@chances-ai/wire 24.0.0

package/dist/serve/relay.d.ts

@@ -0,0 +1,146 @@
+/**
+ * (v17 M0 / docs/6.1 §3.1) The `chances serve` relay — a THIN local HTTP/WS
+ * server projecting the engine onto web + mobile clients. The relay carries NO
+ * agent logic (auth, framing, replay, static serving only — all agent work
+ * stays in the engine via the `EngineHost` seam — projected onto the ACP wire by
+ * `AcpEngineDriver`/`AcpSessionHost` (M1 binding; `/rpc`→`/acp` hard cutover at M3).
+ *
+ * Runtime: the relay runs on a RUNTIME-PORTABLE stack — `node:http` for HTTP
+ * and the `ws` package for the WebSocket control channel. Both run identically
+ * under Node, Bun, and `bun --compile` binaries, so `chances serve` works from
+ * the npm `chances` (Node) bin as well as the compiled binary. (Earlier M0/M1
+ * used `Bun.serve`/`Bun.file`, which threw `Bun is not defined` under the Node
+ * entry — v18 fix.) The transport adapters in `ws-transport.ts` were already
+ * runtime-agnostic; only this file changed.
+ *
+ * The bind default is `127.0.0.1` and NEVER `0.0.0.0` (R1 N1 / §7): LAN exposure
+ * is an explicit, loud opt-in that lands together with auth in M3 — there is no
+ * auth yet, so binding the wider interface would be a footgun.
+ *
+ * Pure pieces (`resolveBindAddress`, `handleRequest`, `serveStatic`) stay
+ * `(Request) → Response`/`Promise<Response | null>`, so routing + static
+ * resolution are unit-tested without a real socket (§11 — no timing flakiness).
+ * `startRelay` bridges them onto `node:http` (`IncomingMessage` ⇆ `Request`,
+ * `Response` ⇆ `ServerResponse`).
+ *
+ * M2 (docs/6.2) wires the WS `/acp` control channel onto ONE persistent
+ * {@link AcpSessionHost} (built once when `control` is present), NOT a per-socket
+ * session. Each accepted socket *attaches* to that session — replaying the gap
+ * since its `Last-Event-ID` cursor (read from the `?last_event_id=N` query
+ * param), then joining the fan-out. The M1 single-controller `409` is GONE:
+ * every socket may drive, the engine serializes turns (`AGENT_BUSY`), and a
+ * half-dead socket is a harmless dead fan-out target (dropped on a guarded send)
+ * rather than a lockout. The relay still carries no agent logic of its own.
+ */
+import type { EngineHost } from "../rpc/index.js";
+/** Loopback — the only safe default before auth (M3). */
+export declare const LOOPBACK = "127.0.0.1";
+/** Default relay port. Arbitrary high port; overridable via `--port`. */
+export declare const DEFAULT_PORT = 4517;
+export interface BindOptions {
+    /** Listen port. Omitted ⇒ {@link DEFAULT_PORT}. */
+    port?: number;
+    /** (v21 M4) Listen interface. Omitted ⇒ {@link LOOPBACK}. A non-loopback host
+     *  REQUIRES `tls` + a pairing token (fail-closed in {@link startRelay}). */
+    host?: string;
+    /** (v21 M4) Self-signed TLS material (PEM). When present the relay serves
+     *  HTTPS/WSS; the CLI generates + caches it for a non-loopback bind. */
+    tls?: {
+        cert: string;
+        key: string;
+    };
+}
+export interface BindAddress {
+    hostname: string;
+    port: number;
+}
+/**
+ * Resolve the bind address. Defaults to {@link LOOPBACK} (unchanged); a
+ * non-loopback `host` is the v21 M4 opt-in for LAN exposure — {@link startRelay}
+ * then REQUIRES TLS + a pairing token (fail-closed), so a wider bind can never run
+ * unencrypted/unauthenticated.
+ */
+export declare function resolveBindAddress(opts?: BindOptions): BindAddress;
+/** Loopback aliases that need no TLS/auth — the trust boundary is the machine
+ *  itself (any local process is already you). */
+export declare function isLoopbackHost(host: string): boolean;
+export interface RelayDeps {
+    /** Agent version surfaced in `/health` + the ACP `initialize` agent info. */
+    version: string;
+}
+/**
+ * The relay's HTTP request handler. Routes only `GET /health`; the WS `/acp`
+ * upgrade is handled by `startRelay`'s `upgrade` listener (it needs the raw
+ * socket) and static SPA assets are tried before this fallback. Pure
+ * `(Request) → Response`, so routing is unit-testable without a socket.
+ */
+export declare function handleRequest(req: Request, deps: RelayDeps): Response;
+/**
+ * Serve a built SPA from `staticDir` (the web-ui `vite build` output): an exact
+ * file match, else the SPA `index.html` fallback for extension-less client
+ * routes (so a deep link / refresh still loads the app). Returns `null` when
+ * nothing matches, so the caller can fall through to {@link handleRequest}.
