  });\n\n  /**\n   * Completes the sealed channel for the calling device.\n   *\n   * Unsealed by necessity: this is the request that establishes sealing. It\n   * carries only a public key, which is safe for the relay to see, and needs the\n   * host key delivered by an approved QR or successful passkey sign-in.\n   */\n  app.post(REMOTE_CHANNEL_ROUTE, limitedJsonBody(CHANNEL_BODY_BYTES), async (context) => {\n    const device = remote.authorize(getCookie(context, DEVICE_COOKIE, 'host'));\n    if (device === undefined) return context.json({ error: 'This device is not paired.' }, UNAUTHORIZED);\n    const body = await readJson(context);\n    if (body === undefined || typeof body.clientPublicKey !== 'string' || !isChannelScope(body.scope)) {\n      return context.json({ error: 'A clientPublicKey and known scope are required.' }, BAD_REQUEST);\n    }\n    if (!remote.openChannel(device, body.scope, body.clientPublicKey)) {\n      return context.json({ error: 'That key did not complete a fresh channel.' }, BAD_REQUEST);\n    }\n    return context.json({ ok: true });\n  });\n\n  app.put(`${REMOTE_API_ROUTE}/settings`, async (context) => {\n    const refused = localOnly(context);\n    if (refused) return refused;\n    let body: unknown;\n    try {\n      body = await context.req.json();\n    } catch {\n      return context.json({ error: 'The request body must be JSON.' }, BAD_REQUEST);\n    }\n    if (!isRecord(body)) return context.json({ error: 'The settings must be an object.' }, BAD_REQUEST);\n    const settings = remote.updateSettings(body);\n    return context.json({ settings });\n  });\n}\n"],"mappings":";;;;;;;;;;AA4BA,MAAM,cAAc;AACpB,MAAM,cAAc;AACpB,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAM,WAAW;AACjB,MAAM,OAAO;AACb,MAAM,WAAW;AACjB,MAAM,cAAc;AACpB,MAAM,eAAe;AACrB,MAAM,WAAW;AACjB,MAAM,UAAU;;AAEhB,MAAM,iBAAiB;AACvB,MAAM,oBAAoB;AAC1B,MAAM,kBAAkB;AACxB,MAAM,6BAA6B;AACnC,MAAM,4BAA4B;AAClC,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;AAC3B,MAAM,2BAA2B;AACjC,MAAM,4BAA4B;AAClC,MAAM,yBAAyB;AAC/B,MAAM,wBAAwB;AAC9B,MAAM,kCAAkC;AACxC,MAAM,qBAAqB;AAC3B,MAAM,yBAAyB;AAC/B,MAAM,4BAA4B;;AAElC,MAAM,0BAA0B;AAChC,MAAM,iCAAkD,IAAI,IAAI;CAAC;CAAW;CAAY;AAAM,CAAC;AAO/F,SAAS,eAAe,OAA6C;CACnE,OAAO,OAAO,UAAU,YAAY,eAAe,IAAI,KAA2B;AACpF;AAQA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,eAAe,SAAS,SAAgE;CACtF,IAAI;EACF,MAAM,OAAgB,MAAM,QAAQ,IAAI,KAAK;EAC7C,OAAO,SAAS,IAAI,IAAI,OAAO,KAAA;CACjC,QAAQ;EACN;CACF;AACF;;;;;;;;AASA,SAAS,cAAc,SAAkB,QAA0B;CACjE,MAAM,WAAY,QAAQ,IAA+E;CACzG,IAAI,aAAa,KAAA,GAAW;EAC1B,WAAW,QAAQ,uBAAuB;EAC1C;CACF;CACA,SAAS,KAAK,UAAU,MAAM;AAChC;;AAGA,SAAS,UAAU,SAA0B;CAC3C,OAAOA,cAAAA,kBAAkB,QAAQ,IAAI,OAAO,YAAY,CAAC;AAC3D;;;;;;;;;AAUA,SAAS,gBAAgB,SAAkB,UAA6C;CACtF,MAAM,aAAc,QAAQ,KAAyC,UAAU,QAAQ;CACvF,IAAI,aAAa,UAAU,OAAO;CAClC,MAAM,cAAcC,cAAAA,eAAe,QAAQ,IAAI,OAAO,cAAc,CAAC;CACrE,OAAO,gBAAgB,YAAY,aAAa,cAAc;AAChE;AAEA,SAAS,gBAAgB,SAAoC;CAC3D,QAAA,GAAOC,gBAAAA,UAAAA,CAAU;EACf;EACA,UAAU,YAAY,QAAQ,KAAK,EAAE,OAAO,iCAAiC,GAAG,iBAAiB;CACnG,CAAC;AACH;AAEA,SAAS,0BAA0B,SAA2D;CAC5F,IAAI,SAAS;CACb,OAAO,OAAO,SAAS,SAAS;EAC9B,IAAI,QAAQ,OAAO,GAAG,OAAO,KAAK;EAClC,IAAI,UAAU,4BAA4B;GACxC,QAAQ,OAAO,eAAe,GAAG;GACjC,OAAO,QAAQ,KAAK,EAAE,OAAO,oDAAoD,GAAG,QAAQ;EAC9F;EACA,UAAU;EACV,IAAI;GACF,MAAM,KAAK;EACb,UAAU;GACR,UAAU;EACZ;CACF;AACF;AAEA,SAAS,yBAAsD;CAC7D,MAAM,0BAAU,IAAI,IAAkD;CACtE,QAAQ,WAAW;EACjB,MAAM,KAAK,KAAK,IAAI;EACpB,IAAI,SAAS,QAAQ,IAAI,MAAM;EAC/B,IAAI,WAAW,KAAA,KAAa,KAAK,OAAO,aAAa,wBAAwB;GAC3E,IAAI,WAAW,KAAA,KAAa,QAAQ,QAAQ,2BAA2B;IACrE,MAAM,SAAS,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,WAAW,KAAA,GAAW