@hansjm10/volt-coding-agent 0.0.0-bootstrap.0 → 0.1.0

package/dist/core/remote/iroh/engine.js

@@ -0,0 +1,499 @@
+import { Buffer } from "node:buffer";
+import { randomBytes } from "node:crypto";
+import { cloneIrohRemoteRpcGrant, createIrohRemotePresetAccess } from "./access-grant.js";
+import { IrohRemoteAuditLogger } from "./audit.js";
+import { hashIrohRemotePairingSecret, } from "./authorization.js";
+import { assertIrohRemoteHandshakeHostIdentity, createIrohRemoteHandshakeFailure, createIrohRemoteHandshakeSuccess, IrohRemoteHandshakeError, parseIrohRemoteHandshakeResponseLine, parseIrohRemoteHelloLine, } from "./handshake.js";
+import { readIrohRemoteHandshakeLine, writeIrohRemoteHandshakeResponse, writeIrohRemoteHello, } from "./handshake-reader.js";
+import { createIrohRemoteHostMetadata } from "./metadata.js";
+import { DEFAULT_IROH_REMOTE_ALLOW_TOOLS, IROH_REMOTE_ALPN, IROH_REMOTE_HOST_FEATURES, normalizeIrohRemoteAllowTools, } from "./protocol.js";
+import { parseIrohRemoteWorkspace, } from "./state.js";
+import { assertIrohRemoteTicketNotExpired, decodeIrohRemoteTicketPayload, encodeIrohRemoteTicketPayload, } from "./ticket.js";
+import { findIrohRemoteWorkspace } from "./workspace.js";
+export const DEFAULT_IROH_REMOTE_PAIRING_TICKET_TTL_MS = 10 * 60 * 1000;
+function createConversationHandshakeMetadata(hello, conversationSession) {
+    if (hello.mode !== "conversation") {
+        throw new Error("conversation handshake metadata requires a conversation hello");
+    }
+    return {
+        target: hello.conversation.target,
+        sessionId: conversationSession.sessionId,
+        selection: conversationSession.selection,
+        ...(conversationSession.requestedSessionId === undefined
+            ? {}
+            : { requestedSessionId: conversationSession.requestedSessionId }),
+    };
+}
+function isEmptyIrohRemoteHostStateForRuntimePairingBootstrap(state) {
+    return (state.workspaces.length === 0 &&
+        state.clients.length === 0 &&
+        (state.revokedClients ?? []).length === 0 &&
+        (state.pendingPairingTickets ?? []).length === 0 &&
+        (state.pairingSecretTombstones ?? []).length === 0);
+}
+export class IrohRemoteHostEngine {
+    auditLogger;
+    classifyWorkspaceAvailability;
+    hostNodeId;
+    relayMode;
+    relayUrls;
+    now;
+    stateManager;
+    validateWorkspace;
+    workspace;
+    authorizationQueue = Promise.resolve();
+    allowTools;
+    rpcGrant;
+    pairingAllowTools;
+    pairingRpcGrant;
+    pairingExpiresAt;
+    pairingSecret;
+    pairingWorkspaceName;
+    constructor(options) {
+        const defaultAccess = createIrohRemotePresetAccess("coding");
+        this.allowTools = normalizeIrohRemoteAllowTools(options.allowTools ?? DEFAULT_IROH_REMOTE_ALLOW_TOOLS);
+        this.rpcGrant = cloneIrohRemoteRpcGrant(options.rpcGrant ?? defaultAccess.rpcGrant);
+        this.auditLogger = options.auditLogger ?? new IrohRemoteAuditLogger();
+        this.classifyWorkspaceAvailability = options.classifyWorkspaceAvailability;
+        this.hostNodeId = options.hostNodeId;
+        this.relayMode = options.relayMode;
+        this.relayUrls = options.relayUrls;
+        this.now = options.now ?? Date.now;
+        this.pairingExpiresAt = options.pairingExpiresAt;
+        this.pairingSecret = options.pairingSecret;
+        this.pairingWorkspaceName = options.pairingSecret === undefined ? undefined : options.workspace.name;
+        this.stateManager = options.stateManager;
+        this.validateWorkspace = options.validateWorkspace;
+        this.workspace = parseIrohRemoteWorkspace(options.workspace);
+    }
+    async pair(options) {
+        return this.runAuthorizationExclusive(async () => {
+            const requestedWorkspace = options.workspace ?? this.workspace.name;
+            const workspace = await this.resolvePairWorkspace(requestedWorkspace, options.workspace === undefined);
+            const secret = options.secret ?? randomBytes(24).toString("base64url");
