@agimon-ai/po-core 0.0.0-alpha.2 → 0.0.0-alpha.21

package/dist/remoteRuntime.cjs

@@ -1,15 +1,18 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_runtime = require("./_virtual/_rolldown/runtime.cjs");
+const require_protocolContracts = require("./src/schemas/protocolContracts.cjs");
 const require_packageApi = require("./src/schemas/packageApi.cjs");
 const require_sessionMcpRoutes = require("./src/server/sessionMcpRoutes.cjs");
 const require_remote = require("./src/constants/remote.cjs");
 const require_index = require("./src/services/devProxyPolicy/index.cjs");
-const require_index$1 = require("./src/services/devProxyStore/index.cjs");
+const require_sync = require("./src/services/devProxyStore/sync.cjs");
+require("./src/services/devProxyStore/index.cjs");
 const require_index$2 = require("./src/services/publicFileShares/index.cjs");
 const require_index$3 = require("./src/services/webauthnPolicy/index.cjs");
 const require_index$4 = require("./src/services/remoteGuardPolicy/index.cjs");
 const require_index$5 = require("./src/services/remoteAccess/index.cjs");
-const require_index$6 = require("./src/services/remoteAccessStore/index.cjs");
+const require_remoteAccessRecords = require("./src/services/remoteAccessStore/remoteAccessRecords.cjs");
+const require_sync$1 = require("./src/services/remoteAccessStore/sync.cjs");
+require("./src/services/remoteAccessStore/index.cjs");
 const require_index$7 = require("./src/services/tunnelProcess/index.cjs");
 const require_devProxyRoutes = require("./src/server/devProxyRoutes.cjs");
 const require_devProxySocket = require("./src/server/devProxySocket.cjs");
@@ -18,7 +21,6 @@ let node_http = require("node:http");
 let node_stream = require("node:stream");
 let node_stream_promises = require("node:stream/promises");
 let ws = require("ws");
-ws = require_runtime.__toESM(ws, 1);
 let hono = require("hono");
 let hono_cookie = require("hono/cookie");
 //#region src/server/remoteRuntime.ts
@@ -55,9 +57,9 @@ const FORBIDDEN_HEADERS = /* @__PURE__ */ new Set([
 	"upgrade",
 	"x-po-token",
 	"x-po-desktop",
-	require_packageApi.DOOM_API_CALLER_LOCALITY_HEADER,
-	require_packageApi.DOOM_API_CALLER_DEVICE_ID_HEADER,
-	require_packageApi.DOOM_API_CALLER_STEP_UP_HEADER,
+	require_packageApi.PO_API_CALLER_LOCALITY_HEADER,
+	require_packageApi.PO_API_CALLER_DEVICE_ID_HEADER,
+	require_packageApi.PO_API_CALLER_STEP_UP_HEADER,
 	"x-forwarded-for",
 	"x-forwarded-host",
 	"x-forwarded-proto"
@@ -97,12 +99,12 @@ async function writeResponse(response, result) {
 }
 /** One global control plane and a second socket dedicated to public tunnel traffic. */
 function createRemoteRuntime(options) {
-	const store = require_index$6.createRemoteAccessStore({
-		stateDir: require_index$6.defaultRemoteStateDir(options.homeDirectory),
+	const store = require_sync$1.createRemoteAccessStore({
+		stateDir: require_remoteAccessRecords.defaultRemoteStateDir(options.homeDirectory),
 		onNotice: (message) => options.onNotice(message)
 	});
 	require_index$7.reapStaleTunnel(store.directory, (message) => options.onNotice(message));
-	const devProxy = require_index$1.createDevProxyStore({
+	const devProxy = require_sync.createDevProxyStore({
 		stateDir: store.directory,
 		onNotice: (message) => options.onNotice(message)
 	});
@@ -231,35 +233,30 @@ function createRemoteRuntime(options) {
 					return;
 				}
 				const channel = device === void 0 ? void 0 : remote.channelFor(device, "protocol");
-				if (!require_packageApi.parseDoomSocketPath(url.pathname) || verdict !== "allow" || !device || !channel) {
+				if (!require_packageApi.parsePoSocketPath(url.pathname) || verdict !== "allow" || !device || !channel) {
 					socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
 					socket.destroy();
 					return;
 				}
 				webSockets.handleUpgrade(incoming, socket, head, (client) => {
-					let upstream;
-					try {
-						upstream = options.connectProtocol(url.pathname, device);
-					} catch (error) {
-						options.onNotice(`remote protocol could not connect: ${String(error)}`);
-						client.close(1011, "protocol unavailable");
-						return;
-					}
-					const pending = [];
-					let pendingBytes = 0;
-					let closed = false;
 					const untrack = remote.trackSocket(device, (code, reason) => client.close(code, reason));
-					const close = () => {
-						if (closed) return;
-						closed = true;
-						untrack();
-						client.close();
-						upstream.close();
-					};
+					const relay = require_protocolContracts.createTextLink({
+						send: (text) => {
+							const sealed = channel.seal(Buffer.from(text));
+							if (!sealed.ok) {
+								relay.ended("seal failed");
+								return;
+							}
+							client.send(Buffer.from(JSON.stringify(sealed.envelope)));
+						},
+						close: () => {
+							untrack();
+							client.close();
+						}
+					});
 					client.on("message", (raw) => {
-						if (closed) return;
 						if (!remote.isDeviceAuthorized(device)) {
-							close();
+							relay.ended("device revoked");
 							return;
 						}
 						const bytes = Array.isArray(raw) ? Buffer.concat(raw) : Buffer.from(raw);
@@ -267,44 +264,24 @@ function createRemoteRuntime(options) {
 						try {
 							envelope = JSON.parse(bytes.toString("utf8"));
 						} catch {
-							close();
+							relay.ended("invalid envelope");
 							return;
 						}
 						const opened = channel.open(envelope);
 						if (!opened.ok) {
-							close();
+							relay.ended("invalid envelope");
 							return;
 						}
-						const plain = Buffer.from(opened.plaintext);
-						if (upstream.readyState === ws.default.OPEN) upstream.send(plain);
-						else {
-							pendingBytes += plain.byteLength;
-							if (pendingBytes > MAX_REQUEST_BYTES) close();
-							else pending.push(plain);
-						}
-					});
-					upstream.on("open", () => {
-						for (const bytes of pending) upstream.send(bytes);
-						pending.length = 0;
-						pendingBytes = 0;
-					});
-					upstream.on("message", (raw) => {
-						if (closed) return;
-						const plain = Array.isArray(raw) ? Buffer.concat(raw) : Buffer.from(raw);
-						const sealed = channel.seal(plain);
-						if (!sealed.ok) {
-							close();
-							return;
-						}
-						client.send(Buffer.from(JSON.stringify(sealed.envelope)));
-					});
-					client.on("close", close);
-					client.on("error", close);
-					upstream.on("close", close);
-					upstream.on("error", (error) => {
-						options.onNotice(`remote protocol failed: ${error.message}`);
-						close();
+						relay.deliver(Buffer.from(opened.plaintext).toString("utf8"));
 					});
+					client.on("close", () => relay.ended("client closed"));
+					client.on("error", () => relay.ended("client error"));
+					try {
+						options.acceptProtocol(url.pathname, relay.link, device);
+					} catch (error) {
+						options.onNotice(`remote protocol could not connect: ${String(error)}`);
+						relay.ended("protocol unavailable");
+					}
 				});
 			});
 			server.headersTimeout = TUNNEL_HEADERS_TIMEOUT_MS;
@@ -416,9 +393,9 @@ function createRemoteRuntime(options) {
 		}
 		headers.delete(require_remote.STEP_UP_HEADER);
 		const sealedStepUp = stepUpNeeded && !stepUpDenied ? "verified" : "not-required";
-		headers.set(require_packageApi.DOOM_API_CALLER_LOCALITY_HEADER, "remote");
-		headers.set(require_packageApi.DOOM_API_CALLER_DEVICE_ID_HEADER, device);
-		headers.set(require_packageApi.DOOM_API_CALLER_STEP_UP_HEADER, sealedStepUp);
+		headers.set(require_packageApi.PO_API_CALLER_LOCALITY_HEADER, "remote");
+		headers.set(require_packageApi.PO_API_CALLER_DEVICE_ID_HEADER, device);
+		headers.set(require_packageApi.PO_API_CALLER_STEP_UP_HEADER, sealedStepUp);
 		let response;
 		if (stepUpDenied) {
 			const gesture = stepUpKind === "device-key" ? "biometric confirmation" : "passkey gesture";

package/dist/remoteRuntime.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"remoteRuntime.cjs","names":["PUBLIC_FILE_SHARE_PREFIX","DOOM_API_CALLER_LOCALITY_HEADER","DOOM_API_CALLER_DEVICE_ID_HEADER","DOOM_API_CALLER_STEP_UP_HEADER","REMOTE_HTTP_ROUTE","REMOTE_CHANNEL_ROUTE","pipeline","Readable","createRemoteAccessStore","defaultRemoteStateDir","createDevProxyStore","Hono","createPublicFileShares","isPublicSessionMcpRoute","originVerdict","localOriginPolicy","isPublicPairingRoute","getCookie","DEVICE_COOKIE","isDevProxyPath","createRemoteAccess","createTunnelLauncher","WebSocketServer","createServer","parseProxyPath","parseDoomSocketPath","WebSocket","stepUpActionFor","STEP_UP_HEADER","isSessionMcpHostRoute","isSessionMcpPhoneRoute"],"sources":["../src/server/remoteRuntime.ts"],"sourcesContent":["import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';\nimport { Readable } from 'node:stream';\nimport { pipeline } from 'node:stream/promises';\n\nimport { Hono } from 'hono';\nimport { getCookie } from 'hono/cookie';\nimport WebSocket, { WebSocketServer, type RawData } from 'ws';\n\nimport { DEVICE_COOKIE, REMOTE_CHANNEL_ROUTE, REMOTE_HTTP_ROUTE, STEP_UP_HEADER } from '../constants/remote';\nimport {\n  DOOM_API_CALLER_DEVICE_ID_HEADER,\n  DOOM_API_CALLER_LOCALITY_HEADER,\n  DOOM_API_CALLER_STEP_UP_HEADER,\n  parseDoomSocketPath,\n} from '../schemas/packageApi';\nimport { isDevProxyPath, parseProxyPath } from '../services/devProxyPolicy';\nimport { createDevProxyStore } from '../services/devProxyStore';\nimport { createPublicFileShares, PUBLIC_FILE_SHARE_PREFIX, type PublicFileShares } from '../services/publicFileShares';\nimport { createRemoteAccess, type RemoteAccess } from '../services/remoteAccess';\nimport { createRemoteAccessStore, defaultRemoteStateDir } from '../services/remoteAccessStore';\nimport {\n  isPublicPairingRoute,\n  originVerdict,\n  type GuardListener,\n  localOriginPolicy,\n} from '../services/remoteGuardPolicy';\nimport { createTunnelLauncher, reapStaleTunnel } from '../services/tunnelProcess';\nimport { stepUpActionFor } from '../services/webauthnPolicy';\nimport { type TunnelLauncher } from '../types/remote';\nimport { registerDevProxyRoutes } from './devProxyRoutes';\nimport { relayDevProxySocket } from './devProxySocket';\nimport { registerRemoteRoutes } from './remoteRoutes';\nimport { isPublicSessionMcpRoute, isSessionMcpHostRoute, isSessionMcpPhoneRoute } from './sessionMcpRoutes';\n\nexport { relayDevProxySocket, type DevProxySocketInput } from './devProxySocket';\n\nconst MAX_REQUEST_BYTES = 8 * 1024 * 1024;\nconst TUNNEL_HEADERS_TIMEOUT_MS = 5_000;\nconst TUNNEL_REQUEST_TIMEOUT_MS = 10_000;\nconst TUNNEL_CONNECTION_LIMIT = 64;\nconst TUNNEL_REQUESTS_PER_SOCKET = 100;\nconst SEALED_HTTP_VERSION = 1;\nconst SEALED_HTTP_METHODS = new Set(['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE']);\n/** HMAC-authenticated peer routes are the only non-device tunnel APIs. */\nconst SESSION_PEER_INBOX_ROUTE = '/api/plugins/session-peer/inbox';\nconst VOICE_PEER_ROUTES = new Set(['/api/plugins/voice/peer', '/api/plugins/voice/peer-ownership']);\n/** The one public file share shape: a 256-bit base64url token and nothing after it. */\nconst PUBLIC_FILE_SHARE_ROUTE = /^\\/mcp-file\\/([A-Za-z0-9_-]{43})$/u;\n/** Everything under this name is reserved for shares, so a near miss never reaches another route. */\nconst PUBLIC_FILE_SHARE_NAMESPACE = PUBLIC_FILE_SHARE_PREFIX.slice(0, -1);\nconst FORBIDDEN_HEADERS = new Set([\n  'authorization',\n  'connection',\n  'content-length',\n  'cookie',\n  'forwarded',\n  'host',\n  'origin',\n  'transfer-encoding',\n  'upgrade',\n  'x-po-token',\n  'x-po-desktop',\n  DOOM_API_CALLER_LOCALITY_HEADER,\n  DOOM_API_CALLER_DEVICE_ID_HEADER,\n  DOOM_API_CALLER_STEP_UP_HEADER,\n  'x-forwarded-for',\n  'x-forwarded-host',\n  'x-forwarded-proto',\n]);\n\ninterface SealedHttpRequest {\n  v: number;\n  method: string;\n  target: string;\n  headers: Array<[string, string]>;\n  body?: string;\n}\n\nfunction sealedRequest(value: unknown): SealedHttpRequest | undefined {\n  if (typeof value !== 'object' || value === null) return undefined;\n  const request = value as Partial<SealedHttpRequest>;\n  if (\n    request.v !== SEALED_HTTP_VERSION ||\n    typeof request.method !== 'string' ||\n    !SEALED_HTTP_METHODS.has(request.method) ||\n    typeof request.target !== 'string' ||\n    !request.target.startsWith('/') ||\n    request.target.startsWith('//') ||\n    request.target.includes('#') ||\n    !Array.isArray(request.headers) ||\n    !request.headers.every(\n      (header) => Array.isArray(header) && header.length === 2 && header.every((part) => typeof part === 'string'),\n    ) ||\n    (request.body !== undefined && typeof request.body !