+ *
+ * Path traversal is rejected by resolving the candidate and requiring it to
+ * stay within `staticDir`. Async (file existence) but called only on the
+ * non-upgrade path, so it never blocks the WS handshake.
+ */
+export declare function serveStatic(req: Request, staticDir: string): Promise<Response | null>;
+export interface RelayHandle extends BindAddress {
+    /** `http://<hostname>:<port>` — the base URL the relay is listening on. */
+    url: string;
+    /** Gracefully shut the persistent session (cancel turn, deny pending, flush
+     *  the final frames to still-open sockets) THEN close sockets + the server +
+     *  release the port. Idempotent. Awaitable so the caller can let the engine
+     *  settle before the runtime is disposed (codex M2 SHOULD). */
+    stop(): Promise<void>;
+}
+/**
+ * Control-channel wiring for the WS `/acp` endpoint (M1; `/rpc`→`/acp` at M3).
+ * When present, the
+ * relay accepts a control socket and binds it to the engine via the `EngineHost`
+ * seam (projected onto ACP by `AcpEngineDriver`/`AcpSessionHost`). Omitted ⇒ a
+ * health-only relay (M0 behaviour).
+ */
+export interface RpcRelayDeps {
+    /** The engine seam. The relay wraps it with {@link perConnectionHost} so a
+     *  single socket close never tears down the shared runtime. */
+    host: EngineHost;
+    /** Surfaced in the ACP `initialize` agent info response. */
+    agent: {
+        name: string;
+        version: string;
+    };
+    /** Auto-approve every tool permission (trusted automation). Default false. */
+    autoApprove?: boolean;
+    /** stderr-style sink for routed `log` events + relay diagnostics. */
+    logSink?: (line: string) => void;
+    /** (v21 M4) Pairing token required on every WS `/acp` upgrade. When present, a
+     *  connect without / with a wrong token is rejected with `401` at the edge
+     *  (constant-time check, before the session). Undefined ⇒ loopback, no auth
+     *  (the trust boundary is the local machine) — backward-compatible. */
+    pairingToken?: string;
+    /** (v21 M4 §5) Enable the single-controller lease (default false ⇒ fan-out:
+     *  any paired device drives, the engine serializes turns via AGENT_BUSY). */
+    controllerLease?: boolean;
+}
+/**
+ * Start the relay on `node:http` + `ws`. Thin wrapper over {@link handleRequest}
+ * + {@link serveStatic} for HTTP routes; when `control` is supplied it also
+ * serves the WS `/acp` control channel (M1). `async` because `node:http`'s
+ * `listen` is asynchronous — the returned handle's `port`/`url` reflect the
+ * ACTUALLY-bound port (resolving `port: 0` → a random free port). Returns a
+ * handle the CLI keeps alive until SIGINT.
+ */
+export declare function startRelay(opts: BindOptions & RelayDeps & {
+    control?: RpcRelayDeps;
+    staticDir?: string;
+}): Promise<RelayHandle>;
+/** Parse a `--port <n>` flag out of a positional token list (CLI helper). Returns
+ *  undefined when absent or malformed (caller falls back to {@link DEFAULT_PORT}). */
+export declare function parsePortFlag(tokens: readonly string[]): number | undefined;
+/** Parse a `--host <addr>` flag (CLI helper, v21 M4). Returns undefined when
+ *  absent (caller stays on {@link LOOPBACK}); a value beginning with `-` is the
+ *  next flag, not an address, so it is rejected. */
+export declare function parseHostFlag(tokens: readonly string[]): string | undefined;
+//# sourceMappingURL=relay.d.ts.map

package/dist/serve/relay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay.d.ts","sourceRoot":"","sources":["../../src/serve/relay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AASH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAMlD,yDAAyD;AACzD,eAAO,MAAM,QAAQ,cAAc,CAAC;AACpC,yEAAyE;AACzE,eAAO,MAAM,YAAY,OAAO,CAAC;AAEjC,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;gFAC4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;4EACwE;IACxE,GAAG,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACrC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,WAAgB,GAAG,WAAW,CAKtE;AAED;iDACiD;AACjD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOpD;AAED,MAAM,WAAW,SAAS;IACxB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,QAAQ,CASrE;AA6BD;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAuB3F;AA0BD,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC9C,2EAA2E;IAC3E,GAAG,EAAE,MAAM,CAAC;IACZ;;;mEAG+D;IAC/D,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B;mEAC+D;IAC/D,IAAI,EAAE,UAAU,CAAC;IACjB,4DAA4D;IAC5D,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,8EAA8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qEAAqE;IACrE,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC;;;2EAGuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;iFAC6E;IAC7E,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAmFD;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,WAAW,GAAG,SAAS,GAAG;IAAE,OAAO,CAAC,EAAE,YAAY,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7E,OAAO,CAAC,WAAW,CAAC,CAwLtB;AAED;sFACsF;AACtF,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAO3E;AAED;;oDAEoD;AACpD,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAM3E"}

package/dist/serve/relay.js

@@ -0,0 +1,475 @@
+/**
+ * (v17 M0 / docs/6.1 §3.1) The `chances serve` relay — a THIN local HTTP/WS
+ * server projecting the engine onto web + mobile clients. The relay carries NO
+ * agent logic (auth, framing, replay, static serving only — all agent work
+ * stays in the engine via the `EngineHost` seam — projected onto the ACP wire by
+ * `AcpEngineDriver`/`AcpSessionHost` (M1 binding; `/rpc`→`/acp` hard cutover at M3).