+            const createdAt = this.now();
+            const expiresAt = options.expiresAt ?? createdAt + (options.ttlMs ?? DEFAULT_IROH_REMOTE_PAIRING_TICKET_TTL_MS);
+            const allowTools = normalizeIrohRemoteAllowTools(options.allowTools ?? workspace.allowedTools ?? this.allowTools);
+            const rpcGrant = cloneIrohRemoteRpcGrant(options.rpcGrant ?? this.rpcGrant);
+            this.pairingAllowTools = allowTools;
+            this.pairingRpcGrant = rpcGrant;
+            this.pairingSecret = secret;
+            this.pairingExpiresAt = expiresAt;
+            this.pairingWorkspaceName = workspace.name;
+            const pendingPairingTicket = await this.stateManager.addPendingPairingTicket({
+                secretHash: hashIrohRemotePairingSecret(secret),
+                workspace: workspace.name,
+                allowedTools: allowTools,
+                rpcGrant,
+                expiresAt,
+                createdAt,
+                ...(options.labelHint === undefined ? {} : { labelHint: options.labelHint }),
+            });
+            const payload = {
+                alpn: IROH_REMOTE_ALPN,
+                expiresAt,
+                irohTicket: options.irohTicket,
+                nodeId: options.nodeId,
+                relayMode: options.relayMode,
+                ...(options.relayUrls === undefined ? {} : { relayUrls: options.relayUrls }),
+                ...(options.relayAuthToken === undefined ? {} : { relayAuthToken: options.relayAuthToken }),
+                secret,
+                workspace: workspace.name,
+            };
+            const ticket = encodeIrohRemoteTicketPayload(payload);
+            await this.log({
+                type: "pairing_ticket_created",
+                workspace: payload.workspace,
+                details: {
+                    allowedTools: pendingPairingTicket.allowedTools,
+                    rpcGrant: pendingPairingTicket.rpcGrant,
+                    createdAt: pendingPairingTicket.createdAt,
+                    expiresAt: pendingPairingTicket.expiresAt,
+                    labelHint: pendingPairingTicket.labelHint,
+                    nodeId: options.nodeId,
+                    relayMode: options.relayMode,
+                },
+            });
+            return { expiresAt, payload, secret, ticket };
+        });
+    }
+    async listClients() {
+        const clients = await this.stateManager.listClients();
+        await this.log({ type: "clients_listed", details: { count: clients.length } });
+        return clients;
+    }
+    async revokeClient(nodeId) {
+        const result = await this.stateManager.revokeClient(nodeId, this.now());
+        await this.log({
+            type: "client_revoked",
+            clientNodeId: nodeId,
+            success: result.revoked,
+            error: result.revoked ? undefined : "client not found",
+        });
+        return result;
+    }
+    async updateClientAccess(nodeId, expectedRevision, access) {
+        const result = await this.stateManager.updateClientAccess(nodeId, expectedRevision, access);
+        await this.log({
+            type: "client_access_updated",
+            clientNodeId: nodeId,
+            success: result.ok,
+            error: result.ok ? undefined : result.reason,
+            details: result.ok
+                ? {
+                    expectedRevision,
+                    revision: result.client.rpcGrant.revision,
+                    allowedTools: result.client.allowedTools,
+                    rpcCapabilities: result.client.rpcGrant.capabilities,
+                }
+                : { expectedRevision, currentRevision: result.currentRevision },
+        });
+        return result;
+    }
+    async approveClientRePair(nodeId) {
+        const result = await this.stateManager.approveClientRePair(nodeId, this.now());
+        await this.log({
+            type: "client_repair_approved",
+            clientNodeId: nodeId,