== 'string')\n  )\n    return undefined;\n  const parsed = new URL(request.target, 'http://po.local');\n  if (parsed.pathname === REMOTE_HTTP_ROUTE || parsed.pathname === REMOTE_CHANNEL_ROUTE) return undefined;\n  return request as SealedHttpRequest;\n}\n\nfunction decodedBody(value: string | undefined): Buffer | undefined {\n  if (value === undefined) return Buffer.alloc(0);\n  if (!/^(?:[A-Za-z\\d+/]{4})*(?:[A-Za-z\\d+/]{2}==|[A-Za-z\\d+/]{3}=)?$/u.test(value)) return undefined;\n  const body = Buffer.from(value, 'base64');\n  return body.toString('base64') === value ? body : undefined;\n}\n\ninterface ListenerBindings {\n  listener: GuardListener;\n  incoming?: IncomingMessage;\n  sealedDeviceId?: string;\n  /** Whether the sealed gateway verified a step-up for this re-dispatched request. */\n  sealedStepUp?: 'verified' | 'not-required';\n}\n\nexport interface RemoteRuntimeOptions {\n  homeDirectory: string;\n  registrationToken: string;\n  bundleTrust(): { publicKey: string; revision: number } | undefined;\n  /** Signs `po/host-channel-key/v1` fields with the shell signer, for native device reconnects. */\n  attestHost?: (fields: readonly string[]) => string | undefined;\n  onNotice(message: string): void;\n  /** The listener to which a sealed, authenticated request is forwarded. */\n  forward(request: Request): Promise<Response>;\n  connectProtocol(pathname: string, deviceId?: string): WebSocket;\n  onDeviceDropped?: (deviceId: string) => void;\n  launchTunnel?: TunnelLauncher;\n  /** Ports the host itself listens on, which a dev proxy target may never name. */\n  reservedPorts?: () => readonly (number | undefined)[];\n}\n\nexport interface RemoteRuntime {\n  readonly remote: RemoteAccess;\n  /** Short-lived public links served by the tunnel listener itself, never forwarded to the hub. */\n  readonly fileShares: PublicFileShares;\n  fetchLocal(request: Request): Promise<Response>;\n  close(): Promise<void>;\n}\n\nasync function readBody(request: IncomingMessage): Promise<Buffer> {\n  const chunks: Buffer[] = [];\n  let size = 0;\n  for await (const chunk of request) {\n    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);\n    size += bytes.byteLength;\n    if (size > MAX_REQUEST_BYTES) throw new Error('The tunnel request body is too large.');\n    chunks.push(bytes);\n  }\n  return Buffer.concat(chunks);\n}\n\nasync function writeResponse(response: ServerResponse, result: Response): Promise<void> {\n  response.writeHead(result.status, Object.fromEntries(result.headers.entries()));\n  if (result.body === null) {\n    response.end();\n    return;\n  }\n  await pipeline(Readable.fromWeb(result.body as import('node:stream/web').ReadableStream), response);\n}\n\n/** One global control plane and a second socket dedicated to public tunnel traffic. */\nexport function createRemoteRuntime(options: RemoteRuntimeOptions): RemoteRuntime {\n  const store = createRemoteAccessStore({\n    stateDir: defaultRemoteStateDir(options.homeDirectory),\n    onNotice: (message) => options.onNotice(message),\n  });\n  reapStaleTunnel(store.directory, (message) => options.onNotice(message));\n  const devProxy = createDevProxyStore({ stateDir: store.directory, onNotice: (message) => options.onNotice(message) });\n  const app = new Hono<{ Bindings: ListenerBindings }>();\n  let remote: RemoteAccess;\n  let frontendOrigin: string | undefined;\n  const fileShares = createPublicFileShares({\n    publicOrigin: () => remote.publicOrigin(),\n    publicOriginRevision: () => remote.publicOriginRevision(),\n    onNotice: (message) => options.onNotice(message),\n  });\n  /** Exact share route on the decoded path, and the raw path must not have needed decoding. */\n  const publicFileShareToken = (request: Request, path: string): string | undefined =>\n    new URL(request.url).pathname === path ? PUBLIC_FILE_SHARE_ROUTE.exec(path)?.[1] : undefined;\n  const inFileShareNamespace = (request: Request, path: string): boolean =>\n    path.startsWith(PUBLIC_FILE_SHARE_NAMESPACE) ||\n    new URL(request.url).pathname.startsWith(PUBLIC_FILE_SHARE_NAMESPACE);\n  app.use('*', async (context, next) => {\n    if (context.env.listener === 'local') return next();\n    const path = context.req.path;\n    const publicSessionMcp = isPublicSessionMcpRoute(context.req.method, path);\n    const publicSessionPeer = context.req.method === 'POST' && path === SESSION_PEER_INBOX_ROUTE;\n    const publicVoicePeer = context.req.method === 'POST' && VOICE_PEER_ROUTES.has(path);\n    const publicFileShare =\n      (context.req.method === 'GET' || context.req.method === 'HEAD') &&\n      publicFileShareToken(context.req.raw, path) !== undefined;\n    const verdict = originVerdict({\n      listener: 'tunnel',\n      // Exact OAuth, MCP, and HMAC-authenticated peer routes authenticate at the\n      // application layer. Treat an absent Origin like a server-to-server read.\n      method: publicSessionMcp || publicSessionPeer || publicVoicePeer ? 'GET' : context.req.method,\n      isUpgrade: false,\n      origin: context.req.header('origin'),\n      host: context.req.header('host'),\n      local: localOriginPolicy(0),\n      tunnel: remote.tunnelPolicy(),\n    });\n    if (verdict !== 'allow') return context.json({ error: `Tunnel request refused: ${verdict}.` }, 403);\n    // The token is the credential, so a share needs no device. Near misses never fall through.\n    if (publicFileShare) return next();\n    if (inFileShareNamespace(context.req.raw, path)) return context.json({ error: 'Not found.' }, 404);\n    if (isPublicPairingRoute(context.req.method, path) || publicSessionMcp || publicSessionPeer || publicVoicePeer)\n      return next();\n    const device = remote.authorize(getCookie(context, DEVICE_COOKIE, 'host'));\n    if (device === undefined) return context.json({ error: 'This device is not paired.' }, 401);\n    if (context.env.sealedDeviceId === device) return next();\n    // A proxied dev site issues its own subresource requests and form posts, none of which can go\n    // through a gateway that seals whole JSON responses. The same predicate the proxy route uses\n    // refuses dot segments, so a path granted here cannot resolve into /api/.\n    if (isDevProxyPath(path)) return next();\n    if (context.req.method === 'POST' && (path === REMOTE_CHANNEL_ROUTE || path === REMOTE_HTTP_ROUTE)) return next();\n    if ((context.req.method === 'GET' || context.req.method === 'HEAD') && !path.startsWith('/api/')) return next();\n    return context.json({ error: 'Remote HTTP requests must use the sealed gateway.' }, 401);\n  });\n\n  remote = createRemoteAccess({\n    store,\n    onDeviceDropped: options.onDeviceDropped,\n    launchTunnel:\n      options.launchTunnel ??\n      createTunnelLauncher({\n        stateDir: store.directory,\n        onNotice: (message) => options.onNotice(message),\n        onExit: (message) => {\n          options.onNotice(`remote access: ${message}`);\n          void remote.disable();\n        },\n      }),\n    bindListener: async () => {\n      const webSockets = new WebSocketServer({ noServer: true, maxPayload: MAX_REQUEST_BYTES });\n      const server = createServer((incoming, outgoing) => {\n        void (async () => {\n          const abort = new AbortController();\n          const disconnected = (): void => abort.abort();\n          incoming.once('aborted', disconnected);\n          outgoing.once('close', disconnected);\n          try {\n            const url = new URL(incoming.url ?? '/', `http://${incoming.headers.host ?? 'localhost'}`);\n            const headers = new Headers();\n            for (const [name, value] of Object.entries(incoming.headers))\n              if (value !== undefined) headers.set(name, Array.isArray(value) ? value.join(', ') : value);\n            const body = incoming.method === 'GET' || incoming.method === 'HEAD' ? undefined : await readBody(incoming);\n            const request = new Request(url, {\n              method: incoming.method,\n              headers,\n              signal: abort.signal,\n              ...(body === undefined ? {} : { body }),\n            });\n            await writeResponse(outgoing, await app.fetch(request, { listener: 'tunnel', incoming }));\n          } finally {\n            incoming.off('aborted', disconnected);\n            outgoing.off('close', disconnected);\n          }\n        })().catch((error: unknown) => {\n          options.onNotice(`tunnel request failed: ${String(error)}`);\n          if (!outgoing.headersSent) {\n            outgoing.writeHead(500, { 'content-type': 'application/json' });\n            outgoing.end(JSON.stringify({ error: 'The tunnel request failed.' }));\n          } else outgoing.destroy();\n        });\n      });\n      server.on('upgrade', (incoming, socket, head) => {\n        const url = new URL(incoming.url ?? '/', `http://${incoming.headers.host ?? 'localhost'}`);\n        const verdict = originVerdict({\n          listener: 'tunnel',\n          method: incoming.method ?? 'GET',\n          isUpgrade: true,\n          origin: incoming.headers.origin,\n          host: incoming.headers.host,\n          local: localOriginPolicy(0),\n          tunnel: remote.tunnelPolicy(),\n        });\n        const cookies = new Map(\n          (incoming.headers.cookie ?? '').split(';').map((part) => {\n            const at = part.indexOf('=');\n            return [part.slice(0, at).trim(), part.slice(at + 1).trim()];\n          }),\n        );\n        const device = remote.authorize(cookies.get(`__Host-${DEVICE_COOKIE}`));\n        // Hot module reload: a paired device's dev-site socket goes to the registered target.\n        if (isDevProxyPath(url.pathname) && verdict === 'allow' && device !== undefined) {\n          const parsed = parseProxyPath(url.pathname);\n          const target = parsed.kind === 'match' ? devProxy.find(parsed.name) : undefined;\n          if (parsed.kind !== 'match' || target === undefined) {\n            socket.write('HTTP/1.1 404 Not Found\\r\\n\\r\\n');\n            socket.destroy();\n            return;\n          }\n          webSockets.handleUpgrade(incoming, socket, head, (client) => {\n            const untrack = remote.trackSocket(device, (code, reason) => client.close(code, reason));\n            client.once('close', untrack);\n            relayDevProxySocket(client, {\n              port: target.port,\n              upstreamPath: `${parsed.upstreamPath}${url.search}`,\n              protocols: incoming.headers['sec-websocket-protocol'],\n              onNotice: (message) => options.onNotice(message),\n            });\n          });\n          return;\n        }\n        const channel = device === undefined ? undefined : remote.channelFor(device, 'protocol');\n        if (!parseDoomSocketPath(url.pathname) || verdict !