+ *
+ * Runtime: the relay runs on a RUNTIME-PORTABLE stack — `node:http` for HTTP
+ * and the `ws` package for the WebSocket control channel. Both run identically
+ * under Node, Bun, and `bun --compile` binaries, so `chances serve` works from
+ * the npm `chances` (Node) bin as well as the compiled binary. (Earlier M0/M1
+ * used `Bun.serve`/`Bun.file`, which threw `Bun is not defined` under the Node
+ * entry — v18 fix.) The transport adapters in `ws-transport.ts` were already
+ * runtime-agnostic; only this file changed.
+ *
+ * The bind default is `127.0.0.1` and NEVER `0.0.0.0` (R1 N1 / §7): LAN exposure
+ * is an explicit, loud opt-in that lands together with auth in M3 — there is no
+ * auth yet, so binding the wider interface would be a footgun.
+ *
+ * Pure pieces (`resolveBindAddress`, `handleRequest`, `serveStatic`) stay
+ * `(Request) → Response`/`Promise<Response | null>`, so routing + static
+ * resolution are unit-tested without a real socket (§11 — no timing flakiness).
+ * `startRelay` bridges them onto `node:http` (`IncomingMessage` ⇆ `Request`,
+ * `Response` ⇆ `ServerResponse`).
+ *
+ * M2 (docs/6.2) wires the WS `/acp` control channel onto ONE persistent
+ * {@link AcpSessionHost} (built once when `control` is present), NOT a per-socket
+ * session. Each accepted socket *attaches* to that session — replaying the gap
+ * since its `Last-Event-ID` cursor (read from the `?last_event_id=N` query
+ * param), then joining the fan-out. The M1 single-controller `409` is GONE:
+ * every socket may drive, the engine serializes turns (`AGENT_BUSY`), and a
+ * half-dead socket is a harmless dead fan-out target (dropped on a guarded send)
+ * rather than a lockout. The relay still carries no agent logic of its own.
+ */
+import { createServer } from "node:http";
+import { createServer as createSecureServer } from "node:https";
+import { readFile, realpath, stat } from "node:fs/promises";
+import { extname, isAbsolute, join, relative, resolve } from "node:path";
+import { WebSocket, WebSocketServer } from "ws";
+import { perConnectionHost } from "./ws-transport.js";
+import { AcpSessionHost } from "./acp-session-host.js";
+import { parseClientId, parseLastEventId } from "./relay-frames.js";
+import { checkToken, extractToken } from "./auth.js";
+/** Loopback — the only safe default before auth (M3). */
+export const LOOPBACK = "127.0.0.1";
+/** Default relay port. Arbitrary high port; overridable via `--port`. */
+export const DEFAULT_PORT = 4517;
+/**
+ * Resolve the bind address. Defaults to {@link LOOPBACK} (unchanged); a
+ * non-loopback `host` is the v21 M4 opt-in for LAN exposure — {@link startRelay}
+ * then REQUIRES TLS + a pairing token (fail-closed), so a wider bind can never run
+ * unencrypted/unauthenticated.
+ */
+export function resolveBindAddress(opts = {}) {
+    return {
+        hostname: opts.host ?? LOOPBACK,
+        port: opts.port ?? DEFAULT_PORT,
+    };
+}
+/** Loopback aliases that need no TLS/auth — the trust boundary is the machine
+ *  itself (any local process is already you). */
+export function isLoopbackHost(host) {
+    if (host === "::1" || host === "localhost")
+        return true;
+    // The WHOLE 127.0.0.0/8 block is loopback (127.0.0.1 … 127.255.255.255), not
+    // just 127.0.0.1 — else 127.0.0.2 would be treated as an exposed bind and
+    // forced through TLS+token (codex M4-review SHOULD).
+    const m = /^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+    return m !== null && m.slice(1).every((o) => Number(o) <= 255);
+}
+/**
+ * The relay's HTTP request handler. Routes only `GET /health`; the WS `/acp`
+ * upgrade is handled by `startRelay`'s `upgrade` listener (it needs the raw
+ * socket) and static SPA assets are tried before this fallback. Pure
+ * `(Request) → Response`, so routing is unit-testable without a socket.
+ */
+export function handleRequest(req, deps) {
+    const url = new URL(req.url);
+    if (req.method === "GET" && url.pathname === "/health") {
+        return Response.json({ status: "ok", agent: "chances", version: deps.version });
+    }
+    // The WS `/acp` upgrade (web/desktop control channel) is intercepted in
+    // `startRelay`'s `upgrade` listener; static SPA assets are tried in the
+    // request listener before falling through here. Everything else is Not Found.