,QAAQ,OAAO,MAAM;GACjD;GACA,SAAS;IAAE,OAAO;IAAG,WAAW;GAAG;GACnC,QAAQ,OAAO,MAAM;GACrB,QAAQ,IAAI,QAAQ,MAAM;EAC5B;EACA,IAAI,OAAO,SAAS,oBAAoB,OAAO;EAC/C,OAAO,SAAS;EAChB,OAAO;CACT;AACF;;;;;;;;;;;;AAaA,SAAgB,qBAAqB,KAAW,SAAoC;CAClF,MAAM,EAAE,WAAW;CACnB,MAAM,WAAW,YAA8B,QAAQ,WAAW,OAAO,MAAM;CAC/E,MAAM,aAAa,YACjB,QAAQ,OAAO,IAAI,KAAA,IAAY,QAAQ,KAAK,EAAE,OAAO,6CAA6C,GAAG,SAAS;CAChH,MAAM,eAAe,0BAA0B,OAAO;CACtD,MAAM,qBAAqB,uBAAuB;CAClD,MAAM,kBAAA,GAAiBC,aAAAA,QAAAA,CACrB,iCAEE,IAAIC,oBAAAA,cAAc,iBAAiB,EACjC,KAAK,SAAS,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,gBAAgB,CAAC,EAC5F,CAAC,CACL;CACA,MAAM,+BAA+B,YAA6B;EAEhE,MAAM,WADW,QAAQ,KAAyC,kBACtC,OAAO,WAAA,GAAUC,YAAAA,UAAAA,CAAU,SAAA,iBAAwB,MAAM,CAAC;EACtF,OAAO,aAAa,KAAA,IAAY,UAAU,UAAU;CACtD;CACA,MAAM,sBAAsB,YAAyC;EACnE,MAAM,SAAS,4BAA4B,OAAO;EAClD,OAAO,QAAQ,OAAO,KAAK,WAAW,UAAU,SAAS,KAAA;CAC3D;CACA,MAAM,wBAAwB,SAAkB,WAAwC;EACtF,IAAI,SAAA,GAAQA,YAAAA,UAAAA,CAAU,SAAS,wBAAwB,MAAM;EAC7D,IAAI,UAAU,KAAA,KAAa,CAAC,sBAAsB,KAAK,KAAK,GAAG,QAAQ,KAAA;EACvE,IAAI,UAAU,KAAA,KAAa,QAAQ,SAAA,GAAQC,YAAAA,YAAAA,CAAY,EAAE,CAAC,CAAC,SAAS,WAAW;EAC/E,IAAI,UAAU,KAAA,KAAa,QACzB,CAAA,GAAA,YAAA,UAAA,CAAU,SAAS,wBAAwB,OAAO;GAChD,QAAQ;GACR,UAAU;GACV,UAAU;GACV,QAAQ;EACV,CAAC;EAEH,OAAO,UAAU,KAAA,IAAY,KAAA,IAAY,UAAU;CACrD;CACA,IAAI,IAAIC,eAAAA,qBAAqB,YAAY;EACvC,MAAM,SAAA,GAAQD,YAAAA,YAAAA,CAAY,WAAW,CAAC,CAAC,SAAS,QAAQ;EACxD,MAAM,aAAa,QAAQ,WAAW,OAAO,MAAM,UAAU,OAAO,YAAY,IAAI,KAAA;EACpF,OAAO,QAAQ,KACbE,gBAAAA,gBAAgB;GAAE;GAAO,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;EAAG,CAAC,GAC9E,KACAC,gBAAAA,mBAAmB,KAAK,CAC1B;CACF,CAAC;CAED,IAAI,KAAKC,eAAAA,qBAAqB,cAAc,gBAAgB,gBAAgB,kBAAkB,GAAG,OAAO,YAAY;EAClH,IAAI;EACJ,IAAI;GACF,OAAO,MAAM,QAAQ,IAAI,KAAK;EAChC,QAAQ;GACN,OAAO,QAAQ,KAAK,EAAE,OAAO,iCAAiC,GAAG,WAAW;EAC9E;EACA,IAAI,CAAC,SAAS,IAAI,KAAK,OAAO,KAAK,SAAS,YAAY,KAAK,SAAS,IACpE,OAAO,QAAQ,KAAK,EAAE,OAAO,6BAA6B,GAAG,WAAW;EAE1E,MAAM,UAAU,OAAO,MAAM;GAC3B,MAAM,KAAK;GACX,WAAW,QAAQ,IAAI,OAAO,YAAY;GAC1C,QAAQ,QAAQ,IAAI,OAAO,cAAc;GACzC,eAAe,gBAAgB,SAAS,QAAQ,WAAW,OAAO,CAAC;EACrE,CAAC;EACD,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK;GAAE,WAAW,QAAQ;GAAW,QAAQ;EAAU,GAAG,QAAQ;EACjG,IAAI,QAAQ,SAAS,gBAAgB,OAAO,QAAQ,KAAK,EAAE,OAAO,0BAA0B,GAAG,IAAI;EACnG,OAAO,QAAQ,KAAK,EAAE,OAAO,qBAAqB,GAAG,QAAQ;CAC/D,CAAC;CAED,IAAI,IAAIC,eAAAA,uBAAuB,YAAY;EACzC,MAAM,YAAY,QAAQ,IAAI,MAAMC,eAAAA,oBAAoB;EACxD,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,KAAK,EAAE,OAAO,4BAA4B,GAAG,WAAW;EACpG,MAAM,SAAS,OAAO,cAAc,SAAS;EAC7C,IAAI,WAAW,KAAA,GAAW,OAAO,QAAQ,KAAK,EAAE,OAAO,2BAA2B,GAAG,SAAS;EAC9F,IAAI,WAAW,YAAY,OAAO,QAAQ,KAAK,EAAE,OAAO,CAAC;EACzD,MAAM,WAAW,OAAO,OAAO,SAAS;EACxC,IAAI,aAAa,KAAA,GAAW,OAAO,QAAQ,KAAK,EAAE,QAAQ,WAAW,CAAC;EAKtE,CAAA,GAAA,YAAA,UAAA,CAAU,SAASC,eAAAA,eAAe,SAAS,OAAO;GAChD,QAAQ;GACR,UAAU;GACV,UAAU;GACV,QAAQ,SAAS;EACnB,CAAC;EACD,OAAO,QAAQ,KAAK;GAClB,QAAQ;GACR,aAAa,OAAO,YAAY;GAChC,eAAe,OAAO,iBAAiB;EACzC,CAAC;CACH,CAAC;CAED,IAAI,IAAIC,eAAAA,mBAAmB,YAAY;EAGrC,MAAM,OAAO,OAAO,WAAA,GAAUT,YAAAA,UAAAA,CAAU,SAASQ,eAAAA,eAAe,MAAM,CAAC;EACvE,OAAO,QAAQ,KAAK,EAAE,OAAO,OAAO,MAAM,MAAM,QAAQ,OAAO,CAAC,EAAE,CAAC;CACrE,CAAC;CAED,IAAI,KAAK,GAAGC,eAAAA,iBAAiB,UAAU,OAAO,YAAY;EACxD,MAAM,UAAU,UAAU,OAAO;EACjC,IAAI,SAAS,OAAO;EACpB,MAAM,UAAU,MAAM,OAAO,OAAO;EACpC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,EAAE,OAAO,QAAQ,MAAM,GAAG,WAAW;EAG1E,IAAI,OAAO,gBAAgB,GAAG;GAC5B,cAAc,eAAe;IAC3B,OAAO,eAAe;GACxB,CAAC;GACD,OAAO,QAAQ,KAAK;IAAE,OAAO,OAAO,MAAM,KAAA,GAAW,IAAI;IAAG,aAAa;GAAK,GAAG,QAAQ;EAC3F;EACA,OAAO,QAAQ,KAAK,EAAE,OAAO,OAAO,MAAM,KAAA,GAAW,IAAI,EAAE,CAAC;CAC9D,CAAC;CAGD,IAAI,KAAK,GAAGA,eAAAA,iBAAiB,WAAW,OAAO,YAAY;EACzD,IAAI,QAAQ,OAAO,