== 'allow' || !device || !channel) {\n          socket.write('HTTP/1.1 403 Forbidden\\r\\n\\r\\n');\n          socket.destroy();\n          return;\n        }\n        webSockets.handleUpgrade(incoming, socket, head, (client) => {\n          let upstream: WebSocket;\n          try {\n            upstream = options.connectProtocol(url.pathname, device);\n          } catch (error) {\n            options.onNotice(`remote protocol could not connect: ${String(error)}`);\n            client.close(1011, 'protocol unavailable');\n            return;\n          }\n          const pending: Buffer[] = [];\n          let pendingBytes = 0;\n          let closed = false;\n          const untrack = remote.trackSocket(device, (code, reason) => client.close(code, reason));\n          const close = (): void => {\n            if (closed) return;\n            closed = true;\n            untrack();\n            client.close();\n            upstream.close();\n          };\n          client.on('message', (raw: RawData) => {\n            if (closed) return;\n            if (!remote.isDeviceAuthorized(device)) {\n              close();\n              return;\n            }\n            const bytes = Array.isArray(raw) ? Buffer.concat(raw) : Buffer.from(raw as Buffer);\n            let envelope: unknown;\n            try {\n              envelope = JSON.parse(bytes.toString('utf8')) as unknown;\n            } catch {\n              close();\n              return;\n            }\n            const opened = channel.open(envelope);\n            if (!opened.ok) {\n              close();\n              return;\n            }\n            const plain = Buffer.from(opened.plaintext);\n            if (upstream.readyState === WebSocket.OPEN) upstream.send(plain);\n            else {\n              pendingBytes += plain.byteLength;\n              if (pendingBytes > MAX_REQUEST_BYTES) close();\n              else pending.push(plain);\n            }\n          });\n          upstream.on('open', () => {\n            for (const bytes of pending) upstream.send(bytes);\n            pending.length = 0;\n            pendingBytes = 0;\n          });\n          upstream.on('message', (raw: RawData) => {\n            if (closed) return;\n            const plain = Array.isArray(raw) ? Buffer.concat(raw) : Buffer.from(raw as Buffer);\n            const sealed = channel.seal(plain);\n            if (!sealed.ok) {\n              close();\n              return;\n            }\n            client.send(Buffer.from(JSON.stringify(sealed.envelope)));\n          });\n          client.on('close', close);\n          client.on('error', close);\n          upstream.on('close', close);\n          upstream.on('error', (error) => {\n            options.onNotice(`remote protocol failed: ${error.message}`);\n            close();\n          });\n        });\n      });\n      server.headersTimeout = TUNNEL_HEADERS_TIMEOUT_MS;\n      server.requestTimeout = TUNNEL_REQUEST_TIMEOUT_MS;\n      server.maxConnections = TUNNEL_CONNECTION_LIMIT;\n      server.maxRequestsPerSocket = TUNNEL_REQUESTS_PER_SOCKET;\n      await new Promise<void>((resolve, reject) => {\n        server.once('error', reject);\n        server.listen(0, '127.0.0.1', resolve);\n      });\n      const address = server.address();\n      if (!address || typeof address === 'string') throw new Error('The tunnel listener has no TCP address.');\n      return {\n        port: address.port,\n        close: async () => {\n          for (const client of webSockets.clients) client.terminate();\n          webSockets.close();\n          server.closeAllConnections();\n          await new Promise<void>((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())));\n        },\n      };\n    },\n    bundleTrust: () => options.bundleTrust(),\n    attestHost: (fields) => options.attestHost?.(fields),\n    onNotice: (message) => options.onNotice(message),\n  });\n  registerRemoteRoutes(app as unknown as Hono, {\n    remote,\n    listenerOf: (context) => (context.env as ListenerBindings).listener,\n  });\n  registerDevProxyRoutes(app as unknown as Hono, {\n    store: devProxy,\n    listenerOf: (context) => (context.env as ListenerBindings).listener,\n    // Read per call: the tunnel port exists only while remote access is on, and a target checked\n    // against a stale list could end up aimed at the cockpit itself.\n    reservedPorts: () => [\n      remote.tunnelPort(),\n      frontendOrigin === undefined ? undefined : Number(new URL(frontendOrigin).port),\n      ...(options.reservedPorts?.() ?? []),\n    ],\n    onNotice: (message) => options.onNotice(message),\n  });\n  app.post('/api/remote/frontend', async (context) => {\n    if (context.env.listener !== 'local')\n      return context.json({ error: 'This action is only available on the host.' }, 403);\n    if (context.req.header('x-po-web-registration') !== options.registrationToken)\n      return context.json({ error: 'The web presentation server was not authenticated.' }, 403);\n    let body: unknown;\n    try {\n      body = await context.req.json();\n    } catch {\n      return context.json({ error: 'A loopback web origin is required.' }, 400);\n    }\n    const origin = typeof body === 'object' && body !== null && 'origin' in body ? body.origin : undefined;\n    if (typeof origin !== 'string') return context.json({ error: 'A loopback web origin is required.' }, 400);\n    let parsed: URL;\n    try {\n      parsed = new URL(origin);\n    } catch {\n      return context.json({ error: 'The web origin is invalid.' }, 400);\n    }\n    if (\n      parsed.protocol !== 'http:' ||\n      !['127.0.0.1', 'localhost', '[::1]'].includes(parsed.hostname) ||\n      parsed.pathname !== '/' ||\n      parsed.search !== '' ||\n      parsed.hash !== '' ||\n      !parsed.port\n    )\n      return context.json({ error: 'The web origin must be a loopback HTTP listener.' }, 400);\n    frontendOrigin = parsed.origin;\n    return context.json({ ok: true });\n  });\n  app.post(REMOTE_HTTP_ROUTE, async (context) => {\n    const device = remote.authorize(getCookie(context, DEVICE_COOKIE, 'host'));\n    const channel = device === undefined ? undefined : remote.channelFor(device, 'http');\n    if (!device || !channel) return context.json({ error: 'A sealed paired device is required.' }, 401);\n    let envelope: unknown;\n    try {\n      envelope = await context.req.json();\n    } catch {\n      return context.json({ error: 'The sealed request envelope was malformed.' }, 400);\n    }\n    const opened = channel.open(envelope);\n    if (!opened.ok) return context.json({ error: `The sealed request was refused: ${opened.failure}.` }, 400);\n    let decoded: unknown;\n    try {\n      decoded = JSON.parse(new TextDecoder().decode(opened.plaintext)) as unknown;\n    } catch {\n      return context.json({ error: 'The sealed HTTP request was malformed.' }, 400);\n    }\n    const inner = sealedRequest(decoded);\n    const body = decodedBody(inner?.body);\n    if (!inner || !body) return context.json({ error: 'The sealed HTTP request was invalid.' }, 400);\n    const target = new URL(inner.target, 'http://po.local');\n    const headers = new Headers();\n    for (const [name, value] of inner.headers) {\n      const normalized = name.toLowerCase();\n      if (FORBIDDEN_HEADERS.has(normalized) || normalized.startsWith('sec-')) continue;\n      headers.append(name, value);\n    }\n    const action = stepUpActionFor(inner.method, target.pathname);\n    const stepUpKind = remote.trustKind(device) === 'device-key' ? 'device-key' : 'passkey';\n    const stepUpNeeded = action !== undefined && remote.stepUpRequired(action, device);\n    let stepUpDenied = false;\n    if (action && stepUpNeeded) {\n      const assertion = headers.get(STEP_UP_HEADER);\n      let credential: unknown;\n      try {\n        credential = assertion ? JSON.parse(Buffer.from(assertion, 'base64url').toString('utf8')) : undefined;\n      } catch {\n        credential = undefined;\n      }\n      const ceremony = credential as { ceremonyId?: unknown; response?: unknown; signature?: unknown } | undefined;\n      if (stepUpKind === 'device-key') {\n        // A device-key session proves the gesture with its biometric key, never a passkey.\n        stepUpDenied = !remote.finishDeviceStepUp(device, action, ceremony?.ceremonyId, ceremony?.signature);\n      } else if (\n        typeof ceremony?.ceremonyId !== 'string' ||\n        !(await remote.passkeys().finishStepUp(ceremony.ceremonyId, `device:${device}`, action, ceremony.response))\n      )\n        stepUpDenied = true;\n    }\n    headers.delete(STEP_UP_HEADER);\n    const sealedStepUp = stepUpNeeded && !stepUpDenied ? 'verified' : 'not-required';\n    // Caller stamps are assigned after the sealed request is opened. They never\n    // originate from browser-controlled sealed headers.\n    headers.set(DOOM_API_CALLER_LOCALITY_HEADER, 'remote');\n    headers.set(DOOM_API_CALLER_DEVICE_ID_HEADER, device);\n    headers.set(DOOM_API_CALLER_STEP_UP_HEADER, sealedStepUp);\n    let response: Response;\n    if (stepUpDenied) {\n      const gesture = stepUpKind === 'device-key' ? 'biometric confirmation' : 'passkey gesture';\n      response = context.json({ error: `This action needs a fresh ${gesture}.`, action, kind: stepUpKind }, 401);\n    } else if (isSessionMcpHostRoute(target.pathname) && !isSessionMcpPhoneRoute(inner.method, target.pathname)) {\n      response = context.json({ error: 'Session MCP management is only available on the host.' }, 403);\n    } else {\n      const internal = new Request(target, {\n        method: inner.method,\n        headers,\n        ...(inner.method === 'GET' || inner.method === 'HEAD' ? {} : { body }),\n      });\n      if (target.pathname === '/api/remote' || target.pathname.startsWith('/api/remote/')) {\n        headers.set('cookie', context.req.header('cookie') ?? '');\n        headers.set('host', context.req.header('host') ?? '');\n        headers.set('origin', context.req.header('origin') ?? '');\n        response = await app.fetch(new Request(internal, { headers }), {\n          listener: 'tunnel',\n          sealedDeviceId: device,\n          sealedStepUp,\n        });\n      } else response = await options.forward(internal);\n    }\n    const responseBody = Buffer.from(await response.arrayBuffer());\n    const sealed = channel.seal(\n      new TextEncoder().encode(\n        JSON.stringify({\n          v: SEALED_HTTP_VERSION,\n          status: response.status,\n          headers: [...response.headers.entries()],\n          body: responseBody.toString('base64'),\n        }),\n      ),\n    );\n    return sealed.ok\n      ? context.json(sealed.envelope)\n      : context.json({ error: `The sealed response failed: ${sealed.failure}.` }, 503);\n  });\n  app.on(['POST', 'DELETE'], '*', async (context) => {\n    if (\n      !isPublicSessionMcpRoute(context.req.method, context.req.path) &&\n      !(context.req.method === 'POST' && context.req.path === SESSION_PEER_INBOX_ROUTE) &&\n      !(context.req.method === 'POST' && VOICE_PEER_ROUTES.has(context.req.path))\n    )\n      return context.notFound();\n    return options.forward(context.req.raw);\n  });\n  app.on(['GET', 'HEAD'], '*', async (context) => {\n    // Served here and never through forward(), which would attach the host token.\n    if (inFileShareNamespace(context.req.raw, context.req.path)) {\n      const token = publicFileShareToken(context.req.raw, context.req.path);\n      return context.env.listener === 'tunnel' && token !== undefined\n        ? fileShares.serve(token, context.req.method)\n        : context.json({ error: 'Not found.' }, 404);\n    }\n    if (isPublicSessionMcpRoute(context.req.method, context.req.path)) return options.forward(context.req.raw);\n    if (context.req.path.startsWith('/api/')) return context.json({ error: 'Not found.' }, 404);\n    if (context.req.path === '/' && remote.authorize(getCookie(context, DEVICE_COOKIE, 'host')) === undefined)\n      return context.redirect('/pair');\n    if (context.req.path === '/bundle-manifest.json' || context.req.path.startsWith('/bundle-assets/')) {\n      const from = new URL(context.req.url);\n      return await options.forward(\n        new Request(new URL(`${from.pathname}${from.search}`, 'http://po.local'), {\n          method: context.req.method,\n        }),\n      );\n    }\n    if (!frontendOrigin) return context.json({ error: 'The web presentation server is unavailable.' }, 503);\n    const from = new URL(context.req.url);\n    const target = new URL(`${from.pathname}${from.search}`, frontendOrigin);\n    const result = await fetch(target, { method: context.req.method, redirect: 'manual' });\n    const headers = new Headers(result.headers);\n    headers.delete('set-cookie');\n    return new Response(result.body, { status: result.status, headers });\n  });\n\n  return {\n    remote,\n    fileShares,\n    fetchLocal: async (request) => app.fetch(request, { listener: 'local' }),\n    close: async () => remote.close(),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAoCA,MAAM,oBAAoB;AAC1B,MAAM,4BAA4B;AAClC,MAAM,4BAA4B;AAClC,MAAM,0BAA0B;AAChC,MAAM,6BAA6B;AACnC,MAAM,sBAAsB;AAC5B,MAAM,sCAAsB,IAAI,IAAI;CAAC;CAAO;CAAQ;CAAQ;CAAO;CAAS;AAAQ,CAAC;;AAErF,MAAM,2BAA2B;AACjC,MAAM,oCAAoB,IAAI,IAAI,CAAC,2BAA2B,mCAAmC,CAAC;;AAElG,MAAM,0BAA0B;;AAEhC,MAAM,8BAA8BA,gBAAAA,yBAAyB,MAAM,GAAG,EAAE;AACxE,MAAM,oCAAoB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACAC,mBAAAA;CACAC,mBAAAA;CACAC,mBAAAA;CACA;CACA;CACA;AACF,CAAC;AAUD,SAAS,cAAc,OAA+C;CACpE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO,KAAA;CACxD,MAAM,UAAU;CAChB,IACE,QAAQ,MAAM,uBACd,OAAO,QAAQ,WAAW,YAC1B,CAAC,oBAAoB,IAAI,QAAQ,MAAM,KACvC,OAAO,QAAQ,WAAW,YAC1B,CAAC,QAAQ,OAAO,WAAW,GAAG,KAC9B,QAAQ,OAAO,WAAW,IAAI,KAC9B,QAAQ,OAAO,SAAS,GAAG,KAC3B,CAAC,MAAM,QAAQ,QAAQ,OAAO,KAC9B,CAAC,QAAQ,QAAQ,OACd,WAAW,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,KAAK,OAAO,OAAO,SAAS,OAAO,SAAS,QAAQ,CAC7G,KACC,QAAQ,SAAS,KAAA,KAAa,OAAO,QAAQ,SAAS,UAEvD,OAAO,KAAA;CACT,MAAM,SAAS,IAAI,IAAI,QAAQ,QAAQ,iBAAiB;CACxD,IAAI,OAAO,aAAaC,eAAAA,qBAAqB,OAAO,aAAaC,eAAAA,sBAAsB,OAAO,KAAA;CAC9F,OAAO;AACT;AAEA,SAAS,YAAY,OAA+C;CAClE,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,MAAM,CAAC;CAC9C,IAAI,CAAC,iEAAiE,KAAK,KAAK,GAAG,OAAO,KAAA;CAC1F,MAAM,OAAO,OAAO,KAAK,OAAO,QAAQ;CACxC,OAAO,KAAK,SAAS,QAAQ,MAAM,QAAQ,OAAO,KAAA;AACpD;AAkCA,eAAe,SAAS,SAA2C;CACjE,MAAM,SAAmB,CAAC;CAC1B,IAAI,OAAO;CACX,WAAW,MAAM,SAAS,SAAS;EACjC,MAAM,QAAQ,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK;EAChE,QAAQ,MAAM;EACd,IAAI,OAAO,mBAAmB,MAAM,IAAI,MAAM,uCAAuC;EACrF,OAAO,KAAK,KAAK;CACnB;CACA,OAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,eAAe,cAAc,UAA0B,QAAiC;CACtF,SAAS,UAAU,OAAO,QAAQ,OAAO,YAAY,OAAO,QAAQ,QAAQ,CAAC,CAAC;CAC9E,IAAI,OAAO,SAAS,MAAM;EACxB,SAAS,IAAI;EACb;CACF;CACA,OAAA,GAAMC,qBAAAA,SAAAA,CAASC,YAAAA,SAAS,QAAQ,OAAO,IAAgD,GAAG,QAAQ;AACpG;;AAGA,SAAgB,oBAAoB,SAA8C;CAChF,MAAM,QAAQC,gBAAAA,wBAAwB;EACpC,UAAUC,gBAAAA,sBAAsB,QAAQ,aAAa;EACrD,WAAW,YAAY,QAAQ,SAAS,OAAO;CACjD,CAAC;CACD,gBAAA,gBAAgB,MAAM,YAAY,YAAY,QAAQ,SAAS,OAAO,CAAC;CACvE,MAAM,WAAWC,gBAAAA,oBAAoB;EAAE,UAAU,MAAM;EAAW,WAAW,YAAY,QAAQ,SAAS,OAAO;CAAE,CAAC;CACpH,MAAM,MAAM,IAAIC,KAAAA,KAAqC;CACrD,IAAI;CACJ,IAAI;CACJ,MAAM,aAAaC,gBAAAA,uBAAuB;EACxC,oBAAoB,OAAO,aAAa;EACxC,4BAA4B,OAAO,qBAAqB;EACxD,WAAW,YAAY,QAAQ,SAAS,OAAO;CACjD,CAAC;;CAED,MAAM,wBAAwB,SAAkB,SAC9C,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,aAAa,OAAO,wBAAwB,KAAK,IAAI,CAAC,GAAG,KAAK,KAAA;CACrF,MAAM,wBAAwB,SAAkB,SAC9C,KAAK,WAAW,2BAA2B,KAC3C,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,SAAS,WAAW,2BAA2B;CACtE,IAAI,IAAI,KAAK,OAAO,SAAS,SAAS;EACpC,IAAI,QAAQ,IAAI,aAAa,SAAS,OAAO,KAAK;EAClD,MAAM,OAAO,QAAQ,IAAI;EACzB,MAAM,mBAAmBC,yBAAAA,wBAAwB,QAAQ,IAAI,QAAQ,IAAI;EACzE,MAAM,oBAAoB,QAAQ,IAAI,WAAW,UAAU,SAAS;EACpE,MAAM,kBAAkB,QAAQ,IAAI,WAAW,UAAU,kBAAkB,IAAI,IAAI;EACnF,MAAM,mBACH,QAAQ,IAAI,WAAW,SAAS,QAAQ,IAAI,WAAW,WACxD,qBAAqB,QAAQ,IAAI,KAAK,IAAI,MAAM,KAAA;EAClD,MAAM,UAAUC,gBAAAA,cAAc;GAC5B,UAAU;GAGV,QAAQ,oBAAoB,qBAAqB,kBAAkB,QAAQ,QAAQ,IAAI;GACvF,WAAW;GACX,QAAQ,QAAQ,IAAI,OAAO,QAAQ;GACnC,MAAM,QAAQ,IAAI,OAAO,MAAM;GAC/B,OAAOC,gBAAAA,kBAAkB,CAAC;GAC1B,QAAQ,OAAO,aAAa;EAC9B,CAAC;EACD,IAAI,YAAY,SAAS,OAAO,QAAQ,KAAK,EAAE,OAAO,2BAA2B,QAAQ,GAAG,GAAG,GAAG;EAElG,IAAI,iBAAiB,OAAO,KAAK;EACjC,IAAI,qBAAqB,QAAQ,IAAI,KAAK,IAAI,GAAG,OAAO,QAAQ,KAAK,EAAE,OAAO,aAAa,GAAG,GAAG;EACjG,IAAIC,gBAAAA,qBAAqB,QAAQ,IAAI,QAAQ,IAAI,KAAK,oBAAoB,qBAAqB,iBAC7F,OAAO,KAAK;EACd,MAAM,SAAS,OAAO,WAAA,GAAUC,YAAAA,UAAAA,CAAU,SAASC,eAAAA,eAAe,MAAM,CAAC;EACzE,IAAI,WAAW,KAAA,GAAW,OAAO,QAAQ,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;EAC1F,IAAI,QAAQ,IAAI,mBAAmB,QAAQ,OAAO,KAAK;EAIvD,IAAIC,cAAAA,eAAe,IAAI,GAAG,OAAO,KAAK;EACtC,IAAI,QAAQ,IAAI,WAAW,WAAW,SAASd,eAAAA,wBAAwB,SAASD,eAAAA,oBAAoB,OAAO,KAAK;EAChH,KAAK,QAAQ,IAAI,WAAW,SAAS,QAAQ,IAAI,WAAW,WAAW,CAAC,KAAK,WAAW,OAAO,GAAG,OAAO,KAAK;EAC9G,OAAO,QAAQ,KAAK,EAAE,OAAO,oDAAoD,GAAG,GAAG;CACzF,CAAC;CAED,SAASgB,gBAAAA,mBAAmB;EAC1B;EACA,iBAAiB,QAAQ;EACzB,cACE,QAAQ,gBACRC,gBAAAA,qBAAqB;GACnB,UAAU,MAAM;GAChB,WAAW,YAAY,QAAQ,SAAS,OAAO;GAC/C,SAAS,YAAY;IACnB,QAAQ,SAAS,kBAAkB,SAAS;IAC5C,OAAY,QAAQ;GACtB;EACF,CAAC;EACH,cAAc,YAAY;GACxB,MAAM,aAAa,IAAIC,GAAAA,gBAAgB;IAAE,UAAU;IAAM,YAAY;GAAkB,CAAC;GACxF,MAAM,UAAA,GAASC,UAAAA,aAAAA,EAAc,UAAU,aAAa;IAClD,CAAM,YAAY;KAChB,MAAM,QAAQ,IAAI,gBAAgB;KAClC,MAAM,qBAA2B,MAAM,MAAM;KAC7C,SAAS,KAAK,WAAW,YAAY;KACrC,SAAS,KAAK,SAAS,YAAY;KACnC,IAAI;MACF,MAAM,MAAM,IAAI,IAAI,SAAS,OAAO,KAAK,UAAU,SAAS,QAAQ,QAAQ,aAAa;MACzF,MAAM,UAAU,IAAI,QAAQ;MAC5B,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,SAAS,OAAO,GACzD,IAAI,UAAU,KAAA,GAAW,QAAQ,IAAI,MAAM,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK;MAC5F,MAAM,OAAO,SAAS,WAAW,SAAS,SAAS,WAAW,SAAS,KAAA,IAAY,MAAM,SAAS,QAAQ;MAC1G,MAAM,UAAU,IAAI,QAAQ,KAAK;OAC/B,QAAQ,SAAS;OACjB;OACA,QAAQ,MAAM;OACd,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;MACvC,CAAC;MACD,MAAM,cAAc,UAAU,MAAM,IAAI,MAAM,SAAS;OAAE,UAAU;OAAU;MAAS,CAAC,CAAC;KAC1F,UAAU;MACR,SAAS,IAAI,WAAW,YAAY;MACpC,SAAS,IAAI,SAAS,YAAY;KACpC;IACF,EAAA,CAAG,CAAC,CAAC,OAAO,UAAmB;KAC7B,QAAQ,SAAS,0BAA0B,OAAO,KAAK,GAAG;KAC1D,IAAI,CAAC,SAAS,aAAa;MACzB,SAAS,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;MAC9D,SAAS,IAAI,KAAK,UAAU,EAAE,OAAO,6BAA6B,CAAC,CAAC;KACtE,OAAO,SAAS,QAAQ;IAC1B,CAAC;GACH,CAAC;GACD,OAAO,GAAG,YAAY,UAAU,QAAQ,SAAS;IAC/C,MAAM,MAAM,IAAI,IAAI,SAAS,OAAO,KAAK,UAAU,SAAS,QAAQ,QAAQ,aAAa;IACzF,MAAM,UAAUT,gBAAAA,cAAc;KAC5B,UAAU;KACV,QAAQ,SAAS,UAAU;KAC3B,WAAW;KACX,QAAQ,SAAS,QAAQ;KACzB,MAAM,SAAS,QAAQ;KACvB,OAAOC,gBAAAA,kBAAkB,CAAC;KAC1B,QAAQ,OAAO,aAAa;IAC9B,CAAC;IACD,MAAM,UAAU,IAAI,KACjB,SAAS,QAAQ,UAAU,GAAA,CAAI,MAAM,GAAG,CAAC,CAAC,KAAK,SAAS;KACvD,MAAM,KAAK,KAAK,QAAQ,GAAG;KAC3B,OAAO,CAAC,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7D,CAAC,CACH;IACA,MAAM,SAAS,OAAO,UAAU,QAAQ,IAAI,UAAUG,eAAAA,eAAe,CAAC;IAEtE,IAAIC,cAAAA,eAAe,IAAI,QAAQ,KAAK,YAAY,WAAW,WAAW,KAAA,GAAW;KAC/E,MAAM,SAASK,cAAAA,eAAe,IAAI,QAAQ;KAC1C,MAAM,SAAS,OAAO,SAAS,UAAU,SAAS,KAAK,OAAO,IAAI,IAAI,KAAA;KACtE,IAAI,OAAO,SAAS,WAAW,WAAW,KAAA,GAAW;MACnD,OAAO,MAAM,gCAAgC;MAC7C,OAAO,QAAQ;MACf;KACF;KACA,WAAW,cAAc,UAAU,QAAQ,OAAO,WAAW;MAC3D,MAAM,UAAU,OAAO,YAAY,SAAS,MAAM,WAAW,OAAO,MAAM,MAAM,MAAM,CAAC;MACvF,OAAO,KAAK,SAAS,OAAO;MAC5B,uBAAA,oBAAoB,QAAQ;OAC1B,MAAM,OAAO;OACb,cAAc,GAAG,OAAO,eAAe,IAAI;OAC3C,WAAW,SAAS,QAAQ;OAC5B,WAAW,YAAY,QAAQ,SAAS,OAAO;MACjD,CAAC;KACH,CAAC;KACD;IACF;IACA,MAAM,UAAU,WAAW,KAAA,IAAY,KAAA,IAAY,OAAO,WAAW,QAAQ,UAAU;IACvF,IAAI,CAACC,mBAAAA,oBAAoB,IAAI,QAAQ,KAAK,YAAY,WAAW,CAAC,UAAU,CAAC,SAAS;KACpF,OAAO,MAAM,gCAAgC;KAC7C,OAAO,QAAQ;KACf;IACF;IACA,WAAW,cAAc,UAAU,QAAQ,OAAO,WAAW;KAC3D,IAAI;KACJ,IAAI;MACF,WAAW,QAAQ,gBAAgB,IAAI,UAAU,MAAM;KACzD,SAAS,OAAO;MACd,QAAQ,SAAS,sCAAsC,OAAO,KAAK,GAAG;MACtE,OAAO,MAAM,MAAM,sBAAsB;MACzC;KACF;KACA,MAAM,UAAoB,CAAC;KAC3B,IAAI,eAAe;KACnB,IAAI,SAAS;KACb,MAAM,UAAU,OAAO,YAAY,SAAS,MAAM,WAAW,OAAO,MAAM,MAAM,MAAM,CAAC;KACvF,MAAM,cAAoB;MACxB,IAAI,QAAQ;MACZ,SAAS;MACT,QAAQ;MACR,OAAO,MAAM;MACb,SAAS,MAAM;KACjB;KACA,OAAO,GAAG,YAAY,QAAiB;MACrC,IAAI,QAAQ;MACZ,IAAI,CAAC,OAAO,mBAAmB,MAAM,GAAG;OACtC,MAAM;OACN;MACF;MACA,MAAM,QAAQ,MAAM,QAAQ,GAAG,IAAI,OAAO,OAAO,GAAG,IAAI,OAAO,KAAK,GAAa;MACjF,IAAI;MACJ,IAAI;OACF,WAAW,KAAK,MAAM,MAAM,SAAS,MAAM,CAAC;MAC9C,QAAQ;OACN,MAAM;OACN;MACF;MACA,MAAM,SAAS,QAAQ,KAAK,QAAQ;MACpC,IAAI,CAAC,OAAO,IAAI;OACd,MAAM;OACN;MACF;MACA,MAAM,QAAQ,OAAO,KAAK,OAAO,SAAS;MAC1C,IAAI,SAAS,eAAeC,GAAAA,QAAU,MAAM,SAAS,KAAK,KAAK;WAC1D;OACH,gBAAgB,MAAM;OACtB,IAAI,eAAe,mBAAmB,MAAM;YACvC,QAAQ,KAAK,KAAK;MACzB;KACF,CAAC;KACD,SAAS,GAAG,cAAc;MACxB,KAAK,MAAM,SAAS,SAAS,SAAS,KAAK,KAAK;MAChD,QAAQ,SAAS;MACjB,eAAe;KACjB,CAAC;KACD,SAAS,GAAG,YAAY,QAAiB;MACvC,IAAI,QAAQ;MACZ,MAAM,QAAQ,MAAM,QAAQ,GAAG,IAAI,OAAO,OAAO,GAAG,IAAI,OAAO,KAAK,GAAa;MACjF,MAAM,SAAS,QAAQ,KAAK,KAAK;MACjC,IAAI,CAAC,OAAO,IAAI;OACd,MAAM;OACN;MACF;MACA,OAAO,KAAK,OAAO,KAAK,KAAK,UAAU,OAAO,QAAQ,CAAC,CAAC;KAC1D,CAAC;KACD,OAAO,GAAG,SAAS,KAAK;KACxB,OAAO,GAAG,SAAS,KAAK;KACxB,SAAS,GAAG,SAAS,KAAK;KAC1B,SAAS,GAAG,UAAU,UAAU;MAC9B,QAAQ,SAAS,2BAA2B,MAAM,SAAS;MAC3D,MAAM;KACR,CAAC;IACH,CAAC;GACH,CAAC;GACD,OAAO,iBAAiB;GACxB,OAAO,iBAAiB;GACxB,OAAO,iBAAiB;GACxB,OAAO,uBAAuB;GAC9B,MAAM,IAAI,SAAe,SAAS,WAAW;IAC3C,OAAO,KAAK,SAAS,MAAM;IAC3B,OAAO,OAAO,GAAG,aAAa,OAAO;GACvC,CAAC;GACD,MAAM,UAAU,OAAO,QAAQ;GAC/B,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU,MAAM,IAAI,MAAM,yCAAyC;GACtG,OAAO;IACL,MAAM,QAAQ;IACd,OAAO,YAAY;KACjB,KAAK,MAAM,UAAU,WAAW,SAAS,OAAO,UAAU;KAC1D,WAAW,MAAM;KACjB,OAAO,oBAAoB;KAC3B,MAAM,IAAI,SAAe,SAAS,WAAW,OAAO,OAAO,UAAW,QAAQ,OAAO,KAAK,IAAI,QAAQ,CAAE,CAAC;IAC3G;GACF;EACF;EACA,mBAAmB,QAAQ,YAAY;EACvC,aAAa,WAAW,QAAQ,aAAa,MAAM;EACnD,WAAW,YAAY,QAAQ,SAAS,OAAO;CACjD,CAAC;CACD,qBAAA,qBAAqB,KAAwB;EAC3C;EACA,aAAa,YAAa,QAAQ,IAAyB;CAC7D,CAAC;CACD,uBAAA,uBAAuB,KAAwB;EAC7C,OAAO;EACP,aAAa,YAAa,QAAQ,IAAyB;EAG3D,qBAAqB;GACnB,OAAO,WAAW;GAClB,mBAAmB,KAAA,IAAY,KAAA,IAAY,OAAO,IAAI,IAAI,cAAc,CAAC,CAAC,IAAI;GAC9E,GAAI,QAAQ,gBAAgB,KAAK,CAAC;EACpC;EACA,WAAW,YAAY,QAAQ,SAAS,OAAO;CACjD,CAAC;CACD,IAAI,KAAK,wBAAwB,OAAO,YAAY;EAClD,IAAI,QAAQ,IAAI,aAAa,SAC3B,OAAO,QAAQ,KAAK,EAAE,OAAO,6CAA6C,GAAG,GAAG;EAClF,IAAI,QAAQ,IAAI,OAAO,uBAAuB,MAAM,QAAQ,mBAC1D,OAAO,QAAQ,KAAK,EAAE,OAAO,qDAAqD,GAAG,GAAG;EAC1F,IAAI;EACJ,IAAI;GACF,OAAO,MAAM,QAAQ,IAAI,KAAK;EAChC,QAAQ;GACN,OAAO,QAAQ,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;EAC1E;EACA,MAAM,SAAS,OAAO,SAAS,YAAY,SAAS,QAAQ,YAAY,OAAO,KAAK,SAAS,KAAA;EAC7F,IAAI,OAAO,WAAW,UAAU,OAAO,QAAQ,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;EACxG,IAAI;EACJ,IAAI;GACF,SAAS,IAAI,IAAI,MAAM;EACzB,QAAQ;GACN,OAAO,QAAQ,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;EAClE;EACA,IACE,OAAO,aAAa,WACpB,CAAC;GAAC;GAAa;GAAa;EAAO,CAAC,CAAC,SAAS,OAAO,QAAQ,KAC7D,OAAO,aAAa,OACpB,OAAO,WAAW,MAClB,OAAO,SAAS,MAChB,CAAC,OAAO,MAER,OAAO,QAAQ,KAAK,EAAE,OAAO,mDAAmD,GAAG,GAAG;EACxF,iBAAiB,OAAO;EACxB,OAAO,QAAQ,KAAK,EAAE,IAAI,KAAK,CAAC;CAClC,CAAC;CACD,IAAI,KAAKtB,eAAAA,mBAAmB,OAAO,YAAY;EAC7C,MAAM,SAAS,OAAO,WAAA,GAAUa,YAAAA,UAAAA,CAAU,SAASC,eAAAA,eAAe,MAAM,CAAC;EACzE,MAAM,UAAU,WAAW,KAAA,IAAY,KAAA,IAAY,OAAO,WAAW,QAAQ,MAAM;EACnF,IAAI,CAAC,UAAU,CAAC,SAAS,OAAO,QAAQ,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;EAClG,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,QAAQ,IAAI,KAAK;EACpC,QAAQ;GACN,OAAO,QAAQ,KAAK,EAAE,OAAO,6CAA6C,GAAG,GAAG;EAClF;EACA,MAAM,SAAS,QAAQ,KAAK,QAAQ;EACpC,IAAI,CAAC,OAAO,IAAI,OAAO,QAAQ,KAAK,EAAE,OAAO,mCAAmC,OAAO,QAAQ,GAAG,GAAG,GAAG;EACxG,IAAI;EACJ,IAAI;GACF,UAAU,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,SAAS,CAAC;EACjE,QAAQ;GACN,OAAO,QAAQ,KAAK,EAAE,OAAO,yCAAyC,GAAG,GAAG;EAC9E;EACA,MAAM,QAAQ,cAAc,OAAO;EACnC,MAAM,OAAO,YAAY,OAAO,IAAI;EACpC,IAAI,CAAC,SAAS,CAAC,MAAM,OAAO,QAAQ,KAAK,EAAE,OAAO,uCAAuC,GAAG,GAAG;EAC/F,MAAM,SAAS,IAAI,IAAI,MAAM,QAAQ,iBAAiB;EACtD,MAAM,UAAU,IAAI,QAAQ;EAC5B,KAAK,MAAM,CAAC,MAAM,UAAU,MAAM,SAAS;GACzC,MAAM,aAAa,KAAK,YAAY;GACpC,IAAI,kBAAkB,IAAI,UAAU,KAAK,WAAW,WAAW,MAAM,GAAG;GACxE,QAAQ,OAAO,MAAM,KAAK;EAC5B;EACA,MAAM,SAASS,gBAAAA,gBAAgB,MAAM,QAAQ,OAAO,QAAQ;EAC5D,MAAM,aAAa,OAAO,UAAU,MAAM,MAAM,eAAe,eAAe;EAC9E,MAAM,eAAe,WAAW,KAAA,KAAa,OAAO,eAAe,QAAQ,MAAM;EACjF,IAAI,eAAe;EACnB,IAAI,UAAU,cAAc;GAC1B,MAAM,YAAY,QAAQ,IAAIC,eAAAA,cAAc;GAC5C,IAAI;GACJ,IAAI;IACF,aAAa,YAAY,KAAK,MAAM,OAAO,KAAK,WAAW,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC,IAAI,KAAA;GAC9F,QAAQ;IACN,aAAa,KAAA;GACf;GACA,MAAM,WAAW;GACjB,IAAI,eAAe,cAEjB,eAAe,CAAC,OAAO,mBAAmB,QAAQ,QAAQ,UAAU,YAAY,UAAU,SAAS;QAC9F,IACL,OAAO,UAAU,eAAe,YAChC,CAAE,MAAM,OAAO,SAAS,CAAC,CAAC,aAAa,SAAS,YAAY,UAAU,UAAU,QAAQ,SAAS,QAAQ,GAEzG,eAAe;EACnB;EACA,QAAQ,OAAOA,eAAAA,cAAc;EAC7B,MAAM,eAAe,gBAAgB,CAAC,eAAe,aAAa;EAGlE,QAAQ,IAAI3B,mBAAAA,iCAAiC,QAAQ;EACrD,QAAQ,IAAIC,mBAAAA,kCAAkC,MAAM;EACpD,QAAQ,IAAIC,mBAAAA,gCAAgC,YAAY;EACxD,IAAI;EACJ,IAAI,cAAc;GAChB,MAAM,UAAU,eAAe,eAAe,2BAA2B;GACzE,WAAW,QAAQ,KAAK;IAAE,OAAO,6BAA6B,QAAQ;IAAI;IAAQ,MAAM;GAAW,GAAG,GAAG;EAC3G,OAAO,IAAI0B,yBAAAA,sBAAsB,OAAO,QAAQ,KAAK,CAACC,yBAAAA,uBAAuB,MAAM,QAAQ,OAAO,QAAQ,GACxG,WAAW,QAAQ,KAAK,EAAE,OAAO,wDAAwD,GAAG,GAAG;OAC1F;GACL,MAAM,WAAW,IAAI,QAAQ,QAAQ;IACnC,QAAQ,MAAM;IACd;IACA,GAAI,MAAM,WAAW,SAAS,MAAM,WAAW,SAAS,CAAC,IAAI,EAAE,KAAK;GACtE,CAAC;GACD,IAAI,OAAO,aAAa,iBAAiB,OAAO,SAAS,WAAW,cAAc,GAAG;IACnF,QAAQ,IAAI,UAAU,QAAQ,IAAI,OAAO,QAAQ,KAAK,EAAE;IACxD,QAAQ,IAAI,QAAQ,QAAQ,IAAI,OAAO,MAAM,KAAK,EAAE;IACpD,QAAQ,IAAI,UAAU,QAAQ,IAAI,OAAO,QAAQ,KAAK,EAAE;IACxD,WAAW,MAAM,IAAI,MAAM,IAAI,QAAQ,UAAU,EAAE,QAAQ,CAAC,GAAG;KAC7D,UAAU;KACV,gBAAgB;KAChB;IACF,CAAC;GACH,OAAO,WAAW,MAAM,QAAQ,QAAQ,QAAQ;EAClD;EACA,MAAM,eAAe,OAAO,KAAK,MAAM,SAAS,YAAY,CAAC;EAC7D,MAAM,SAAS,QAAQ,KACrB,IAAI,YAAY,CAAC,CAAC,OAChB,KAAK,UAAU;GACb,GAAG;GACH,QAAQ,SAAS;GACjB,SAAS,CAAC,GAAG,SAAS,QAAQ,QAAQ,CAAC;GACvC,MAAM,aAAa,SAAS,QAAQ;EACtC,CAAC,CACH,CACF;EACA,OAAO,OAAO,KACV,QAAQ,KAAK,OAAO,QAAQ,IAC5B,QAAQ,KAAK,EAAE,OAAO,+BAA+B,OAAO,QAAQ,GAAG,GAAG,GAAG;CACnF,CAAC;CACD,IAAI,GAAG,CAAC,QAAQ,QAAQ,GAAG,KAAK,OAAO,YAAY;EACjD,IACE,CAACjB,yBAAAA,wBAAwB,QAAQ,IAAI,QAAQ,QAAQ,IAAI,IAAI,KAC7D,EAAE,QAAQ,IAAI,WAAW,UAAU,QAAQ,IAAI,SAAS,6BACxD,EAAE,QAAQ,IAAI,WAAW,UAAU,kBAAkB,IAAI,QAAQ,IAAI,IAAI,IAEzE,OAAO,QAAQ,SAAS;EAC1B,OAAO,QAAQ,QAAQ,QAAQ,IAAI,GAAG;CACxC,CAAC;CACD,IAAI,GAAG,CAAC,OAAO,MAAM,GAAG,KAAK,OAAO,YAAY;EAE9C,IAAI,qBAAqB,QAAQ,IAAI,KAAK,QAAQ,IAAI,IAAI,GAAG;GAC3D,MAAM,QAAQ,qBAAqB,QAAQ,IAAI,KAAK,QAAQ,IAAI,IAAI;GACpE,OAAO,QAAQ,IAAI,aAAa,YAAY,UAAU,KAAA,IAClD,WAAW,MAAM,OAAO,QAAQ,IAAI,MAAM,IAC1C,QAAQ,KAAK,EAAE,OAAO,aAAa,GAAG,GAAG;EAC/C;EACA,IAAIA,yBAAAA,wBAAwB,QAAQ,IAAI,QAAQ,QAAQ,IAAI,IAAI,GAAG,OAAO,QAAQ,QAAQ,QAAQ,IAAI,GAAG;EACzG,IAAI,QAAQ,IAAI,KAAK,WAAW,OAAO,GAAG,OAAO,QAAQ,KAAK,EAAE,OAAO,aAAa,GAAG,GAAG;EAC1F,IAAI,QAAQ,IAAI,SAAS,OAAO,OAAO,WAAA,GAAUI,YAAAA,UAAAA,CAAU,SAAA,aAAwB,MAAM,CAAC,MAAM,KAAA,GAC9F,OAAO,QAAQ,SAAS,OAAO;EACjC,IAAI,QAAQ,IAAI,SAAS,2BAA2B,QAAQ,IAAI,KAAK,WAAW,iBAAiB,GAAG;GAClG,MAAM,OAAO,IAAI,IAAI,QAAQ,IAAI,GAAG;GACpC,OAAO,MAAM,QAAQ,QACnB,IAAI,QAAQ,IAAI,IAAI,GAAG,KAAK,WAAW,KAAK,UAAU,iBAAiB,GAAG,EACxE,QAAQ,QAAQ,IAAI,OACtB,CAAC,CACH;EACF;EACA,IAAI,CAAC,gBAAgB,OAAO,QAAQ,KAAK,EAAE,OAAO,8CAA8C,GAAG,GAAG;EACtG,MAAM,OAAO,IAAI,IAAI,QAAQ,IAAI,GAAG;EACpC,MAAM,SAAS,IAAI,IAAI,GAAG,KAAK,WAAW,KAAK,UAAU,cAAc;EACvE,MAAM,SAAS,MAAM,MAAM,QAAQ;GAAE,QAAQ,QAAQ,IAAI;GAAQ,UAAU;EAAS,CAAC;EACrF,MAAM,UAAU,IAAI,QAAQ,OAAO,OAAO;EAC1C,QAAQ,OAAO,YAAY;EAC3B,OAAO,IAAI,SAAS,OAAO,MAAM;GAAE,QAAQ,OAAO;GAAQ;EAAQ,CAAC;CACrE,CAAC;CAED,OAAO;EACL;EACA;EACA,YAAY,OAAO,YAAY,IAAI,MAAM,SAAS,EAAE,UAAU,QAAQ,CAAC;EACvE,OAAO,YAAY,OAAO,MAAM;CAClC;AACF"}