+    return new Response("Not Found", { status: 404 });
+}
+/** Extension → `Content-Type`. `Bun.file`/`new Response(file)` set this for us;
+ *  with `node:fs` we must map it ourselves. Unknown ⇒ a safe binary default. */
+const CONTENT_TYPES = {
+    ".html": "text/html; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".mjs": "text/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".json": "application/json; charset=utf-8",
+    ".map": "application/json; charset=utf-8",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".webp": "image/webp",
+    ".ico": "image/x-icon",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2",
+    ".ttf": "font/ttf",
+    ".wasm": "application/wasm",
+    ".txt": "text/plain; charset=utf-8",
+};
+function contentTypeFor(filePath) {
+    return CONTENT_TYPES[extname(filePath).toLowerCase()] ?? "application/octet-stream";
+}
+/**
+ * Serve a built SPA from `staticDir` (the web-ui `vite build` output): an exact
+ * file match, else the SPA `index.html` fallback for extension-less client
+ * routes (so a deep link / refresh still loads the app). Returns `null` when
+ * nothing matches, so the caller can fall through to {@link handleRequest}.
+ *
+ * Path traversal is rejected by resolving the candidate and requiring it to
+ * stay within `staticDir`. Async (file existence) but called only on the
+ * non-upgrade path, so it never blocks the WS handshake.
+ */
+export async function serveStatic(req, staticDir) {
+    if (req.method !== "GET" && req.method !== "HEAD")
+        return null;
+    const base = resolve(staticDir);
+    // The realpath of the root anchors the symlink-escape check below. If the
+    // staticDir itself doesn't exist, serve nothing.
+    const realBase = await realpath(base).catch(() => null);
+    if (realBase === null)
+        return null;
+    const pathname = new URL(req.url).pathname;
+    const candidate = pathname === "/" ? "index.html" : pathname.replace(/^\/+/, "");
+    const filePath = resolve(join(base, candidate));
+    // Lexical guard: reject anything resolving outside the root (`../../etc/...`).
+    if (!isWithin(base, filePath))
+        return null;
+    const direct = await servableFile(filePath, realBase);
+    if (direct)
+        return direct;
+    // SPA fallback: an extension-less route (client-side path) → index.html.
+    if (extname(pathname) === "") {
+        const index = await servableFile(join(base, "index.html"), realBase);
+        if (index)
+            return index;
+    }
+    return null;
+}
+/**
+ * Serve `filePath` only if it exists AND its REAL path stays within `realBase`
+ * — a symlink inside the static root that points outside it (codex R2 SHOULD-1)
+ * is rejected, which the lexical resolve check alone can't catch.
+ */
+async function servableFile(filePath, realBase) {
+    const st = await stat(filePath).catch(() => null);
+    if (!st || !st.isFile())
+        return null;
+    const real = await realpath(filePath).catch(() => null);
+    if (real === null || !isWithin(realBase, real))
+        return null;
+    const data = await readFile(filePath).catch(() => null);
+    if (data === null)
+        return null;
+    // `Uint8Array` body keeps the Response Web-API portable across Node/Bun.
+    return new Response(new Uint8Array(data), { headers: { "content-type": contentTypeFor(filePath) } });
+}
+/** Platform-correct containment: is `target` `base` itself or strictly inside it?
+ *  Uses `path.relative` (not a hardcoded `/` prefix, which breaks on Windows
+ *  back-slash paths — codex v17 holistic SHOULD-FIX). */
+function isWithin(base, target) {
+    const rel = relative(base, target);
+    return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}
+/** Reconstruct an absolute URL from a `node:http` request (its `url` is the
+ *  path+query only) by resolving `req.url` against the relay's OWN bound base.
+ *  The `Host` header is deliberately NOT trusted (codex v18 SHOULD-FIX) — only
+ *  the pathname/method are read downstream, and the relay is loopback-bound.
+ *  May throw on a malformed `req.url`; callers parse inside a guard. */
+function requestUrl(req, baseUrl) {
+    return new URL(req.url ?? "/", baseUrl).toString();
+}
+/** `node:http` headers → Web `Headers` so the pure handlers see one shape. */
+function toWebHeaders(headers) {
+    const out = new Headers();
+    for (const [key, value] of Object.entries(headers)) {
+        if (Array.isArray(value))
+            for (const v of value)
+                out.append(key, v);
+        else if (value !== undefined)
+            out.set(key, value);
+    }
+    return out;
+}
+/** Pipe a Web `Response` (from the pure handlers) onto a `node:http` response. */
+async function writeWebResponse(res, response) {
+    res.statusCode = response.status;
+    response.headers.forEach((value, key) => res.setHeader(key, value));
+    const body = Buffer.from(await response.arrayBuffer());
+    res.end(body);
+}
+/**
+ * Adapt a `ws` WebSocket to the {@link ServerSocket} tri-state `send` the
+ * {@link ReplayHub} fan-out uses: `>0` sent, `-1` enqueued-but-backpressured,
+ * `0` dropped/dead. `ws` has no `drain` event, so once buffered bytes cross the
+ * high-water mark we poll `bufferedAmount` and fire `onWritable` when it falls
+ * below the low-water mark — faithful backpressure without an unbounded in-memory
+ * `ws` send queue. At loopback (single user) this path is essentially never hit.