+            success: result.approved,
+            error: result.approved ? undefined : "revoked client not found",
+        });
+        return result;
+    }
+    async setClientLastSessionId(nodeId, workspace, sessionId) {
+        return this.stateManager.setClientLastSessionId(nodeId, workspace, sessionId);
+    }
+    async authorizeHello(hello, remoteNodeId) {
+        return this.runAuthorizationExclusive(() => this.authorizeHelloUnlocked(hello, remoteNodeId));
+    }
+    async ensurePrimaryWorkspaceRegistered() {
+        const state = await this.stateManager.getState();
+        const workspace = findIrohRemoteWorkspace(state, this.workspace.name);
+        if (workspace) {
+            return workspace;
+        }
+        return await this.stateManager.upsertWorkspace(this.workspace);
+    }
+    async resolvePairWorkspace(workspaceName, registerPrimaryFallback) {
+        const workspace = registerPrimaryFallback && workspaceName === this.workspace.name
+            ? await this.ensurePrimaryWorkspaceRegistered()
+            : findIrohRemoteWorkspace(await this.stateManager.getState(), workspaceName);
+        if (!workspace) {
+            throw new Error(`workspace_unavailable: workspace not registered: ${workspaceName}`);
+        }
+        if (this.validateWorkspace !== undefined && !(await this.validateWorkspace(workspace))) {
+            throw new Error(`workspace_unavailable: workspace path is unavailable: ${workspaceName}`);
+        }
+        return workspace;
+    }
+    async authorizeHelloUnlocked(hello, remoteNodeId) {
+        await this.ensureRuntimePairingWorkspaceRegistered();
+        const allowTools = normalizeIrohRemoteAllowTools(this.pairingSecret !== undefined && hello.secret === this.pairingSecret
+            ? (this.pairingAllowTools ?? this.allowTools)
+            : this.allowTools);
+        const result = await this.stateManager.authorizeClient(hello, remoteNodeId, {
+            allowTools,
+            rpcGrant: this.pairingSecret !== undefined && hello.secret === this.pairingSecret
+                ? (this.pairingRpcGrant ?? this.rpcGrant)
+                : this.rpcGrant,
+            classifyWorkspaceAvailability: this.classifyWorkspaceAvailability,
+            now: this.now(),
+            pairingExpiresAt: this.pairingExpiresAt,
+            pairingSecret: this.pairingSecret,
+            validateWorkspace: this.validateWorkspace,
+        });
+        if (result.ok && result.pairingSecretConsumed) {
+            this.clearPairingSecret();
+        }
+        else if (!result.ok && result.pairingSecretExpired) {
+            this.clearPairingSecret();
+        }
+        await this.logPairingTicketLifecycle(result, remoteNodeId);
+        await this.logAuthorization(hello, remoteNodeId, result);
+        return result;
+    }
+    runAuthorizationExclusive(operation) {
+        const run = this.authorizationQueue.then(operation, operation);
+        this.authorizationQueue = run.then(() => undefined, () => undefined);
+        return run;
+    }
+    async readHandshake(stream, remoteNodeId, options = {}) {
+        let initialInput = Buffer.alloc(0);
+        try {
+            const handshake = await readIrohRemoteHandshakeLine(stream.recv, options);
+            initialInput = handshake.rest;
+            if (handshake.line === undefined) {
+                return await this.writeHandshakeResult(stream, await this.createHandshakeFailure("missing handshake", initialInput));
+            }
+            const hello = parseIrohRemoteHelloLine(handshake.line);
+            const authorization = await this.authorizeHello(hello, remoteNodeId);
+            if (!authorization.ok) {
+                return await this.writeHandshakeResult(stream, {
+                    ok: false,
+                    error: authorization.error,
+                    initialInput,
+                    response: createIrohRemoteHandshakeFailure(authorization.error, {