+{"version":3,"file":"remoteRuntime.cjs","names":["PUBLIC_FILE_SHARE_PREFIX","PO_API_CALLER_LOCALITY_HEADER","PO_API_CALLER_DEVICE_ID_HEADER","PO_API_CALLER_STEP_UP_HEADER","REMOTE_HTTP_ROUTE","REMOTE_CHANNEL_ROUTE","pipeline","Readable","createRemoteAccessStore","defaultRemoteStateDir","createDevProxyStore","Hono","createPublicFileShares","isPublicSessionMcpRoute","originVerdict","localOriginPolicy","isPublicPairingRoute","getCookie","DEVICE_COOKIE","isDevProxyPath","createRemoteAccess","createTunnelLauncher","WebSocketServer","createServer","parseProxyPath","parsePoSocketPath","createTextLink","stepUpActionFor","STEP_UP_HEADER","isSessionMcpHostRoute","isSessionMcpPhoneRoute"],"sources":["../src/server/remoteRuntime.ts"],"sourcesContent":["import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';\nimport { Readable } from 'node:stream';\nimport { pipeline } from 'node:stream/promises';\n\nimport type { Link } from '@earendil-works/chord';\nimport { Hono } from 'hono';\nimport { getCookie } from 'hono/cookie';\nimport { WebSocketServer, type RawData } from 'ws';\n\nimport { DEVICE_COOKIE, REMOTE_CHANNEL_ROUTE, REMOTE_HTTP_ROUTE, STEP_UP_HEADER } from '../constants/remote';\nimport {\n  PO_API_CALLER_DEVICE_ID_HEADER,\n  PO_API_CALLER_LOCALITY_HEADER,\n  PO_API_CALLER_STEP_UP_HEADER,\n  parsePoSocketPath,\n} from '../schemas/packageApi';\nimport { createTextLink } from '../schemas/protocolContracts';\nimport { isDevProxyPath, parseProxyPath } from '../services/devProxyPolicy';\nimport { createDevProxyStore } from '../services/devProxyStore';\nimport { createPublicFileShares, PUBLIC_FILE_SHARE_PREFIX, type PublicFileShares } from '../services/publicFileShares';\nimport { createRemoteAccess, type RemoteAccess } from '../services/remoteAccess';\nimport { createRemoteAccessStore, defaultRemoteStateDir } from '../services/remoteAccessStore';\nimport {\n  isPublicPairingRoute,\n  originVerdict,\n  type GuardListener,\n  localOriginPolicy,\n} from '../services/remoteGuardPolicy';\nimport { createTunnelLauncher, reapStaleTunnel } from '../services/tunnelProcess';\nimport { stepUpActionFor } from '../services/webauthnPolicy';\nimport { type TunnelLauncher } from '../types/remote';\nimport { registerDevProxyRoutes } from './devProxyRoutes';\nimport { relayDevProxySocket } from './devProxySocket';\nimport { registerRemoteRoutes } from './remoteRoutes';\nimport { isPublicSessionMcpRoute, isSessionMcpHostRoute, isSessionMcpPhoneRoute } from './sessionMcpRoutes';\n\nexport { relayDevProxySocket, type DevProxySocketInput } from './devProxySocket';\n\nconst MAX_REQUEST_BYTES = 8 * 1024 * 1024;\nconst TUNNEL_HEADERS_TIMEOUT_MS = 5_000;\nconst TUNNEL_REQUEST_TIMEOUT_MS = 10_000;\nconst TUNNEL_CONNECTION_LIMIT = 64;\nconst TUNNEL_REQUESTS_PER_SOCKET = 100;\nconst SEALED_HTTP_VERSION = 1;\nconst SEALED_HTTP_METHODS = new Set(['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE']);\n/** HMAC-authenticated peer routes are the only non-device tunnel APIs. */\nconst SESSION_PEER_INBOX_ROUTE = '/api/plugins/session-peer/inbox';\nconst VOICE_PEER_ROUTES = new Set(['/api/plugins/voice/peer', '/api/plugins/voice/peer-ownership']);\n/** The one public file share shape: a 256-bit base64url token and nothing after it. */\nconst PUBLIC_FILE_SHARE_ROUTE = /^\\/mcp-file\\/([A-Za-z0-9_-]{43})$/u;\n/** Everything under this name is reserved for shares, so a near miss never reaches another route. */\nconst PUBLIC_FILE_SHARE_NAMESPACE = PUBLIC_FILE_SHARE_PREFIX.slice(0, -1);\nconst FORBIDDEN_HEADERS = new Set([\n  'authorization',\n  'connection',\n  'content-length',\n  'cookie',\n  'forwarded',\n  'host',\n  'origin',\n  'transfer-encoding',\n  'upgrade',\n  'x-po-token',\n  'x-po-desktop',\n  PO_API_CALLER_LOCALITY_HEADER,\n  PO_API_CALLER_DEVICE_ID_HEADER,\n  PO_API_CALLER_STEP_UP_HEADER,\n  'x-forwarded-for',\n  'x-forwarded-host',\n  'x-forwarded-proto',\n]);\n\ninterface SealedHttpRequest {\n  v: number;\n  method: string;\n  target: string;\n  headers: Array<[string, string]>;\n  body?: string;\n}\n\nfunction sealedRequest(value: unknown): SealedHttpRequest | undefined {\n  if (typeof value !== 'object' || value === null) return undefined;\n  const request = value as Partial<SealedHttpRequest>;\n  if (\n    request.v !== SEALED_HTTP_VERSION ||\n    typeof request.method !== 'string' ||\n    !SEALED_HTTP_METHODS.has(request.method) ||\n    typeof request.target !== 'string' ||\n    !request.target.startsWith('/') ||\n    request.target.startsWith('//') ||\n    request.target.includes('#') ||\n    !Array.isArray(request.headers) ||\n    !request.headers.every(\n      (header) => Array.isArray(header) && header.length === 2 && header.every((part) => typeof part === 'string'),\n    ) ||\n    (request.body !== undefined && typeof request.body !== 'string')\n  )\n    return undefined;\n  const parsed = new URL(request.target, 'http://po.local');\n  if (parsed.pathname === REMOTE_HTTP_ROUTE || parsed.pathname === REMOTE_CHANNEL_ROUTE) return undefined;\n  return request as SealedHttpRequest;\n}\n\nfunction decodedBody(value: string | undefined): Buffer | undefined {\n  if (value === undefined) return Buffer.alloc(0);\n  if (!/^(?:[A-Za-z\\d+/]{4})*(?:[A-Za-z\\d+/]{2}==|[A-Za-z\\d+/]{3}=)?$/u.test(value)) return undefined;\n  const body = Buffer.from(value, 'base64');\n  return body.toString('base64') === value ? body : undefined;\n}\n\ninterface ListenerBindings {\n  listener: GuardListener;\n  incoming?: IncomingMessage;\n  sealedDeviceId?: string;\n  /** Whether the sealed gateway verified a step-up for this re-dispatched request. */\n  sealedStepUp?: 'verified' | 'not-required';\n}\n\nexport interface RemoteRuntimeOptions {\n  homeDirectory: string;\n  registrationToken: string;\n  bundleTrust(): { publicKey: string; revision: number } | undefined;\n  /** Signs `po/host-channel-key/v1` fields with the shell signer, for native device reconnects. */\n  attestHost?: (fields: readonly string[]) => string | undefined;\n  onNotice(message: string): void;\n  /** The listener to which a sealed, authenticated request is forwarded. */\n  forward(request: Request): Promise<Response>;\n  /** Hands a paired device's relayed Chord link to the protocol host, as an upgrade at `pathname` would. */\n  acceptProtocol(pathname: string, link: Link, deviceId: string): boolean;\n  onDeviceDropped?: (deviceId: string) => void;\n  launchTunnel?: TunnelLauncher;\n  /** Ports the host itself listens on, which a dev proxy target may never name. */\n  reservedPorts?: () => readonly (number | undefined)[];\n}\n\nexport interface RemoteRuntime {\n  readonly remote: RemoteAccess;\n  /** Short-lived public links served by the tunnel listener itself, never forwarded to the hub. */\n  readonly fileShares: PublicFileShares;\n  fetchLocal(request: Request): Promise<Response>;\n  close(): Promise<void>;\n}\n\nasync function readBody(request: IncomingMessage): Promise<Buffer> {\n  const chunks: Buffer[] = [];\n  let size = 0;\n  for await (const chunk of request) {\n    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);\n    size += bytes.byteLength;\n    if (size > MAX_REQUEST_BYTES) throw new Error('The tunnel request body is too large.');\n    chunks.push(bytes);\n  }\n  return Buffer.concat(chunks);\n}\n\nasync function writeResponse(response: ServerResponse, result: Response): Promise<void> {\n  response.writeHead(result.status, Object.fromEntries(result.headers.entries()));\n  if (result.body === null) {\n    response.end();\n    return;\n  }\n  await pipeline(Readable.fromWeb(result.body as import('node:stream/web').ReadableStream), response);\n}\n\n/** One global control plane and a second socket dedicated to public tunnel traffic. */\nexport function createRemoteRuntime(options: RemoteRuntimeOptions): RemoteRuntime {\n  const store = createRemoteAccessStore({\n    stateDir: defaultRemoteStateDir(options.homeDirectory),\n    onNotice: (message) => options.onNotice(message),\n  });\n  reapStaleTunnel(store.directory, (message) => options.onNotice(message));\n  const devProxy = createDevProxyStore({ stateDir: store.directory, onNotice: (message) => options.onNotice(message) });\n  const app = new Hono<{ Bindings: ListenerBindings }>();\n  let remote: RemoteAccess;\n  let frontendOrigin: string | undefined;\n  const fileShares = createPublicFileShares({\n    publicOrigin: () => remote.publicOrigin(),\n    publicOriginRevision: () => remote.publicOriginRevision(),\n    onNotice: (message) => options.onNotice(message),\n  });\n  /** Exact share route on the decoded path, and the raw path must not have needed decoding. */\n  const publicFileShareToken = (request: Request, path: string): string | undefined =>\n    new URL(request.url).pathname === path ? PUBLIC_FILE_SHARE_ROUTE.exec(path)?.[1] : undefined;\n  const inFileShareNamespace = (request: Request, path: string): boolean =>\n    path.startsWith(PUBLIC_FILE_SHARE_NAMESPACE) ||\n    new URL(request.url).pathname.startsWith(PUBLIC_FILE_SHARE_NAMESPACE);\n  app.use('*', async (context, next) => {\n    if (context.env.listener === 'local') return next();\n    const path = context.req.path;\n    const publicSessionMcp = isPublicSessionMcpRoute(context.req.method, path);\n    const publicSessionPeer = context.req.method === 'POST' && path === SESSION_PEER_INBOX_ROUTE;\n    const publicVoicePeer = context.req.method === 'POST' && VOICE_PEER_ROUTES.has(path);\n    const publicFileShare =\n      (context.req.method === 'GET' || context.req.method === 'HEAD') &&\n      publicFileShareToken(context.req.raw, path) !== undefined;\n    const verdict = originVerdict({\n      listener: 'tunnel',\n      // Exact OAuth, MCP, and HMAC-authenticated peer routes authenticate at the\n      // application layer. Treat an absent Origin like a server-to-server read.\n      method: publicSessionMcp || publicSessionPeer || publicVoicePeer ? 'GET' : context.req.method,\n      isUpgrade: false,\n      origin: context.req.header('origin'),\n      host: context.req.header('host'),\n      local: localOriginPolicy(0),\n      tunnel: remote.tunnelPolicy(),\n    });\n    if (verdict !== 'allow') return context.json({ error: `Tunnel request refused: ${verdict}.` }, 403);\n    // The token is the credential, so a share needs no device. Near misses never fall through.\n    if (publicFileShare) return next();\n    if (inFileShareNamespace(context.req.raw, path)) return context.json({ error: 'Not found.' }, 404);\n    if (isPublicPairingRoute(context.req.method, path) || publicSessionMcp || publicSessionPeer || publicVoicePeer)\n      return next();\n    const device = remote.authorize(getCookie(context, DEVICE_COOKIE, 'host'));\n    if (device === undefined) return context.json({ error: 'This device is not paired.' }, 401);\n    if (context.env.sealedDeviceId === device) return next();\n    // A proxied dev site issues its own subresource requests and form posts, none of which can go\n    // through a gateway that seals whole JSON responses. The same predicate the proxy route uses\n    // refuses dot segments, so a path granted here cannot resolve into /api/.\n    if (isDevProxyPath(path)) return next();\n    if (context.req.method === 'POST' && (path === REMOTE_CHANNEL_ROUTE || path === REMOTE_HTTP_ROUTE)) return next();\n    if ((context.req.method === 'GET' || context.req.method === 'HEAD') && !path.startsWith('/api/')) return next();\n    return context.json({ error: 'Remote HTTP requests must use the sealed gateway.' }, 401);\n  });\n\n  remote = createRemoteAccess({\n    store,\n    onDeviceDropped: options.onDeviceDropped,\n    launchTunnel:\n      options.launchTunnel ??\n      createTunnelLauncher({\n        stateDir: store.directory,\n        onNotice: (message) => options.onNotice(message),\n        onExit: (message) => {\n          options.onNotice(`remote access: ${message}`);\n          void remote.disable();\n        },\n      }),\n    bindListener: async () => {\n      const webSockets = new WebSocketServer({ noServer: true, maxPayload: MAX_REQUEST_BYTES });\n      const server = createServer((incoming, outgoing) => {\n        void (async () => {\n          const abort = new AbortController();\n          const disconnected = (): void => abort.abort();\n          incoming.once('aborted', disconnected);\n          outgoing.once('close', disconnected);\n          try {\n            const url = new URL(incoming.url ?? '/', `http://${incoming.headers.host ?? 'localhost'}`);\n            const headers = new Headers();\n            for (const [name, value] of Object.entries(incoming.headers))\n              if (value !