+ */
+function nodeServerSocket(ws, onWritable) {
+    const HIGH_WATER = 1 << 20; // 1 MiB queued ⇒ report backpressure
+    const LOW_WATER = 1 << 16; // drained below 64 KiB ⇒ resume writers
+    let pollTimer;
+    const stopPoll = () => {
+        if (pollTimer) {
+            clearInterval(pollTimer);
+            pollTimer = undefined;
+        }
+    };
+    return {
+        get bufferedAmount() {
+            return ws.bufferedAmount;
+        },
+        send(data) {
+            if (ws.readyState !== WebSocket.OPEN)
+                return 0;
+            try {
+                ws.send(data);
+            }
+            catch {
+                return 0; // socket closing mid-write — treat as dropped
+            }
+            if (ws.bufferedAmount >= HIGH_WATER) {
+                if (!pollTimer) {
+                    pollTimer = setInterval(() => {
+                        if (ws.readyState !== WebSocket.OPEN || ws.bufferedAmount <= LOW_WATER) {
+                            stopPoll();
+                            onWritable();
+                        }
+                    }, 10);
+                    pollTimer.unref?.();
+                }
+                return -1;
+            }
+            return 1;
+        },
+        close(code, reason) {
+            stopPoll();
+            try {
+                ws.close(code, reason);
+            }
+            catch {
+                /* already closing */
+            }
+        },
+    };
+}
+/**
+ * Start the relay on `node:http` + `ws`. Thin wrapper over {@link handleRequest}
+ * + {@link serveStatic} for HTTP routes; when `control` is supplied it also
+ * serves the WS `/acp` control channel (M1). `async` because `node:http`'s
+ * `listen` is asynchronous — the returned handle's `port`/`url` reflect the
+ * ACTUALLY-bound port (resolving `port: 0` → a random free port). Returns a
+ * handle the CLI keeps alive until SIGINT.
+ */
+export async function startRelay(opts) {
+    const { hostname, port } = resolveBindAddress(opts);
+    const control = opts.control;
+    const staticDir = opts.staticDir;
+    const tls = opts.tls;
+    // (v21 M4) Fail-closed: a non-loopback bind MUST be both encrypted (TLS) and
+    // authenticated (a pairing token), or the agent would be exposed to the LAN in
+    // cleartext with no auth. Refuse to start otherwise. Loopback is unchanged
+    // (plain HTTP, no token — the trust boundary is the local machine).
+    if (!isLoopbackHost(hostname)) {
+        if (!tls)
+            throw new Error(`serve: refusing to bind ${hostname} without TLS — a non-loopback bind requires a self-signed cert (loopback stays plain HTTP)`);
+        if (!control?.pairingToken)
+            throw new Error(`serve: refusing to bind ${hostname} without a pairing token — run \`chances serve --new-token\` first`);
+    }
+    const deps = { version: opts.version };
+    const scheme = tls ? "https" : "http";
+    // The relay's own base — `req.url` is resolved against this (never the Host
+    // header) when bridging requests onto the pure handlers.
+    const baseUrl = `${scheme}://${hostname}:${port}`;
+    const httpServer = tls
+        ? createSecureServer({ cert: tls.cert, key: tls.key }, (req, res) => {
+            void serveHttp(req, res);
+        })
+        : createServer((req, res) => {
+            void serveHttp(req, res);
+        });
+    async function serveHttp(req, res) {
+        try {
+            const request = new Request(requestUrl(req, baseUrl), {
+                method: req.method ?? "GET",
+                headers: toWebHeaders(req.headers),
+            });
+            const pathname = new URL(request.url).pathname;
+            // API routes win over the SPA: `serveStatic`'s extension-less index
+            // fallback would otherwise shadow `/health` (it has no extension).
+            if (pathname === "/health") {
+                await writeWebResponse(res, handleRequest(request, deps));
+                return;
+            }
+            // A non-upgrade hit on the control endpoint (a real upgrade goes to the
+            // `upgrade` listener, never here) — tell the caller to upgrade.