+                        hostNodeId: this.hostNodeId,
+                        outcome: authorization.outcome,
+                        workspace: authorization.workspace?.name,
+                    }),
+                    responseWritten: false,
+                });
+            }
+            const successResult = {
+                ok: true,
+                authorization,
+                hello,
+                initialInput,
+                response: this.createHandshakeSuccessResponse(hello, authorization, remoteNodeId, options),
+                responseWritten: false,
+            };
+            if (options.writeSuccessResponse === false) {
+                return successResult;
+            }
+            return await this.writeHandshakeResult(stream, successResult);
+        }
+        catch (error) {
+            return await this.writeHandshakeResult(stream, await this.createHandshakeFailure(error instanceof Error ? error.message : String(error), initialInput, error));
+        }
+    }
+    setAllowTools(allowTools) {
+        this.allowTools = normalizeIrohRemoteAllowTools(allowTools);
+    }
+    clearPairingSecretForWorkspace(workspaceName) {
+        if (this.pairingWorkspaceName !== workspaceName) {
+            return false;
+        }
+        this.clearPairingSecret();
+        return true;
+    }
+    async cancelPairingSecretByHash(secretHash) {
+        return this.runAuthorizationExclusive(async () => {
+            const liveSecretMatches = this.pairingSecret !== undefined && hashIrohRemotePairingSecret(this.pairingSecret) === secretHash;
+            if (liveSecretMatches)
+                this.clearPairingSecret();
+            const removedPendingTicket = await this.stateManager.removePendingPairingTicket(secretHash);
+            return liveSecretMatches || removedPendingTicket;
+        });
+    }
+    async ensureRuntimePairingWorkspaceRegistered() {
+        if (this.pairingSecret === undefined || this.pairingWorkspaceName !== this.workspace.name) {
+            return;
+        }
+        const state = await this.stateManager.getState();
+        if (findIrohRemoteWorkspace(state, this.workspace.name)) {
+            return;
+        }
+        if (isEmptyIrohRemoteHostStateForRuntimePairingBootstrap(state)) {
+            await this.stateManager.upsertWorkspace(this.workspace);
+            return;
+        }
+        this.clearPairingSecret();
+    }
+    clearPairingSecret() {
+        this.pairingAllowTools = undefined;
+        this.pairingRpcGrant = undefined;
+        this.pairingSecret = undefined;
+        this.pairingExpiresAt = undefined;
+        this.pairingWorkspaceName = undefined;
+    }
+    async createHandshakeFailure(error, initialInput, cause) {
+        const outcome = cause instanceof IrohRemoteHandshakeError ? cause.outcome : undefined;
+        await this.log({
+            type: "handshake_rejected",
+            workspace: this.workspace.name,
+            success: false,
+            error,
+            details: outcome === undefined ? undefined : { outcome },
+        });
+        return {
+            ok: false,
+            error,
+            initialInput,
+            response: createIrohRemoteHandshakeFailure(error, {
+                hostNodeId: this.hostNodeId,
+                ...(outcome === undefined ? {} : { outcome }),
+            }),
+            responseWritten: false,
+        };
+    }
+    createHandshakeSuccessResponse(hello, authorization, remoteNodeId, options) {
+        const common = {
+            child: options.child,
+            clientNodeId: remoteNodeId,
+            features: [...IROH_REMOTE_HOST_FEATURES],
+            hostNodeId: this.hostNodeId,
+            remoteHost: createIrohRemoteHostMetadata({
+                authorization,
+                hostNodeId: this.hostNodeId,
+                relayMode: this.relayMode,
+                relayUrls: this.relayUrls,
+                features: [...IROH_REMOTE_HOST_FEATURES],