== undefined) headers.set(name, Array.isArray(value) ? value.join(', ') : value);\n            const body = incoming.method === 'GET' || incoming.method === 'HEAD' ? undefined : await readBody(incoming);\n            const request = new Request(url, {\n              method: incoming.method,\n              headers,\n              signal: abort.signal,\n              ...(body === undefined ? {} : { body }),\n            });\n            await writeResponse(outgoing, await app.fetch(request, { listener: 'tunnel', incoming }));\n          } finally {\n            incoming.off('aborted', disconnected);\n            outgoing.off('close', disconnected);\n          }\n        })().catch((error: unknown) => {\n          options.onNotice(`tunnel request failed: ${String(error)}`);\n          if (!outgoing.headersSent) {\n            outgoing.writeHead(500, { 'content-type': 'application/json' });\n            outgoing.end(JSON.stringify({ error: 'The tunnel request failed.' }));\n          } else outgoing.destroy();\n        });\n      });\n      server.on('upgrade', (incoming, socket, head) => {\n        const url = new URL(incoming.url ?? '/', `http://${incoming.headers.host ?? 'localhost'}`);\n        const verdict = originVerdict({\n          listener: 'tunnel',\n          method: incoming.method ?? 'GET',\n          isUpgrade: true,\n          origin: incoming.headers.origin,\n          host: incoming.headers.host,\n          local: localOriginPolicy(0),\n          tunnel: remote.tunnelPolicy(),\n        });\n        const cookies = new Map(\n          (incoming.headers.cookie ?? '').split(';').map((part) => {\n            const at = part.indexOf('=');\n            return [part.slice(0, at).trim(), part.slice(at + 1).trim()];\n          }),\n        );\n        const device = remote.authorize(cookies.get(`__Host-${DEVICE_COOKIE}`));\n        // Hot module reload: a paired device's dev-site socket goes to the registered target.\n        if (isDevProxyPath(url.pathname) && verdict === 'allow' && device !== undefined) {\n          const parsed = parseProxyPath(url.pathname);\n          const target = parsed.kind === 'match' ? devProxy.find(parsed.name) : undefined;\n          if (parsed.kind !== 'match' || target === undefined) {\n            socket.write('HTTP/1.1 404 Not Found\\r\\n\\r\\n');\n            socket.destroy();\n            return;\n          }\n          webSockets.handleUpgrade(incoming, socket, head, (client) => {\n            const untrack = remote.trackSocket(device, (code, reason) => client.close(code, reason));\n            client.once('close', untrack);\n            relayDevProxySocket(client, {\n              port: target.port,\n              upstreamPath: `${parsed.upstreamPath}${url.search}`,\n              protocols: incoming.headers['sec-websocket-protocol'],\n              onNotice: (message) => options.onNotice(message),\n            });\n          });\n          return;\n        }\n        const channel = device === undefined ? undefined : remote.channelFor(device, 'protocol');\n        if (!parsePoSocketPath(url.pathname) || verdict !== 'allow' || !device || !channel) {\n          socket.write('HTTP/1.1 403 Forbidden\\r\\n\\r\\n');\n          socket.destroy();\n          return;\n        }\n        webSockets.handleUpgrade(incoming, socket, head, (client) => {\n          const untrack = remote.trackSocket(device, (code, reason) => client.close(code, reason));\n          const relay = createTextLink({\n            send: (text) => {\n              const sealed = channel.seal(Buffer.from(text));\n              if (!sealed.ok) {\n                relay.ended('seal failed');\n                return;\n              }\n              client.send(Buffer.from(JSON.stringify(sealed.envelope)));\n            },\n            close: () => {\n              untrack();\n              client.close();\n            },\n          });\n          client.on('message', (raw: RawData) => {\n            if (!remote.isDeviceAuthorized(device)) {\n              relay.ended('device revoked');\n              return;\n            }\n            const bytes = Array.isArray(raw) ? Buffer.concat(raw) : Buffer.from(raw as Buffer);\n            let envelope: unknown;\n            try {\n              envelope = JSON.parse(bytes.toString('utf8')) as unknown;\n            } catch {\n              relay.ended('invalid envelope');\n              return;\n            }\n            const opened = channel.open(envelope);\n            if (!opened.ok) {\n              relay.ended('invalid envelope');\n              return;\n            }\n            relay.deliver(Buffer.from(opened.plaintext).toString('utf8'));\n          });\n          client.on('close', () => relay.ended('client closed'));\n          client.on('error', () => relay.ended('client error'));\n          try {\n            options.acceptProtocol(url.pathname, relay.link, device);\n          } catch (error) {\n            options.onNotice(`remote protocol could not connect: ${String(error)}`);\n            relay.ended('protocol unavailable');\n          }\n        });\n      });\n      server.headersTimeout = TUNNEL_HEADERS_TIMEOUT_MS;\n      server.requestTimeout = TUNNEL_REQUEST_TIMEOUT_MS;\n      server.maxConnections = TUNNEL_CONNECTION_LIMIT;\n      server.maxRequestsPerSocket = TUNNEL_REQUESTS_PER_SOCKET;\n      await new Promise<void>((resolve, reject) => {\n        server.once('error', reject);\n        server.listen(0, '127.0.0.1', resolve);\n      });\n      const address = server.address();\n      if (!address || typeof address === 'string') throw new Error('The tunnel listener has no TCP address.');\n      return {\n        port: address.port,\n        close: async () => {\n          for (const client of webSockets.clients) client.terminate();\n          webSockets.close();\n          server.closeAllConnections();\n          await new Promise<void>((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())));\n        },\n      };\n    },\n    bundleTrust: () => options.bundleTrust(),\n    attestHost: (fields) => options.attestHost?.(fields),\n    onNotice: (message) => options.onNotice(message),\n  });\n  registerRemoteRoutes(app as unknown as Hono, {\n    remote,\n    listenerOf: (context) => (context.env as ListenerBindings).listener,\n  });\n  registerDevProxyRoutes(app as unknown as Hono, {\n    store: devProxy,\n    listenerOf: (context) => (context.env as ListenerBindings).listener,\n    // Read per call: the tunnel port exists only while remote access is on, and a target checked\n    // against a stale list could end up aimed at the cockpit itself.\n    reservedPorts: () => [\n      remote.tunnelPort(),\n      frontendOrigin === undefined ? undefined : Number(new URL(frontendOrigin).port),\n      ...(options.reservedPorts?.() ?? []),\n    ],\n    onNotice: (message) => options.onNotice(message),\n  });\n  app.post('/api/remote/frontend', async (context) => {\n    if (context.env.listener !== 'local')\n      return context.json({ error: 'This action is only available on the host.' }, 403);\n    if (context.req.header('x-po-web-registration') !== options.registrationToken)\n      return context.json({ error: 'The web presentation server was not authenticated.' }, 403);\n    let body: unknown;\n    try {\n      body = await context.req.json();\n    } catch {\n      return context.json({ error: 'A loopback web origin is required.' }, 400);\n    }\n    const origin = typeof body === 'object' && body !== null && 'origin' in body ? body.origin : undefined;\n    if (typeof origin !== 'string') return context.json({ error: 'A loopback web origin is required.' }, 400);\n    let parsed: URL;\n    try {\n      parsed = new URL(origin);\n    } catch {\n      return context.json({ error: 'The web origin is invalid.' }, 400);\n    }\n    if (\n      parsed.protocol !== 'http:' ||\n      !['127.0.0.1', 'localhost', '[::1]'].includes(parsed.hostname) ||\n      parsed.pathname !== '/' ||\n      parsed.search !== '' ||\n      parsed.hash !== '' ||\n      !parsed.port\n    )\n      return context.json({ error: 'The web origin must be a loopback HTTP listener.' }, 400);\n    frontendOrigin = parsed.origin;\n    return context.json({ ok: true });\n  });\n  app.post(REMOTE_HTTP_ROUTE, async (context) => {\n    const device = remote.authorize(getCookie(context, DEVICE_COOKIE, 'host'));\n    const channel = device === undefined ? undefined : remote.channelFor(device, 'http');\n    if (!device || !channel) return context.json({ error: 'A sealed paired device is required.' }, 401);\n    let envelope: unknown;\n    try {\n      envelope = await context.req.json();\n    } catch {\n      return context.json({ error: 'The sealed request envelope was malformed.' }, 400);\n    }\n    const opened = channel.open(envelope);\n    if (!opened.ok) return context.json({ error: `The sealed request was refused: ${opened.failure}.` }, 400);\n    let decoded: unknown;\n    try {\n      decoded = JSON.parse(new TextDecoder().decode(opened.plaintext)) as unknown;\n    } catch {\n      return context.json({ error: 'The sealed HTTP request was malformed.' }, 400);\n    }\n    const inner = sealedRequest(decoded);\n    const body = decodedBody(inner?.body);\n    if (!inner || !body) return context.json({ error: 'The sealed HTTP request was invalid.' }, 400);\n    const target = new URL(inner.target, 'http://po.local');\n    const headers = new Headers();\n    for (const [name, value] of inner.headers) {\n      const normalized = name.toLowerCase();\n      if (FORBIDDEN_HEADERS.has(normalized) || normalized.startsWith('sec-')) continue;\n      headers.append(name, value);\n    }\n    const action = stepUpActionFor(inner.method, target.pathname);\n    const stepUpKind = remote.trustKind(device) === 'device-key' ? 'device-key' : 'passkey';\n    const stepUpNeeded = action !== undefined && remote.stepUpRequired(action, device);\n    let stepUpDenied = false;\n    if (action && stepUpNeeded) {\n      const assertion = headers.get(STEP_UP_HEADER);\n      let credential: unknown;\n      try {\n        credential = assertion ? JSON.parse(Buffer.from(assertion, 'base64url').toString('utf8')) : undefined;\n      } catch {\n        credential = undefined;\n      }\n      const ceremony = credential as { ceremonyId?: unknown; response?: unknown; signature?: unknown } | undefined;\n      if (stepUpKind === 'device-key') {\n        // A device-key session proves the gesture with its biometric key, never a passkey.\n        stepUpDenied = !remote.finishDeviceStepUp(device, action, ceremony?.ceremonyId, ceremony?.signature);\n      } else if (\n        typeof ceremony?.ceremonyId !== 'string' ||\n        !(await remote.passkeys().finishStepUp(ceremony.ceremonyId, `device:${device}`, action, ceremony.response))\n      )\n        stepUpDenied = true;\n    }\n    headers.delete(STEP_UP_HEADER);\n    const sealedStepUp = stepUpNeeded && !stepUpDenied ? 'verified' : 'not-required';\n    // Caller stamps are assigned after the sealed request is opened. They never\n    // originate from browser-controlled sealed headers.\n    headers.set(PO_API_CALLER_LOCALITY_HEADER, 'remote');\n    headers.set(PO_API_CALLER_DEVICE_ID_HEADER, device);\n    headers.set(PO_API_CALLER_STEP_UP_HEADER, sealedStepUp);\n    let response: Response;\n    if (stepUpDenied) {\n      const gesture = stepUpKind === 'device-key' ? 'biometric confirmation' : 'passkey gesture';\n      response = context.json({ error: `This action needs a fresh ${gesture}.`, action, kind: stepUpKind }, 401);\n    } else if (isSessionMcpHostRoute(target.pathname) && !isSessionMcpPhoneRoute(inner.method, target.pathname)) {\n      response = context.json({ error: 'Session MCP management is only available on the host.' }, 403);\n    } else {\n      const internal = new Request(target, {\n        method: inner.method,\n        headers,\n        ...(inner.method === 'GET' || inner.method === 'HEAD' ? {} : { body }),\n      });\n      if (target.pathname === '/api/remote' || target.pathname.startsWith('/api/remote/')) {\n        headers.set('cookie', context.req.header('cookie') ?? '');\n        headers.set('host', context.req.header('host') ?? '');\n        headers.set('origin', context.req.header('origin') ?? '');\n        response = await app.fetch(new Request(internal, { headers }), {\n          listener: 'tunnel',\n          sealedDeviceId: device,\n          sealedStepUp,\n        });\n      } else response = await options.forward(internal);\n    }\n    const responseBody = Buffer.from(await response.arrayBuffer());\n    const sealed = channel.seal(\n      new TextEncoder().encode(\n        JSON.stringify({\n          v: SEALED_HTTP_VERSION,\n          status: response.status,\n          headers: [...response.headers.entries()],\n          body: responseBody.toString('base64'),\n        }),\n      ),\n    );\n    return sealed.ok\n      ? context.json(sealed.envelope)\n      : context.json({ error: `The sealed response failed: ${sealed.failure}.