+            if (control && pathname === "/acp") {
+                await writeWebResponse(res, new Response("Expected a WebSocket upgrade", { status: 426 }));
+                return;
+            }
+            if (staticDir) {
+                const asset = await serveStatic(request, staticDir);
+                if (asset) {
+                    await writeWebResponse(res, asset);
+                    return;
+                }
+            }
+            await writeWebResponse(res, handleRequest(request, deps));
+        }
+        catch {
+            if (!res.headersSent) {
+                res.statusCode = 500;
+                res.end("Internal Server Error");
+            }
+        }
+    }
+    // ONE persistent session for the whole `serve` process (M2). Built once when
+    // a control host is present; sockets attach/detach over it. `perConnectionHost`
+    // makes the AcpEngineDriver's own `host.dispose()` a NO-OP so the runtime is
+    // torn down EXACTLY ONCE by `main()`'s `disposeRuntime` on exit (the session is
+    // persistent, so per-session dispose would double-tear-down the shared
+    // runtime). `AcpSessionHost.shutdown()` still ends the queue + runs the engine's
+    // graceful turn/permission shutdown.
+    let sessionHost;
+    // The WS control channel rides `noServer` mode: we own the `upgrade` event so
+    // we can validate the path before `ws` takes the socket.
+    let wss;
+    if (control) {
+        sessionHost = new AcpSessionHost({
+            host: perConnectionHost(control.host),
+            agent: control.agent,
+            ...(control.autoApprove !== undefined ? { autoApprove: control.autoApprove } : {}),
+            ...(control.logSink ? { logSink: control.logSink } : {}),
+            ...(control.controllerLease !== undefined ? { controllerLease: control.controllerLease } : {}),
+        });
+        const host = sessionHost;
+        wss = new WebSocketServer({ noServer: true });
+        wss.on("connection", (ws, req) => {
+            // Drain is dormant in M2 — the ReplayHub never parks the writer (the ring
+            // is the durable buffer), so `onWritable` is a no-op.
+            const socket = nodeServerSocket(ws, () => { });
+            // Cursor for the replay/reconnect: `?last_event_id=N` query param (a
+            // browser WebSocket cannot set headers), header fallback for non-browser.
+            const lastSeq = parseLastEventId(req.url ?? "/acp", req.headers);
+            const clientId = parseClientId(req.url ?? "/acp");
+            const attachment = host.attach(socket, lastSeq, clientId);
+            ws.on("message", (data, isBinary) => {
+                // The ACP wire is JSON-RPC NDJSON text; ignore binary frames (and empty
+                // text frames) rather than feeding them to the line parser (codex v18
+                // SHOULD-FIX — the prior `!isBinary || text` leaked binary frames in).
+                if (isBinary)
+                    return;
+                const text = Array.isArray(data) ? Buffer.concat(data).toString() : data.toString();
+                if (text)
+                    host.onMessage(text, clientId);
+            });
+            // Without an `error` listener, a transport/protocol error on the socket
+            // throws as an UNHANDLED EventEmitter error and crashes the relay (codex
+            // v18 MUST-FIX). Just DETACH — the session + any in-flight turn survive a
+            // socket drop (M2); a `close` event usually follows, and `detach` is
+            // idempotent.
+            ws.on("error", (err) => {
+                control.logSink?.(`relay: /acp socket error: ${err.message}\n`);
+                attachment.detach();
+            });
+            ws.on("close", () => attachment.detach());
+        });
+        httpServer.on("upgrade", (req, socket, head) => {
+            // Never let a malformed upgrade request throw OUT of this event handler
+            // (it would be an unhandled exception) — guard the URL parse and drop the
+            // socket on failure (codex v18 SHOULD-FIX).
+            let pathname;
+            try {
+                pathname = new URL(requestUrl(req, baseUrl)).pathname;
+            }
+            catch {
+                socket.destroy();
+                return;
+            }
+            if (pathname !== "/acp") {
+                socket.destroy();
+                return;
+            }
+            // (v21 M4) Pairing-token auth at the edge: when a token is configured (any
+            // non-loopback bind requires one — Stage 2), reject an absent/wrong token
+            // with a 401 BEFORE the upgrade, so it never reaches the session. Loopback
+            // runs with `pairingToken` undefined, so this is a no-op there.
+            if (control.pairingToken !== undefined && !checkToken(extractToken(req.url, req.headers, baseUrl), control.pairingToken)) {
+                socket.write("HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n");
+                socket.destroy();
+                return;
+            }
+            // No 409: every socket attaches + fans out (M2). A reconnecting or 2nd
+            // client just joins; the engine serializes turns via AGENT_BUSY.
+            wss.handleUpgrade(req, socket, head, (ws) => wss.emit("connection", ws, req));
+        });
+    }
+    await new Promise((resolveListen, rejectListen) => {
+        const onError = (err) => rejectListen(err);
+        httpServer.once("error", onError);
+        httpServer.listen(port, hostname, () => {
+            httpServer.removeListener("error", onError);
+            resolveListen();
+        });
+    });
+    const addr = httpServer.address();
+    const boundPort = addr && typeof addr === "object" ? addr.port : port;
+    return {
+        hostname,
+        port: boundPort,
+        url: `${scheme}://${hostname}:${boundPort}`,
+        stop: async () => {
+            // AWAIT the engine's graceful shutdown FIRST (end the persistent queue →
+            // cancel the turn, deny pending, flush the terminal `result` to the
+            // still-open sockets) so an in-flight browser-driven turn settles before
+            // the caller lets `main()`'s `disposeRuntime` tear the runtime down (codex
+            // M2 SHOULD — the prior fire-and-forget raced disposal). `host.dispose`
+            // inside this is a no-op via perConnectionHost, so the runtime is still
+            // disposed exactly once, by `main()`.