+            }),
+            workspace: authorization.workspace.name,
+        };
+        if (hello.mode === "workspaceDiscovery") {
+            return createIrohRemoteHandshakeSuccess({
+                ...common,
+                workspaceDiscovery: { purpose: hello.workspaceDiscovery.purpose },
+            });
+        }
+        if (hello.mode === "workspaceManagement") {
+            return createIrohRemoteHandshakeSuccess({
+                ...common,
+                workspaceManagement: { purpose: hello.workspaceManagement.purpose },
+            });
+        }
+        if (options.conversationSession === undefined) {
+            if (options.writeSuccessResponse === false) {
+                return createIrohRemoteHandshakeSuccess(common);
+            }
+            throw new IrohRemoteHandshakeError("conversation_streams_unsupported", "conversation stream requires resolved session metadata");
+        }
+        return createIrohRemoteHandshakeSuccess({
+            ...common,
+            sessionId: options.conversationSession.sessionId,
+            conversation: createConversationHandshakeMetadata(hello, options.conversationSession),
+        });
+    }
+    async writeHandshakeResult(stream, result) {
+        try {
+            await writeIrohRemoteHandshakeResponse(stream.send, result.response);
+            return { ...result, responseWritten: true };
+        }
+        catch (error) {
+            // Authorization may already be committed; response write failures should not reclassify the result.
+            return {
+                ...result,
+                responseWritten: false,
+                responseWriteError: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+    async logPairingTicketLifecycle(result, remoteNodeId) {
+        for (const ticket of result.expiredPairingTickets ?? []) {
+            await this.log({
+                type: "pairing_ticket_expired",
+                workspace: ticket.workspace,
+                success: false,
+                details: {
+                    allowedTools: ticket.allowedTools,
+                    rpcGrant: ticket.rpcGrant,
+                    createdAt: ticket.createdAt,
+                    expiresAt: ticket.expiresAt,
+                },
+            });
+        }
+        if (!result.ok || !result.pairingSecretConsumed) {
+            return;
+        }
+        await this.log({
+            type: "pairing_ticket_consumed",
+            clientNodeId: remoteNodeId,
+            workspace: result.workspace.name,
+            success: true,
+            details: result.consumedPairingTicket
+                ? {
+                    allowedTools: result.consumedPairingTicket.allowedTools,
+                    rpcGrant: result.consumedPairingTicket.rpcGrant,
+                    createdAt: result.consumedPairingTicket.createdAt,
+                    expiresAt: result.consumedPairingTicket.expiresAt,
+                    labelHint: result.consumedPairingTicket.labelHint,
+                }
+                : undefined,
+        });
+    }
+    async logAuthorization(hello, remoteNodeId, result) {
+        await this.log({
+            type: result.ok ? "client_authorized" : "client_rejected",
+            clientNodeId: remoteNodeId,
+            workspace: hello.workspace,
+            success: result.ok,
+            error: result.ok ? undefined : result.error,
+            details: result.ok
+                ? { paired: result.paired }
+                : { outcome: result.outcome, pairingSecretExpired: result.pairingSecretExpired },
+        });
+    }
+    async log(event) {
+        try {
+            await this.auditLogger.log(event);
+        }
+        catch (error) {
+            // A valid handshake must not be reclassified as a failure when audit I/O
+            // fails, but a dropped security-relevant event must not vanish silently.
+            // Surface it to the daemon log (captured stderr) so the omission is visible.