` }, 503);\n  });\n  app.on(['POST', 'DELETE'], '*', async (context) => {\n    if (\n      !isPublicSessionMcpRoute(context.req.method, context.req.path) &&\n      !(context.req.method === 'POST' && context.req.path === SESSION_PEER_INBOX_ROUTE) &&\n      !(context.req.method === 'POST' && VOICE_PEER_ROUTES.has(context.req.path))\n    )\n      return context.notFound();\n    return options.forward(context.req.raw);\n  });\n  app.on(['GET', 'HEAD'], '*', async (context) => {\n    // Served here and never through forward(), which would attach the host token.\n    if (inFileShareNamespace(context.req.raw, context.req.path)) {\n      const token = publicFileShareToken(context.req.raw, context.req.path);\n      return context.env.listener === 'tunnel' && token !== undefined\n        ? fileShares.serve(token, context.req.method)\n        : context.json({ error: 'Not found.' }, 404);\n    }\n    if (isPublicSessionMcpRoute(context.req.method, context.req.path)) return options.forward(context.req.raw);\n    if (context.req.path.startsWith('/api/')) return context.json({ error: 'Not found.' }, 404);\n    if (context.req.path === '/' && remote.authorize(getCookie(context, DEVICE_COOKIE, 'host')) === undefined)\n      return context.redirect('/pair');\n    if (context.req.path === '/bundle-manifest.json' || context.req.path.startsWith('/bundle-assets/')) {\n      const from = new URL(context.req.url);\n      return await options.forward(\n        new Request(new URL(`${from.pathname}${from.search}`, 'http://po.local'), {\n          method: context.req.method,\n        }),\n      );\n    }\n    if (!frontendOrigin) return context.json({ error: 'The web presentation server is unavailable.' }, 503);\n    const from = new URL(context.req.url);\n    const target = new URL(`${from.pathname}${from.search}`, frontendOrigin);\n    const result = await fetch(target, { method: context.req.method, redirect: 'manual' });\n    const headers = new Headers(result.headers);\n    headers.delete('set-cookie');\n    return new Response(result.body, { status: result.status, headers });\n  });\n\n  return {\n    remote,\n    fileShares,\n    fetchLocal: async (request) => app.fetch(request, { listener: 'local' }),\n    close: async () => remote.close(),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,MAAM,oBAAoB;AAC1B,MAAM,4BAA4B;AAClC,MAAM,4BAA4B;AAClC,MAAM,0BAA0B;AAChC,MAAM,6BAA6B;AACnC,MAAM,sBAAsB;AAC5B,MAAM,sCAAsB,IAAI,IAAI;CAAC;CAAO;CAAQ;CAAQ;CAAO;CAAS;AAAQ,CAAC;;AAErF,MAAM,2BAA2B;AACjC,MAAM,oCAAoB,IAAI,IAAI,CAAC,2BAA2B,mCAAmC,CAAC;;AAElG,MAAM,0BAA0B;;AAEhC,MAAM,8BAA8BA,gBAAAA,yBAAyB,MAAM,GAAG,EAAE;AACxE,MAAM,oCAAoB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACAC,mBAAAA;CACAC,mBAAAA;CACAC,mBAAAA;CACA;CACA;CACA;AACF,CAAC;AAUD,SAAS,cAAc,OAA+C;CACpE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO,KAAA;CACxD,MAAM,UAAU;CAChB,IACE,QAAQ,MAAM,uBACd,OAAO,QAAQ,WAAW,YAC1B,CAAC,oBAAoB,IAAI,QAAQ,MAAM,KACvC,OAAO,QAAQ,WAAW,YAC1B,CAAC,QAAQ,OAAO,WAAW,GAAG,KAC9B,QAAQ,OAAO,WAAW,IAAI,KAC9B,QAAQ,OAAO,SAAS,GAAG,KAC3B,CAAC,MAAM,QAAQ,QAAQ,OAAO,KAC9B,CAAC,QAAQ,QAAQ,OACd,WAAW,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,KAAK,OAAO,OAAO,SAAS,OAAO,SAAS,QAAQ,CAC7G,KACC,QAAQ,SAAS,KAAA,KAAa,OAAO,QAAQ,SAAS,UAEvD,OAAO,KAAA;CACT,MAAM,SAAS,IAAI,IAAI,QAAQ,QAAQ,iBAAiB;CACxD,IAAI,OAAO,aAAaC,eAAAA,qBAAqB,OAAO,aAAaC,eAAAA,sBAAsB,OAAO,KAAA;CAC9F,OAAO;AACT;AAEA,SAAS,YAAY,OAA+C;CAClE,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,MAAM,CAAC;CAC9C,IAAI,CAAC,iEAAiE,KAAK,KAAK,GAAG,OAAO,KAAA;CAC1F,MAAM,OAAO,OAAO,KAAK,OAAO,QAAQ;CACxC,OAAO,KAAK,SAAS,QAAQ,MAAM,QAAQ,OAAO,KAAA;AACpD;AAmCA,eAAe,SAAS,SAA2C;CACjE,MAAM,SAAmB,CAAC;CAC1B,IAAI,OAAO;CACX,WAAW,MAAM,SAAS,SAAS;EACjC,MAAM,QAAQ,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK;EAChE,QAAQ,MAAM;EACd,IAAI,OAAO,mBAAmB,MAAM,IAAI,MAAM,uCAAuC;EACrF,OAAO,KAAK,KAAK;CACnB;CACA,OAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,eAAe,cAAc,UAA0B,QAAiC;CACtF,SAAS,UAAU,OAAO,QAAQ,OAAO,YAAY,OAAO,QAAQ,QAAQ,CAAC,CAAC;CAC9E,IAAI,OAAO,SAAS,MAAM;EACxB,SAAS,IAAI;EACb;CACF;CACA,OAAA,GAAMC,qBAAAA,SAAAA,CAASC,YAAAA,SAAS,QAAQ,OAAO,IAAgD,GAAG,QAAQ;AACpG;;AAGA,SAAgB,oBAAoB,SAA8C;CAChF,MAAM,QAAQC,eAAAA,wBAAwB;EACpC,UAAUC,4BAAAA,sBAAsB,QAAQ,aAAa;EACrD,WAAW,YAAY,QAAQ,SAAS,OAAO;CACjD,CAAC;CACD,gBAAA,gBAAgB,MAAM,YAAY,YAAY,QAAQ,SAAS,OAAO,CAAC;CACvE,MAAM,WAAWC,aAAAA,oBAAoB;EAAE,UAAU,MAAM;EAAW,WAAW,YAAY,QAAQ,SAAS,OAAO;CAAE,CAAC;CACpH,MAAM,MAAM,IAAIC,KAAAA,KAAqC;CACrD,IAAI;CACJ,IAAI;CACJ,MAAM,aAAaC,gBAAAA,uBAAuB;EACxC,oBAAoB,OAAO,aAAa;EACxC,4BAA4B,OAAO,qBAAqB;EACxD,WAAW,YAAY,QAAQ,SAAS,OAAO;CACjD,CAAC;;CAED,MAAM,wBAAwB,SAAkB,SAC9C,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,aAAa,OAAO,wBAAwB,KAAK,IAAI,CAAC,GAAG,KAAK,KAAA;CACrF,MAAM,wBAAwB,SAAkB,SAC9C,KAAK,WAAW,2BAA2B,KAC3C,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,SAAS,WAAW,2BAA2B;CACtE,IAAI,IAAI,KAAK,OAAO,SAAS,SAAS;EACpC,IAAI,QAAQ,IAAI,aAAa,SAAS,OAAO,KAAK;EAClD,MAAM,OAAO,QAAQ,IAAI;EACzB,MAAM,mBAAmBC,yBAAAA,wBAAwB,QAAQ,IAAI,QAAQ,IAAI;EACzE,MAAM,oBAAoB,QAAQ,IAAI,WAAW,UAAU,SAAS;EACpE,MAAM,kBAAkB,QAAQ,IAAI,WAAW,UAAU,kBAAkB,IAAI,IAAI;EACnF,MAAM,mBACH,QAAQ,IAAI,WAAW,SAAS,QAAQ,IAAI,WAAW,WACxD,qBAAqB,QAAQ,IAAI,KAAK,IAAI,MAAM,KAAA;EAClD,MAAM,UAAUC,gBAAAA,cAAc;GAC5B,UAAU;GAGV,QAAQ,oBAAoB,qBAAqB,kBAAkB,QAAQ,QAAQ,IAAI;GACvF,WAAW;GACX,QAAQ,QAAQ,IAAI,OAAO,QAAQ;GACnC,MAAM,QAAQ,IAAI,OAAO,MAAM;GAC/B,OAAOC,gBAAAA,kBAAkB,CAAC;GAC1B,QAAQ,OAAO,aAAa;EAC9B,CAAC;EACD,IAAI,YAAY,SAAS,OAAO,QAAQ,KAAK,EAAE,OAAO,2BAA2B,QAAQ,GAAG,GAAG,GAAG;EAElG,IAAI,iBAAiB,OAAO,KAAK;EACjC,IAAI,qBAAqB,QAAQ,IAAI,KAAK,IAAI,GAAG,OAAO,QAAQ,KAAK,EAAE,OAAO,aAAa,GAAG,GAAG;EACjG,IAAIC,gBAAAA,qBAAqB,QAAQ,IAAI,QAAQ,IAAI,KAAK,oBAAoB,qBAAqB,iBAC7F,OAAO,KAAK;EACd,MAAM,SAAS,OAAO,WAAA,GAAUC,YAAAA,UAAAA,CAAU,SAASC,eAAAA,eAAe,MAAM,CAAC;EACzE,IAAI,WAAW,KAAA,GAAW,OAAO,QAAQ,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;EAC1F,IAAI,QAAQ,IAAI,mBAAmB,QAAQ,OAAO,KAAK;EAIvD,IAAIC,cAAAA,eAAe,IAAI,GAAG,OAAO,KAAK;EACtC,IAAI,QAAQ,IAAI,WAAW,WAAW,SAASd,eAAAA,wBAAwB,SAASD,eAAAA,oBAAoB,OAAO,KAAK;EAChH,KAAK,QAAQ,IAAI,WAAW,SAAS,QAAQ,IAAI,WAAW,WAAW,CAAC,KAAK,WAAW,OAAO,GAAG,OAAO,KAAK;EAC9G,OAAO,QAAQ,KAAK,EAAE,OAAO,oDAAoD,GAAG,GAAG;CACzF,CAAC;CAED,SAASgB,gBAAAA,mBAAmB;EAC1B;EACA,iBAAiB,QAAQ;EACzB,cACE,QAAQ,gBACRC,gBAAAA,qBAAqB;GACnB,UAAU,MAAM;GAChB,WAAW,YAAY,QAAQ,SAAS,OAAO;GAC/C,SAAS,YAAY;IACnB,QAAQ,SAAS,kBAAkB,SAAS;IAC5C,OAAY,QAAQ;GACtB;EACF,CAAC;EACH,cAAc,YAAY;GACxB,MAAM,aAAa,IAAIC,GAAAA,gBAAgB;IAAE,UAAU;IAAM,YAAY;GAAkB,CAAC;GACxF,MAAM,UAAA,GAASC,UAAAA,aAAAA,EAAc,UAAU,aAAa;IAClD,CAAM,YAAY;KAChB,MAAM,QAAQ,IAAI,gBAAgB;KAClC,MAAM,qBAA2B,MAAM,MAAM;KAC7C,SAAS,KAAK,WAAW,YAAY;KACrC,SAAS,KAAK,SAAS,YAAY;KACnC,IAAI;MACF,MAAM,MAAM,IAAI,IAAI,SAAS,OAAO,KAAK,UAAU,SAAS,QAAQ,QAAQ,aAAa;MACzF,MAAM,UAAU,IAAI,QAAQ;MAC5B,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,SAAS,OAAO,GACzD,IAAI,UAAU,KAAA,GAAW,QAAQ,IAAI,MAAM,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK;MAC5F,MAAM,OAAO,SAAS,WAAW,SAAS,SAAS,WAAW,SAAS,KAAA,IAAY,MAAM,SAAS,QAAQ;MAC1G,MAAM,UAAU,IAAI,QAAQ,KAAK;OAC/B,QAAQ,SAAS;OACjB;OACA,QAAQ,MAAM;OACd,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;MACvC,CAAC;MACD,MAAM,cAAc,UAAU,MAAM,IAAI,MAAM,SAAS;OAAE,UAAU;OAAU;MAAS,CAAC,CAAC;KAC1F,UAAU;MACR,SAAS,IAAI,WAAW,YAAY;MACpC,SAAS,IAAI,SAAS,YAAY;KACpC;IACF,EAAA,CAAG,CAAC,CAAC,OAAO,UAAmB;KAC7B,QAAQ,SAAS,0BAA0B,OAAO,KAAK,GAAG;KAC1D,IAAI,CAAC,SAAS,aAAa;MACzB,SAAS,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;MAC9D,SAAS,IAAI,KAAK,UAAU,EAAE,OAAO,6BAA6B,CAAC,CAAC;KACtE,OAAO,SAAS,QAAQ;IAC1B,CAAC;GACH,CAAC;GACD,OAAO,GAAG,YAAY,UAAU,QAAQ,SAAS;IAC/C,MAAM,MAAM,IAAI,IAAI,SAAS,OAAO,KAAK,UAAU,SAAS,QAAQ,QAAQ,aAAa;IACzF,MAAM,UAAUT,gBAAAA,cAAc;KAC5B,UAAU;KACV,QAAQ,SAAS,UAAU;KAC3B,WAAW;KACX,QAAQ,SAAS,QAAQ;KACzB,MAAM,SAAS,QAAQ;KACvB,OAAOC,gBAAAA,kBAAkB,CAAC;KAC1B,QAAQ,OAAO,aAAa;IAC9B,CAAC;IACD,MAAM,UAAU,IAAI,KACjB,SAAS,QAAQ,UAAU,GAAA,CAAI,MAAM,GAAG,CAAC,CAAC,KAAK,SAAS;KACvD,MAAM,KAAK,KAAK,QAAQ,GAAG;KAC3B,OAAO,CAAC,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7D,CAAC,CACH;IACA,MAAM,SAAS,OAAO,UAAU,QAAQ,IAAI,UAAUG,eAAAA,eAAe,CAAC;IAEtE,IAAIC,cAAAA,eAAe,IAAI,QAAQ,KAAK,YAAY,WAAW,WAAW,KAAA,GAAW;KAC/E,MAAM,SAASK,cAAAA,eAAe,IAAI,QAAQ;KAC1C,MAAM,SAAS,OAAO,SAAS,UAAU,SAAS,KAAK,OAAO,IAAI,IAAI,KAAA;KACtE,IAAI,OAAO,SAAS,WAAW,WAAW,KAAA,GAAW;MACnD,OAAO,MAAM,gCAAgC;MAC7C,OAAO,QAAQ;MACf;KACF;KACA,WAAW,cAAc,UAAU,QAAQ,OAAO,WAAW;MAC3D,MAAM,UAAU,OAAO,YAAY,SAAS,MAAM,WAAW,OAAO,MAAM,MAAM,MAAM,CAAC;MACvF,OAAO,KAAK,SAAS,OAAO;MAC5B,uBAAA,oBAAoB,QAAQ;OAC1B,MAAM,OAAO;OACb,cAAc,GAAG,OAAO,eAAe,IAAI;OAC3C,WAAW,SAAS,QAAQ;OAC5B,WAAW,YAAY,QAAQ,SAAS,OAAO;MACjD,CAAC;KACH,CAAC;KACD;IACF;IACA,MAAM,UAAU,WAAW,KAAA,IAAY,KAAA,IAAY,OAAO,WAAW,QAAQ,UAAU;IACvF,IAAI,CAACC,mBAAAA,kBAAkB,IAAI,QAAQ,KAAK,YAAY,WAAW,CAAC,UAAU,CAAC,SAAS;KAClF,OAAO,MAAM,gCAAgC;KAC7C,OAAO,QAAQ;KACf;IACF;IACA,WAAW,cAAc,UAAU,QAAQ,OAAO,WAAW;KAC3D,MAAM,UAAU,OAAO,YAAY,SAAS,MAAM,WAAW,OAAO,MAAM,MAAM,MAAM,CAAC;KACvF,MAAM,QAAQC,0BAAAA,eAAe;MAC3B,OAAO,SAAS;OACd,MAAM,SAAS,QAAQ,KAAK,OAAO,KAAK,IAAI,CAAC;OAC7C,IAAI,CAAC,OAAO,IAAI;QACd,MAAM,MAAM,aAAa;QACzB;OACF;OACA,OAAO,KAAK,OAAO,KAAK,KAAK,UAAU,OAAO,QAAQ,CAAC,CAAC;MAC1D;MACA,aAAa;OACX,QAAQ;OACR,OAAO,MAAM;MACf;KACF,CAAC;KACD,OAAO,GAAG,YAAY,QAAiB;MACrC,IAAI,CAAC,OAAO,mBAAmB,MAAM,GAAG;OACtC,MAAM,MAAM,gBAAgB;OAC5B;MACF;MACA,MAAM,QAAQ,MAAM,QAAQ,GAAG,IAAI,OAAO,OAAO,GAAG,IAAI,OAAO,KAAK,GAAa;MACjF,IAAI;MACJ,IAAI;OACF,WAAW,KAAK,MAAM,MAAM,SAAS,MAAM,CAAC;MAC9C,QAAQ;OACN,MAAM,MAAM,kBAAkB;OAC9B;MACF;MACA,MAAM,SAAS,QAAQ,KAAK,QAAQ;MACpC,IAAI,CAAC,OAAO,IAAI;OACd,MAAM,MAAM,kBAAkB;OAC9B;MACF;MACA,MAAM,QAAQ,OAAO,KAAK,OAAO,SAAS,CAAC,CAAC,SAAS,MAAM,CAAC;KAC9D,CAAC;KACD,OAAO,GAAG,eAAe,MAAM,MAAM,eAAe,CAAC;KACrD,OAAO,GAAG,eAAe,MAAM,MAAM,cAAc,CAAC;KACpD,IAAI;MACF,QAAQ,eAAe,IAAI,UAAU,MAAM,MAAM,MAAM;KACzD,SAAS,OAAO;MACd,QAAQ,SAAS,sCAAsC,OAAO,KAAK,GAAG;MACtE,MAAM,MAAM,sBAAsB;KACpC;IACF,CAAC;GACH,CAAC;GACD,OAAO,iBAAiB;GACxB,OAAO,iBAAiB;GACxB,OAAO,iBAAiB;GACxB,OAAO,uBAAuB;GAC9B,MAAM,IAAI,SAAe,SAAS,WAAW;IAC3C,OAAO,KAAK,SAAS,MAAM;IAC3B,OAAO,OAAO,GAAG,aAAa,OAAO;GACvC,CAAC;GACD,MAAM,UAAU,OAAO,QAAQ;GAC/B,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU,MAAM,IAAI,MAAM,yCAAyC;GACtG,OAAO;IACL,MAAM,QAAQ;IACd,OAAO,YAAY;KACjB,KAAK,MAAM,UAAU,WAAW,SAAS,OAAO,UAAU;KAC1D,WAAW,MAAM;KACjB,OAAO,oBAAoB;KAC3B,MAAM,IAAI,SAAe,SAAS,WAAW,OAAO,OAAO,UAAW,QAAQ,OAAO,KAAK,IAAI,QAAQ,CAAE,CAAC;IAC3G;GACF;EACF;EACA,mBAAmB,QAAQ,YAAY;EACvC,aAAa,WAAW,QAAQ,aAAa,MAAM;EACnD,WAAW,YAAY,QAAQ,SAAS,OAAO;CACjD,CAAC;CACD,qBAAA,qBAAqB,KAAwB;EAC3C;EACA,aAAa,YAAa,QAAQ,IAAyB;CAC7D,CAAC;CACD,uBAAA,uBAAuB,KAAwB;EAC7C,OAAO;EACP,aAAa,YAAa,QAAQ,IAAyB;EAG3D,qBAAqB;GACnB,OAAO,WAAW;GAClB,mBAAmB,KAAA,IAAY,KAAA,IAAY,OAAO,IAAI,IAAI,cAAc,CAAC,CAAC,IAAI;GAC9E,GAAI,QAAQ,gBAAgB,KAAK,CAAC;EACpC;EACA,WAAW,YAAY,QAAQ,SAAS,OAAO;CACjD,CAAC;CACD,IAAI,KAAK,wBAAwB,OAAO,YAAY;EAClD,IAAI,QAAQ,IAAI,aAAa,SAC3B,OAAO,QAAQ,KAAK,EAAE,OAAO,6CAA6C,GAAG,GAAG;EAClF,IAAI,QAAQ,IAAI,OAAO,uBAAuB,MAAM,QAAQ,mBAC1D,OAAO,QAAQ,KAAK,EAAE,OAAO,qDAAqD,GAAG,GAAG;EAC1F,IAAI;EACJ,IAAI;GACF,OAAO,MAAM,QAAQ,IAAI,KAAK;EAChC,QAAQ;GACN,OAAO,QAAQ,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;EAC1E;EACA,MAAM,SAAS,OAAO,SAAS,YAAY,SAAS,QAAQ,YAAY,OAAO,KAAK,SAAS,KAAA;EAC7F,IAAI,OAAO,WAAW,UAAU,OAAO,QAAQ,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;EACxG,IAAI;EACJ,IAAI;GACF,SAAS,IAAI,IAAI,MAAM;EACzB,QAAQ;GACN,OAAO,QAAQ,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;EAClE;EACA,IACE,OAAO,aAAa,WACpB,CAAC;GAAC;GAAa;GAAa;EAAO,CAAC,CAAC,SAAS,OAAO,QAAQ,KAC7D,OAAO,aAAa,OACpB,OAAO,WAAW,MAClB,OAAO,SAAS,MAChB,CAAC,OAAO,MAER,OAAO,QAAQ,KAAK,EAAE,OAAO,mDAAmD,GAAG,GAAG;EACxF,iBAAiB,OAAO;EACxB,OAAO,QAAQ,KAAK,EAAE,IAAI,KAAK,CAAC;CAClC,CAAC;CACD,IAAI,KAAKtB,eAAAA,mBAAmB,OAAO,YAAY;EAC7C,MAAM,SAAS,OAAO,WAAA,GAAUa,YAAAA,UAAAA,CAAU,SAASC,eAAAA,eAAe,MAAM,CAAC;EACzE,MAAM,UAAU,WAAW,KAAA,IAAY,KAAA,IAAY,OAAO,WAAW,QAAQ,MAAM;EACnF,IAAI,CAAC,UAAU,CAAC,SAAS,OAAO,QAAQ,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;EAClG,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,QAAQ,IAAI,KAAK;EACpC,QAAQ;GACN,OAAO,QAAQ,KAAK,EAAE,OAAO,6CAA6C,GAAG,GAAG;EAClF;EACA,MAAM,SAAS,QAAQ,KAAK,QAAQ;EACpC,IAAI,CAAC,OAAO,IAAI,OAAO,QAAQ,KAAK,EAAE,OAAO,mCAAmC,OAAO,QAAQ,GAAG,GAAG,GAAG;EACxG,IAAI;EACJ,IAAI;GACF,UAAU,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,SAAS,CAAC;EACjE,QAAQ;GACN,OAAO,QAAQ,KAAK,EAAE,OAAO,yCAAyC,GAAG,GAAG;EAC9E;EACA,MAAM,QAAQ,cAAc,OAAO;EACnC,MAAM,OAAO,YAAY,OAAO,IAAI;EACpC,IAAI,CAAC,SAAS,CAAC,MAAM,OAAO,QAAQ,KAAK,EAAE,OAAO,uCAAuC,GAAG,GAAG;EAC/F,MAAM,SAAS,IAAI,IAAI,MAAM,QAAQ,iBAAiB;EACtD,MAAM,UAAU,IAAI,QAAQ;EAC5B,KAAK,MAAM,CAAC,MAAM,UAAU,MAAM,SAAS;GACzC,MAAM,aAAa,KAAK,YAAY;GACpC,IAAI,kBAAkB,IAAI,UAAU,KAAK,WAAW,WAAW,MAAM,GAAG;GACxE,QAAQ,OAAO,MAAM,KAAK;EAC5B;EACA,MAAM,SAASS,gBAAAA,gBAAgB,MAAM,QAAQ,OAAO,QAAQ;EAC5D,MAAM,aAAa,OAAO,UAAU,MAAM,MAAM,eAAe,eAAe;EAC9E,MAAM,eAAe,WAAW,KAAA,KAAa,OAAO,eAAe,QAAQ,MAAM;EACjF,IAAI,eAAe;EACnB,IAAI,UAAU,cAAc;GAC1B,MAAM,YAAY,QAAQ,IAAIC,eAAAA,cAAc;GAC5C,IAAI;GACJ,IAAI;IACF,aAAa,YAAY,KAAK,MAAM,OAAO,KAAK,WAAW,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC,IAAI,KAAA;GAC9F,QAAQ;IACN,aAAa,KAAA;GACf;GACA,MAAM,WAAW;GACjB,IAAI,eAAe,cAEjB,eAAe,CAAC,OAAO,mBAAmB,QAAQ,QAAQ,UAAU,YAAY,UAAU,SAAS;QAC9F,IACL,OAAO,UAAU,eAAe,YAChC,CAAE,MAAM,OAAO,SAAS,CAAC,CAAC,aAAa,SAAS,YAAY,UAAU,UAAU,QAAQ,SAAS,QAAQ,GAEzG,eAAe;EACnB;EACA,QAAQ,OAAOA,eAAAA,cAAc;EAC7B,MAAM,eAAe,gBAAgB,CAAC,eAAe,aAAa;EAGlE,QAAQ,IAAI3B,mBAAAA,+BAA+B,QAAQ;EACnD,QAAQ,IAAIC,mBAAAA,gCAAgC,MAAM;EAClD,QAAQ,IAAIC,mBAAAA,8BAA8B,YAAY;EACtD,IAAI;EACJ,IAAI,cAAc;GAChB,MAAM,UAAU,eAAe,eAAe,2BAA2B;GACzE,WAAW,QAAQ,KAAK;IAAE,OAAO,6BAA6B,QAAQ;IAAI;IAAQ,MAAM;GAAW,GAAG,GAAG;EAC3G,OAAO,IAAI0B,yBAAAA,sBAAsB,OAAO,QAAQ,KAAK,CAACC,yBAAAA,uBAAuB,MAAM,QAAQ,OAAO,QAAQ,GACxG,WAAW,QAAQ,KAAK,EAAE,OAAO,wDAAwD,GAAG,GAAG;OAC1F;GACL,MAAM,WAAW,IAAI,QAAQ,QAAQ;IACnC,QAAQ,MAAM;IACd;IACA,GAAI,MAAM,WAAW,SAAS,MAAM,WAAW,SAAS,CAAC,IAAI,EAAE,KAAK;GACtE,CAAC;GACD,IAAI,OAAO,aAAa,iBAAiB,OAAO,SAAS,WAAW,cAAc,GAAG;IACnF,QAAQ,IAAI,UAAU,QAAQ,IAAI,OAAO,QAAQ,KAAK,EAAE;IACxD,QAAQ,IAAI,QAAQ,QAAQ,IAAI,OAAO,MAAM,KAAK,EAAE;IACpD,QAAQ,IAAI,UAAU,QAAQ,IAAI,OAAO,QAAQ,KAAK,EAAE;IACxD,WAAW,MAAM,IAAI,MAAM,IAAI,QAAQ,UAAU,EAAE,QAAQ,CAAC,GAAG;KAC7D,UAAU;KACV,gBAAgB;KAChB;IACF,CAAC;GACH,OAAO,WAAW,MAAM,QAAQ,QAAQ,QAAQ;EAClD;EACA,MAAM,eAAe,OAAO,KAAK,MAAM,SAAS,YAAY,CAAC;EAC7D,MAAM,SAAS,QAAQ,KACrB,IAAI,YAAY,CAAC,CAAC,OAChB,KAAK,UAAU;GACb,GAAG;GACH,QAAQ,SAAS;GACjB,SAAS,CAAC,GAAG,SAAS,QAAQ,QAAQ,CAAC;GACvC,MAAM,aAAa,SAAS,QAAQ;EACtC,CAAC,CACH,CACF;EACA,OAAO,OAAO,KACV,QAAQ,KAAK,OAAO,QAAQ,IAC5B,QAAQ,KAAK,EAAE,OAAO,+BAA+B,OAAO,QAAQ,GAAG,GAAG,GAAG;CACnF,CAAC;CACD,IAAI,GAAG,CAAC,QAAQ,QAAQ,GAAG,KAAK,OAAO,YAAY;EACjD,IACE,CAACjB,yBAAAA,wBAAwB,QAAQ,IAAI,QAAQ,QAAQ,IAAI,IAAI,KAC7D,EAAE,QAAQ,IAAI,WAAW,UAAU,QAAQ,IAAI,SAAS,6BACxD,EAAE,QAAQ,IAAI,WAAW,UAAU,kBAAkB,IAAI,QAAQ,IAAI,IAAI,IAEzE,OAAO,QAAQ,SAAS;EAC1B,OAAO,QAAQ,QAAQ,QAAQ,IAAI,GAAG;CACxC,CAAC;CACD,IAAI,GAAG,CAAC,OAAO,MAAM,GAAG,KAAK,OAAO,YAAY;EAE9C,IAAI,qBAAqB,QAAQ,IAAI,KAAK,QAAQ,IAAI,IAAI,GAAG;GAC3D,MAAM,QAAQ,qBAAqB,QAAQ,IAAI,KAAK,QAAQ,IAAI,IAAI;GACpE,OAAO,QAAQ,IAAI,aAAa,YAAY,UAAU,KAAA,IAClD,WAAW,MAAM,OAAO,QAAQ,IAAI,MAAM,IAC1C,QAAQ,KAAK,EAAE,OAAO,aAAa,GAAG,GAAG;EAC/C;EACA,IAAIA,yBAAAA,wBAAwB,QAAQ,IAAI,QAAQ,QAAQ,IAAI,IAAI,GAAG,OAAO,QAAQ,QAAQ,QAAQ,IAAI,GAAG;EACzG,IAAI,QAAQ,IAAI,KAAK,WAAW,OAAO,GAAG,OAAO,QAAQ,KAAK,EAAE,OAAO,aAAa,GAAG,GAAG;EAC1F,IAAI,QAAQ,IAAI,SAAS,OAAO,OAAO,WAAA,GAAUI,YAAAA,UAAAA,CAAU,SAAA,aAAwB,MAAM,CAAC,MAAM,KAAA,GAC9F,OAAO,QAAQ,SAAS,OAAO;EACjC,IAAI,QAAQ,IAAI,SAAS,2BAA2B,QAAQ,IAAI,KAAK,WAAW,iBAAiB,GAAG;GAClG,MAAM,OAAO,IAAI,IAAI,QAAQ,IAAI,GAAG;GACpC,OAAO,MAAM,QAAQ,QACnB,IAAI,QAAQ,IAAI,IAAI,GAAG,KAAK,WAAW,KAAK,UAAU,iBAAiB,GAAG,EACxE,QAAQ,QAAQ,IAAI,OACtB,CAAC,CACH;EACF;EACA,IAAI,CAAC,gBAAgB,OAAO,QAAQ,KAAK,EAAE,OAAO,8CAA8C,GAAG,GAAG;EACtG,MAAM,OAAO,IAAI,IAAI,QAAQ,IAAI,GAAG;EACpC,MAAM,SAAS,IAAI,IAAI,GAAG,KAAK,WAAW,KAAK,UAAU,cAAc;EACvE,MAAM,SAAS,MAAM,MAAM,QAAQ;GAAE,QAAQ,QAAQ,IAAI;GAAQ,UAAU;EAAS,CAAC;EACrF,MAAM,UAAU,IAAI,QAAQ,OAAO,OAAO;EAC1C,QAAQ,OAAO,YAAY;EAC3B,OAAO,IAAI,SAAS,OAAO,MAAM;GAAE,QAAQ,OAAO;GAAQ;EAAQ,CAAC;CACrE,CAAC;CAED,OAAO;EACL;EACA;EACA,YAAY,OAAO,YAAY,IAAI,MAAM,SAAS,EAAE,UAAU,QAAQ,CAAC;EACvE,OAAO,YAAY,OAAO,MAAM;CAClC;AACF"}

package/dist/remoteRuntime.d.mts

@@ -2,7 +2,7 @@ import { PublicFileShares } from "./src/services/publicFileShares/index.mjs";
 import { TunnelLauncher } from "./src/types/remote.mjs";
 import { RemoteAccess } from "./src/services/remoteAccess/index.mjs";
 import { DevProxySocketInput, relayDevProxySocket } from "./src/server/devProxySocket.mjs";
-import WebSocket$1 from "ws";
+import { Link } from "@earendil-works/chord";
 //#region src/server/remoteRuntime.d.ts
 export interface RemoteRuntimeOptions {
   homeDirectory: string;
@@ -16,7 +16,8 @@ export interface RemoteRuntimeOptions {
   onNotice(message: string): void;
   /** The listener to which a sealed, authenticated request is forwarded. */
   forward(request: Request): Promise<Response>;
-  connectProtocol(pathname: string, deviceId?: string): WebSocket$1;
+  /** Hands a paired device's relayed Chord link to the protocol host, as an upgrade at `pathname` would. */
+  acceptProtocol(pathname: string, link: Link, deviceId: string): boolean;
   onDeviceDropped?: (deviceId: string) => void;
   launchTunnel?: TunnelLauncher;
   /** Ports the host itself listens on, which a dev proxy target may never name. */

package/dist/remoteRuntime.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"remoteRuntime.d.mts","names":["WebSocket"],"sources":["../src/server/remoteRuntime.ts"],"mappings":";;;;;;iBAoHiB;EACf;EACA;EACA;IAAiB;IAAmB;;;EAEpC,cAAc;EACd,SAAS;;EAET,QAAQ,SAAS,UAAU,QAAQ;EACnC,gBAAgB,kBAAkB,oBAAoBA;EACtD,mBAAmB;EACnB,eAAe;;EAEf;;iBAGe;WACN,QAAQ;;WAER,YAAY;EACrB,WAAW,SAAS,UAAU,QAAQ;EACtC,SAAS;;;wBAyBK,oBAAoB,SAAS,uBAAuB"}
+{"version":3,"file":"remoteRuntime.d.mts","names":[],"sources":["../src/server/remoteRuntime.ts"],"mappings":";;;;;;iBAsHiB;EACf;EACA;EACA;IAAiB;IAAmB;;;EAEpC,cAAc;EACd,SAAS;;EAET,QAAQ,SAAS,UAAU,QAAQ;;EAEnC,eAAe,kBAAkB,MAAM,MAAM;EAC7C,mBAAmB;EACnB,eAAe;;EAEf;;iBAGe;WACN,QAAQ;;WAER,YAAY;EACrB,WAAW,SAAS,UAAU,QAAQ;EACtC,SAAS;;;wBAyBK,oBAAoB,SAAS,uBAAuB"}

package/dist/remoteRuntime.mjs

@@ -1,13 +1,17 @@
-import { DOOM_API_CALLER_DEVICE_ID_HEADER, DOOM_API_CALLER_LOCALITY_HEADER, DOOM_API_CALLER_STEP_UP_HEADER, parseDoomSocketPath } from "./src/schemas/packageApi.mjs";
+import { createTextLink } from "./src/schemas/protocolContracts.mjs";
+import { PO_API_CALLER_DEVICE_ID_HEADER, PO_API_CALLER_LOCALITY_HEADER, PO_API_CALLER_STEP_UP_HEADER, parsePoSocketPath } from "./src/schemas/packageApi.mjs";
 import { isPublicSessionMcpRoute, isSessionMcpHostRoute, isSessionMcpPhoneRoute } from "./src/server/sessionMcpRoutes.mjs";
 import { DEVICE_COOKIE, REMOTE_CHANNEL_ROUTE, REMOTE_HTTP_ROUTE, STEP_UP_HEADER } from "./src/constants/remote.mjs";
 import { isDevProxyPath, parseProxyPath } from "./src/services/devProxyPolicy/index.mjs";
-import { createDevProxyStore } from "./src/services/devProxyStore/index.mjs";
+import { createDevProxyStore } from "./src/services/devProxyStore/sync.mjs";
+import "./src/services/devProxyStore/index.mjs";
 import { PUBLIC_FILE_SHARE_PREFIX, createPublicFileShares } from "./src/services/publicFileShares/index.mjs";
 import { stepUpActionFor } from "./src/services/webauthnPolicy/index.mjs";
 import { isPublicPairingRoute, localOriginPolicy, originVerdict } from "./src/services/remoteGuardPolicy/index.mjs";
 import { createRemoteAccess } from "./src/services/remoteAccess/index.mjs";
-import { createRemoteAccessStore, defaultRemoteStateDir } from "./src/services/remoteAccessStore/index.mjs";
+import { defaultRemoteStateDir } from "./src/services/remoteAccessStore/remoteAccessRecords.mjs";
+import { createRemoteAccessStore } from "./src/services/remoteAccessStore/sync.mjs";
+import "./src/services/remoteAccessStore/index.mjs";
 import { createTunnelLauncher, reapStaleTunnel } from "./src/services/tunnelProcess/index.mjs";
 import { registerDevProxyRoutes } from "./src/server/devProxyRoutes.mjs";
 import { relayDevProxySocket } from "./src/server/devProxySocket.mjs";
@@ -15,7 +19,7 @@ import { registerRemoteRoutes } from "./src/server/remoteRoutes.mjs";
 import { createServer } from "node:http";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
-import WebSocket$1, { WebSocketServer } from "ws";
+import { WebSocketServer } from "ws";
 import { Hono } from "hono";
 import { getCookie } from "hono/cookie";
 //#region src/server/remoteRuntime.ts
@@ -52,9 +56,9 @@ const FORBIDDEN_HEADERS = /* @__PURE__ */ new Set([
 	"upgrade",
 	"x-po-token",
 	"x-po-desktop",
-	DOOM_API_CALLER_LOCALITY_HEADER,
-	DOOM_API_CALLER_DEVICE_ID_HEADER,
-	DOOM_API_CALLER_STEP_UP_HEADER,
+	PO_API_CALLER_LOCALITY_HEADER,
+	PO_API_CALLER_DEVICE_ID_HEADER,
+	PO_API_CALLER_STEP_UP_HEADER,
 	"x-forwarded-for",
 	"x-forwarded-host",
 	"x-forwarded-proto"
@@ -228,35 +232,30 @@ function createRemoteRuntime(options) {
 					return;
 				}
 				const channel = device === void 0 ? void 0 : remote.channelFor(device, "protocol");
-				if (!parseDoomSocketPath(url.pathname) || verdict !== "allow" || !device || !channel) {
+				if (!parsePoSocketPath(url.pathname) || verdict !== "allow" || !device || !channel) {
 					socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
 					socket.destroy();
 					return;
 				}
 				webSockets.handleUpgrade(incoming, socket, head, (client) => {
-					let upstream;
-					try {
-						upstream = options.connectProtocol(url.pathname, device);
-					} catch (error) {
-						options.onNotice(`remote protocol could not connect: ${String(error)}`);
-						client.close(1011, "protocol unavailable");
-						return;
-					}
-					const pending = [];
-					let pendingBytes = 0;
-					let closed = false;
 					const untrack = remote.trackSocket(device, (code, reason) => client.close(code, reason));
-					const close = () => {
-						if (closed) return;
-						closed = true;
-						untrack();
-						client.close();
-						upstream.close();
-					};
+					const relay = createTextLink({
+						send: (text) => {
+							const sealed = channel.seal(Buffer.from(text));
+							if (!sealed.ok) {
+								relay.ended("seal failed");
+								return;
+							}
+							client.send(Buffer.from(JSON.stringify(sealed.envelope)));
+						},
+						close: () => {
+							untrack();
+							client.close();
+						}
+					});
 					client.on("message", (raw) => {
-						if (closed) return;
 						if (!remote.isDeviceAuthorized(device)) {
-							close();
+							relay.ended("device revoked");
 							return;
 						}
 						const bytes = Array.isArray(raw) ? Buffer.concat(raw) : Buffer.from(raw);
@@ -264,44 +263,24 @@ function createRemoteRuntime(options) {
 						try {
 							envelope = JSON.parse(bytes.toString("utf8"));
 						} catch {
-							close();
+							relay.ended("invalid envelope");
 							return;
 						}
 						const opened = channel.open(envelope);
 						if (!opened.ok) {
-							close();
+							relay.ended("invalid envelope");
 							return;
 						}
-						const plain = Buffer.from(opened.plaintext);
-						if (upstream.readyState === WebSocket$1.OPEN) upstream.send(plain);
-						else {
-							pendingBytes += plain.byteLength;
-							if (pendingBytes > MAX_REQUEST_BYTES) close();
-							else pending.push(plain);
-						}
-					});
-					upstream.on("open", () => {
-						for (const bytes of pending) upstream.send(bytes);
-						pending.length = 0;
-						pendingBytes = 0;
-					});
-					upstream.on("message", (raw) => {
-						if (closed) return;
-						const plain = Array.isArray(raw) ? Buffer.concat(raw) : Buffer.from(raw);
-						const sealed = channel.seal(plain);
-						if (!sealed.ok) {
-							close();
-							return;
-						}
-						client.send(Buffer.from(JSON.stringify(sealed.envelope)));
-					});
-					client.on("close", close);
-					client.on("error", close);
-					upstream.on("close", close);
-					upstream.on("error", (error) => {
-						options.onNotice(`remote protocol failed: ${error.message}`);
-						close();
+						relay.deliver(Buffer.from(opened.plaintext).toString("utf8"));
 					});
+					client.on("close", () => relay.ended("client closed"));
+					client.on("error", () => relay.ended("client error"));
+					try {
+						options.acceptProtocol(url.pathname, relay.link, device);
+					} catch (error) {
+						options.onNotice(`remote protocol could not connect: ${String(error)}`);
+						relay.ended("protocol unavailable");
+					}
 				});
 			});
 			server.headersTimeout = TUNNEL_HEADERS_TIMEOUT_MS;
@@ -413,9 +392,9 @@ function createRemoteRuntime(options) {
 		}
 		headers.delete(STEP_UP_HEADER);
 		const sealedStepUp = stepUpNeeded && !stepUpDenied ? "verified" : "not-required";
-		headers.set(DOOM_API_CALLER_LOCALITY_HEADER, "remote");
-		headers.set(DOOM_API_CALLER_DEVICE_ID_HEADER, device);
-		headers.set(DOOM_API_CALLER_STEP_UP_HEADER, sealedStepUp);
+		headers.set(PO_API_CALLER_LOCALITY_HEADER, "remote");
+		headers.set(PO_API_CALLER_DEVICE_ID_HEADER, device);
+		headers.set(PO_API_CALLER_STEP_UP_HEADER, sealedStepUp);
 		let response;
 		if (stepUpDenied) {
 			const gesture = stepUpKind === "device-key" ? "biometric confirmation" : "passkey gesture";