+            try {
+                await sessionHost?.shutdown();
+            }
+            catch {
+                /* best-effort — never block the socket/server close on it */
+            }
+            for (const client of wss?.clients ?? []) {
+                try {
+                    client.terminate();
+                }
+                catch {
+                    /* already gone */
+                }
+            }
+            wss?.close();
+            // Force-close lingering keep-alive sockets so the port frees promptly
+            // (node 18.2+; absent under some runtimes — guard with `?.`).
+            httpServer.closeAllConnections?.();
+            httpServer.close();
+        },
+    };
+}
+/** Parse a `--port <n>` flag out of a positional token list (CLI helper). Returns
+ *  undefined when absent or malformed (caller falls back to {@link DEFAULT_PORT}). */
+export function parsePortFlag(tokens) {
+    const i = tokens.indexOf("--port");
+    if (i < 0)
+        return undefined;
+    const raw = tokens[i + 1];
+    if (raw === undefined)
+        return undefined;
+    const n = Number.parseInt(raw, 10);
+    return Number.isInteger(n) && n > 0 && n < 65536 ? n : undefined;
+}
+/** Parse a `--host <addr>` flag (CLI helper, v21 M4). Returns undefined when
+ *  absent (caller stays on {@link LOOPBACK}); a value beginning with `-` is the
+ *  next flag, not an address, so it is rejected. */
+export function parseHostFlag(tokens) {
+    const i = tokens.indexOf("--host");
+    if (i < 0)
+        return undefined;
+    const raw = tokens[i + 1];
+    if (raw === undefined || raw.startsWith("-"))
+        return undefined;
+    return raw;
+}
+//# sourceMappingURL=relay.js.map

package/dist/serve/relay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay.js","sourceRoot":"","sources":["../../src/serve/relay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,YAAY,EAAoF,MAAM,WAAW,CAAC;AAC3H,OAAO,EAAE,YAAY,IAAI,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAgB,MAAM,IAAI,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAqB,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAErD,yDAAyD;AACzD,MAAM,CAAC,MAAM,QAAQ,GAAG,WAAW,CAAC;AACpC,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AAkBjC;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAoB,EAAE;IACvD,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,QAAQ;QAC/B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,YAAY;KAChC,CAAC;AACJ,CAAC;AAED;iDACiD;AACjD,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACxD,6EAA6E;IAC7E,0EAA0E;IAC1E,qDAAqD;IACrD,MAAM,CAAC,GAAG,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;AACjE,CAAC;AAOD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY,EAAE,IAAe;IACzD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,wEAAwE;IACxE,wEAAwE;IACxE,8EAA8E;IAC9E,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;gFACgF;AAChF,MAAM,aAAa,GAA2B;IAC5C,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,gCAAgC;IACvC,MAAM,EAAE,gCAAgC;IACxC,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,iCAAiC;IACzC,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,cAAc;IACtB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EAAE,2BAA2B;CACpC,CAAC;AAEF,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,0BAA0B,CAAC;AACtF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAY,EAAE,SAAiB;IAC/D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,0EAA0E;IAC1E,iDAAiD;IACjD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC3C,MAAM,SAAS,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IAChD,+EAA+E;IAC/E,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,yEAAyE;IACzE,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC;QACrE,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,QAAgB;IAC5D,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,yEAAyE;IACzE,OAAO,IAAI,QAAQ,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;AACvG,CAAC;AAED;;yDAEyD;AACzD,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAuCD;;;;wEAIwE;AACxE,SAAS,UAAU,CAAC,GAAoB,EAAE,OAAe;IACvD,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACrD,CAAC;AAED,8EAA8E;AAC9E,SAAS,YAAY,CAAC,OAA4B;IAChD,MAAM,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;aAC/D,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,gBAAgB,CAAC,GAAmB,EAAE,QAAkB;IACrE,GAAG,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACvD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,EAAa,EAAE,UAAsB;IAC7D,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,qCAAqC;IACjE,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,wCAAwC;IACnE,IAAI,SAAqD,CAAC;IAC1D,MAAM,QAAQ,GAAG,GAAS,EAAE;QAC1B,IAAI,SAAS,EAAE,CAAC;YACd,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,SAAS,GAAG,SAAS,CAAC;QACxB,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,IAAI,cAAc;YAChB,OAAO,EAAE,CAAC,cAAc,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,IAAY;YACf,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;gBAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,CAAC,CAAC,8CAA8C;YAC1D,CAAC;YACD,IAAI,EAAE,CAAC,cAAc,IAAI,UAAU,EAAE,CAAC;gBACpC,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;wBAC3B,