GAAG;GACpB,MAAM,OAAO,QAAQ;GACrB,OAAO,QAAQ,KAAK,EAAE,OAAO,OAAO,MAAM,KAAA,GAAW,IAAI,EAAE,CAAC;EAC9D;EAGA,cAAc,eAAe,KAAK,OAAO,QAAQ,CAAC;EAClD,OAAO,QAAQ,KAAK,EAAE,QAAQ,UAAU,GAAG,QAAQ;CACrD,CAAC;CAED,IAAI,KAAK,GAAGA,eAAAA,iBAAiB,UAAU,YAAY;EACjD,MAAM,UAAU,UAAU,OAAO;EACjC,IAAI,SAAS,OAAO;EACpB,MAAM,SAAS,OAAO,YAAY;EAClC,IAAI,WAAW,KAAA,GACb,OAAO,QAAQ,KAAK,EAAE,OAAO,6DAA6D,GAAG,QAAQ;EACvG,OAAO,QAAQ,KAAK,QAAQ,OAAO;CACrC,CAAC;CAED,IAAI,KAAK,GAAGA,eAAAA,iBAAiB,wBAAwB,YAAY;EAC/D,MAAM,UAAU,UAAU,OAAO;EACjC,IAAI,SAAS,OAAO;EACpB,MAAM,UAAU,OAAO,QAAQ,QAAQ,IAAI,MAAM,IAAI,CAAC;EACtD,IAAI,YAAY,YAAY,OAAO,QAAQ,KAAK,EAAE,OAAO,OAAO,MAAM,KAAA,GAAW,IAAI,EAAE,CAAC;EACxF,IAAI,YAAY,WAAW,OAAO,QAAQ,KAAK,EAAE,OAAO,2BAA2B,GAAG,SAAS;EAC/F,OAAO,QAAQ,KAAK,EAAE,OAAO,mBAAmB,QAAQ,GAAG,GAAG,QAAQ;CACxE,CAAC;CAED,IAAI,KAAK,GAAGA,eAAAA,iBAAiB,qBAAqB,YAAY;EAC5D,MAAM,UAAU,UAAU,OAAO;EACjC,IAAI,SAAS,OAAO;EACpB,MAAM,UAAU,OAAO,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC;EACnD,IAAI,YAAY,UAAU,OAAO,QAAQ,KAAK,EAAE,OAAO,OAAO,MAAM,KAAA,GAAW,IAAI,EAAE,CAAC;EACtF,IAAI,YAAY,WAAW,OAAO,QAAQ,KAAK,EAAE,OAAO,2BAA2B,GAAG,SAAS;EAC/F,OAAO,QAAQ,KAAK,EAAE,OAAO,mCAAmC,GAAG,QAAQ;CAC7E,CAAC;CAED,IAAI,OAAO,GAAGA,eAAAA,iBAAiB,gBAAgB,YAAY;EACzD,IAAI,CAAC,OAAO,aAAa,QAAQ,IAAI,MAAM,IAAI,CAAC,GAC9C,OAAO,QAAQ,KAAK,EAAE,OAAO,kBAAkB,GAAG,SAAS;EAE7D,OAAO,QAAQ,KAAK,EAAE,OAAO,OAAO,MAAM,KAAA,GAAW,QAAQ,OAAO,CAAC,EAAE,CAAC;CAC1E,CAAC;CAID,IAAI,IAAI,GAAGA,eAAAA,iBAAiB,aAAa,YAAY;EACnD,MAAM,WAAW,OAAO,SAAS;EACjC,OAAO,QAAQ,KAAK;GAClB,SAAS,SAAS,QAAQ;GAC1B,aAAa,SAAS,KAAK,CAAC,CAAC,KAAK,EAAE,IAAI,OAAO,WAAW,kBAAkB;IAC1E;IACA;IACA,WAAW,IAAI,KAAK,SAAS,CAAC,CAAC,YAAY;IAC3C,YAAY,IAAI,KAAK,UAAU,CAAC,CAAC,YAAY;GAC/C,EAAE;EACJ,CAAC;CACH,CAAC;CAED,IAAI,KACFC,eAAAA,8BACA,cACA,gBACA,gBAAgB,wBAAwB,GACxC,OAAO,YAAY;EACjB,MAAM,SAAS,mBAAmB,OAAO;EACzC,IAAI,WAAW,