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,cAAc,IAAI,SAAS,EAAE,CAAC;4BACvE,QAAQ,EAAE,CAAC;4BACX,UAAU,EAAE,CAAC;wBACf,CAAC;oBACH,CAAC,EAAE,EAAE,CAAC,CAAC;oBACP,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;gBACtB,CAAC;gBACD,OAAO,CAAC,CAAC,CAAC;YACZ,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,CAAC,IAAa,EAAE,MAAe;YAClC,QAAQ,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,qBAAqB;YACvB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAA8E;IAE9E,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,6EAA6E;IAC7E,+EAA+E;IAC/E,2EAA2E;IAC3E,oEAAoE;IACpE,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,4FAA4F,CAAC,CAAC;QAC3J,IAAI,CAAC,OAAO,EAAE,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,oEAAoE,CAAC,CAAC;IACvJ,CAAC;IACD,MAAM,IAAI,GAAc,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IACtC,4EAA4E;IAC5E,yDAAyD;IACzD,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;IAElD,MAAM,UAAU,GAAW,GAAG;QAC5B,CAAC,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAChE,KAAK,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC;QACJ,CAAC,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACxB,KAAK,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IAEP,KAAK,UAAU,SAAS,CAAC,GAAoB,EAAE,GAAmB;QAChE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE;gBACpD,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;gBAC3B,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;aACnC,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YAC/C,oEAAoE;YACpE,mEAAmE;YACnE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,wEAAwE;YACxE,gEAAgE;YAChE,IAAI,OAAO,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACnC,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC,8BAA8B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC3F,OAAO;YACT,CAAC;YACD,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;gBACpD,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBACnC,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,gFAAgF;IAChF,6EAA6E;IAC7E,gFAAgF;IAChF,uEAAuE;IACvE,iFAAiF;IACjF,qCAAqC;IACrC,IAAI,WAAuC,CAAC;IAC5C,8EAA8E;IAC9E,yDAAyD;IACzD,IAAI,GAAgC,CAAC;IACrC,IAAI,OAAO,EAAE,CAAC;QACZ,WAAW,GAAG,IAAI,cAAc,CAAC;YAC/B,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC;YACrC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/F,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC;QACzB,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAa,EAAE,GAAoB,EAAE,EAAE;YAC3D,0EAA0E;YAC1E,sDAAsD;YACtD,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC9C,qEAAqE;YACrE,0EAA0E;YAC1E,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,IAAI,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC;YAClD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC1D,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,QAAiB,EAAE,EAAE;gBACpD,wEAAwE;gBACxE,sEAAsE;gBACtE,uEAAuE;gBACvE,IAAI,QAAQ;oBAAE,OAAO;gBACrB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpF,IAAI,IAAI;oBAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;YACH,wEAAwE;YACxE,yEAAyE;YACzE,0EAA0E;YAC1E,qEAAqE;YACrE,cAAc;YACd,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;gBAC5B,OAAO,CAAC,OAAO,EAAE,CAAC,6BAA6B,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;gBAChE,UAAU,CAAC,MAAM,EAAE,CAAC;YACtB,CAAC,CAAC,CAAC;YACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAoB,EAAE,MAAc,EAAE,IAAY,EAAE,EAAE;YAC9E,wEAAwE;YACxE,0EAA0E;YAC1E,4CAA4C;YAC5C,IAAI,QAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACxB,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,2EAA2E;YAC3E,0EAA0E;YAC1E,2EAA2E;YAC3E,gEAAgE;YAChE,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBACzH,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;gBACvE,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,uEAAuE;YACvE,iEAAiE;YACjE,GAAI,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,GAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,OAAO,CAAO,CAAC,aAAa,EAAE,YAAY,EAAE,EAAE;QACtD,MAAM,OAAO,GAAG,CAAC,GAAU,EAAQ,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACxD,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE;YACrC,UAAU,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5C,aAAa,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACvF,OAAO;QACL,QAAQ;QACR,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,GAAG,MAAM,MAAM,QAAQ,IAAI,SAAS,EAAE;QAC3C,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,yEAAyE;YACzE,oEAAoE;YACpE,yEAAyE;YACzE,2EAA2E;YAC3E,wEAAwE;YACxE,wEAAwE;YACxE,sCAAsC;YACtC,IAAI,CAAC;gBACH,MAAM,WAAW,EAAE,QAAQ,EAAE,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;YAC/D,CAAC;YACD,KAAK,MAAM,MAAM,IAAI,GAAG,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;gBACxC,IAAI,CAAC;oBACH,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrB,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB;gBACpB,CAAC;YACH,CAAC;YACD,GAAG,EAAE,KAAK,EAAE,CAAC;YACb,sEAAsE;YACtE,8DAA8D;YAC7D,UAA4D,CAAC,mBAAmB,EAAE,EAAE,CAAC;YACtF,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;sFACsF;AACtF,MAAM,UAAU,aAAa,CAAC,MAAyB;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC;AAED;;oDAEoD;AACpD,MAAM,UAAU,aAAa,CAAC,MAAyB;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC"}