KAAA,GAAW,OAAO,QAAQ,KAAK,EAAE,OAAO,6BAA6B,GAAG,YAAY;EACnG,MAAM,QAAQ,MAAM,OAAO,SAAS,CAAC,CAAC,kBAAkB,QAAQ,UAAU,OAAO,CAAC;EAClF,IAAI,UAAU,KAAA,GAAW,OAAO,QAAQ,KAAK,EAAE,OAAO,OAAO,SAAS,CAAC,CAAC,QAAQ,EAAE,GAAG,QAAQ;EAC7F,OAAO,QAAQ,KAAK,KAAK;CAC3B,CACF;CAEA,IAAI,KACFC,eAAAA,+BACA,cACA,gBACA,gBAAgB,yBAAyB,GACzC,OAAO,YAAY;EACjB,MAAM,SAAS,mBAAmB,OAAO;EACzC,IAAI,WAAW,KAAA,GAAW,OAAO,QAAQ,KAAK,EAAE,OAAO,6BAA6B,GAAG,YAAY;EACnG,MAAM,OAAO,MAAM,SAAS,OAAO;EACnC,IAAI,SAAS,KAAA,KAAa,OAAO,KAAK,eAAe,YAAY,EAAE,cAAc,OAC/E,OAAO,QAAQ,KAAK,EAAE,OAAO,0CAA0C,GAAG,WAAW;EAEvF,MAAM,UAAU,MAAM,OACnB,SAAS,CAAC,CACV,mBAAmB,KAAK,YAAY,QAAQ,KAAK,UAAU,UAAU,OAAO,CAAC;EAChF,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,EAAE,OAAO,QAAQ,MAAM,GAAG,WAAW;EAC1E,OAAO,QAAQ,KAAK,EAAE,IAAI,QAAQ,GAAG,CAAC;CACxC,CACF;CAIA,IAAI,KACFC,eAAAA,0BACA,cACA,gBACA,gBAAgB,wBAAwB,GACxC,OAAO,YAAY;EACjB,MAAM,WAAW,QAAQ,WAAW,OAAO;EAC3C,MAAM,SAAS,gBAAgB,SAAS,QAAQ,KAAK;EACrD,IAAI,aAAa,YAAY,CAAC,mBAAmB,MAAM,GAAG;GACxD,QAAQ,OAAO,eAAe,IAAI;GAClC,OAAO,QAAQ,KAAK,EAAE,OAAO,wDAAwD,GAAG,QAAQ;EAClG;EACA,MAAM,SAAS,qBAAqB,SAAS,IAAI;EACjD,IAAI,WAAW,KAAA,GAAW,OAAO,QAAQ,KAAK,EAAE,OAAO,gCAAgC,GAAG,QAAQ;EAClG,MAAM,QAAQ,MAAM,OAAO,SAAS,CAAC,CAAC,oBAAoB,MAAM;EAChE,IAAI,UAAU,KAAA,GAAW,OAAO,QAAQ,KAAK,EAAE,OAAO,4BAA4B,GAAG,QAAQ;EAC7F,OAAO,QAAQ,KAAK,KAAK;CAC3B,CACF;CAEA,IAAI,KACFC,eAAAA,2BACA,cACA,gBACA,gBAAgB,yBAAyB,GACzC,OAAO,YAAY;EACjB,MAAM,OAAO,MAAM,SAAS,OAAO;EACnC,IAAI,SAAS,KAAA,KAAa,OAAO,KAAK,eAAe,YAAY,EAAE,cAAc,OAC/E,OAAO,QAAQ,KAAK,EAAE,OAAO,0CAA0C,GAAG,WAAW;EAEvF,MAAM,SAAS,qBAAqB,SAAS,KAAK;EAClD,IAAI,WAAW,KAAA,GACb,OAAO,QAAQ,KAAK,EAAE,OAAO,gDAAgD,GAAG,YAAY;EAC9F,MAAM,UAAU,MAAM,OAAO,SAAS,CAAC,CAAC,qBAAqB,KAAK,YAAY,QAAQ,KAAK,QAAQ;EACnG,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,EAAE,OAAO,QAAQ,MAAM,GAAG,YAAY;EAC3E,MAAM,gBAAgB,OAAO,iBAAiB;EAC9C,IAAI,kBAAkB,KAAA,GAAW,OAAO,QAAQ,KAAK,EAAE,OAAO,mCAAmC,GAAG,QAAQ;EAC5G,MAAM,UAAU,OAAO,kBAAkB,QAAQ,WAAW,KAAK;EACjE,CAAA,GAAA,YAAA,UAAA,CAAU,SAASL,eAAAA,eAAe,QAAQ,OAAO;GAC/C,QAAQ;GACR,UAAU;GACV,UAAU;GACV,QAAQ,QAAQ;EAClB,CAAC;EACD,OAAO,QAAQ,KAAK;GAAE,IAAI;GAAM;EAAc,CAAC;CACjD,CACF;CAEA,IAAI,OAAO,GAAGC,eAAAA,iBAAiB,iBAAiB,YAAY;EAC1D,MAAM,UAAU,UAAU,OAAO;EACjC,IAAI,SAAS,OAAO;EACpB,IAAI,CAAC,OAAO,SAAS,CAAC,CAAC,OAAO,QAAQ,IAAI,MAAM,IAAI,CAAC,GACnD,OAAO,QAAQ,KAAK,EAAE,OAAO,mBAAmB,GAAG,SAAS;EAE9D,OAAO,QAAQ,KAAK,EAAE,IAAI,KAAK,CAAC;CAClC,CAAC;;CAGD,IAAI,KAAK,GAAGA,eAAAA,iBAAiB,aAAa,OAAO,YAAY;EAC3D,MAAM,OAAO,MAAM,SAAS,OAAO;EACnC,IAAI,SAAS,KAAA,KAAa,CAACK,gBAAAA,eAAe,KAAK,MAAM,GACnD,OAAO,QAAQ,KAAK,EAAE,OAAO,8BAA8B,GAAG,WAAW;EAE3E,MAAM,QAAQ,MAAM,OAAO,SAAS,CAAC,CAAC,YAAY,4BAA4B,OAAO,GAAG,KAAK,MAAM;EACnG,IAAI,UAAU,KAAA,GAAW,OAAO,QAAQ,KAAK,EAAE,OAAO,4BAA4B,GAAG,QAAQ;EAC7F,OAAO,QAAQ,KAAK,KAAK;CAC3B,CAAC;;;;;;;;CASD,IAAI,KAAKC,eAAAA,sBAAsB,gBAAgB,kBAAkB,GAAG,OAAO,YAAY;EACrF,MAAM,SAAS,OAAO,WAAA,GAAUf,YAAAA,UAAAA,CAAU,SAASQ,eAAAA,eAAe,MAAM,CAAC;EACzE,IAAI,WAAW,KAAA,GAAW,OAAO,QAAQ,KAAK,EAAE,OAAO,6BAA6B,GAAG,YAAY;EACnG,MAAM,OAAO,MAAM,SAAS,OAAO;EACnC,IAAI,SAAS,KAAA,KAAa,OAAO,KAAK,oBAAoB,YAAY,CAAC,eAAe,KAAK,KAAK,GAC9F,OAAO,QAAQ,KAAK,EAAE,OAAO,kDAAkD,GAAG,WAAW;EAE/F,IAAI,CAAC,OAAO,YAAY,QAAQ,KAAK,OAAO,KAAK,eAAe,GAC9D,OAAO,QAAQ,KAAK,EAAE,OAAO,6CAA6C,GAAG,WAAW;EAE1F,OAAO,QAAQ,KAAK,EAAE,IAAI,KAAK,CAAC;CAClC,CAAC;CAED,IAAI,IAAI,GAAGC,eAAAA,iBAAiB,YAAY,OAAO,YAAY;EACzD,MAAM,UAAU,UAAU,OAAO;EACjC,IAAI,SAAS,OAAO;EACpB,IAAI;EACJ,IAAI;GACF,OAAO,MAAM,QAAQ,IAAI,KAAK;EAChC,QAAQ;GACN,OAAO,QAAQ,KAAK,EAAE,OAAO,iCAAiC,GAAG,WAAW;EAC9E;EACA,IAAI,CAAC,SAAS,IAAI,GAAG,OAAO,QAAQ,KAAK,EAAE,OAAO,kCAAkC,GAAG,WAAW;EAClG,MAAM,WAAW,OAAO,eAAe,IAAI;EAC3C,OAAO,QAAQ,KAAK,EAAE,SAAS,CAAC;CAClC,CAAC;AACH"}