+            console.error(`[iroh-remote] failed to write audit event ${event.type}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+}
+export class IrohRemoteClientEngine {
+    auditLogger;
+    clientLabel;
+    clientNodeId;
+    now;
+    constructor(options = {}) {
+        this.auditLogger = options.auditLogger ?? new IrohRemoteAuditLogger();
+        this.clientLabel = options.clientLabel;
+        this.clientNodeId = options.clientNodeId;
+        this.now = options.now ?? Date.now;
+    }
+    async createHelloFromTicket(ticket) {
+        const payload = decodeIrohRemoteTicketPayload(ticket);
+        assertIrohRemoteTicketNotExpired(payload, this.now());
+        const hello = this.createHello(payload);
+        await this.log({
+            type: "ticket_loaded",
+            workspace: payload.workspace,
+            details: { nodeId: payload.nodeId, relayMode: payload.relayMode },
+        });
+        return { hello, payload };
+    }
+    createHello(payload) {
+        return {
+            type: "volt_iroh_hello",
+            protocol: IROH_REMOTE_ALPN,
+            workspace: payload.workspace,
+            secret: payload.secret,
+            clientLabel: this.clientLabel,
+            clientNodeId: this.clientNodeId,
+            mode: "conversation",
+            conversation: { target: "last" },
+        };
+    }
+    async writeHello(stream, payload) {
+        const hello = this.createHello(payload);
+        await writeIrohRemoteHello(stream.send, hello);
+        await this.log({
+            type: "hello_sent",
+            workspace: payload.workspace,
+            details: { nodeId: payload.nodeId },
+        });
+        return hello;
+    }
+    async readHandshakeResponse(recv, options = {}) {
+        const handshake = await readIrohRemoteHandshakeLine(recv, options);
+        if (handshake.line === undefined) {
+            throw new Error("missing handshake response");
+        }
+        const response = parseIrohRemoteHandshakeResponseLine(handshake.line);
+        assertIrohRemoteHandshakeHostIdentity(response, options.expectedHostNodeId);
+        await this.log({
+            type: "handshake_response_received",
+            workspace: response.success ? response.workspace : undefined,
+            success: response.success,
+            error: response.success ? undefined : response.error,
+            details: response.success ? undefined : { outcome: response.outcome },
+        });
+        return { initialInput: handshake.rest, response };
+    }
+    async log(event) {
+        try {
+            await this.auditLogger.log(event);
+        }
+        catch {
+            // Client-side protocol progress should not fail after audit I/O fails.
+        }
+    }
+}
+//# sourceMappingURL=engine.js.map

package/dist/core/remote/iroh/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../../../src/core/remote/iroh/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,uBAAuB,EAAE,4BAA4B,EAA2B,MAAM,mBAAmB,CAAC;AACnH,OAAO,EAAkC,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnF,OAAO,EACN,2BAA2B,GAG3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,qCAAqC,EACrC,gCAAgC,EAChC,gCAAgC,EAGhC,wBAAwB,EAKxB,oCAAoC,EACpC,wBAAwB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEN,2BAA2B,EAC3B,gCAAgC,EAChC,oBAAoB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EACN,+BAA+B,EAC/B,gBAAgB,EAChB,yBAAyB,EAEzB,6BAA6B,GAC7B,MAAM,eAAe,CAAC;AACvB,OAAO,EAIN,wBAAwB,GACxB,MAAM,YAAY,CAAC;AAOpB,OAAO,EACN,gCAAgC,EAChC,6BAA6B,EAC7B,6BAA6B,GAE7B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,uBAAuB,EAAkD,MAAM,gBAAgB,CAAC;AAEzG,MAAM,CAAC,MAAM,yCAAyC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA0FxE,SAAS,mCAAmC,CAC3C,KAAsB,EACtB,mBAAmH,EACzE;IAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO;QACN,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM;QACjC,SAAS,EAAE,mBAAmB,CAAC,SAAS;QACxC,SAAS,EAAE,mBAAmB,CAAC,SAAS;QACxC,GAAG,CAAC,mBAAmB,CAAC,kBAAkB,KAAK,SAAS;YACvD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,kBAAkB,EAAE,CAAC;KAClE,CAAC;AAAA,CACF;AAED,SAAS,oDAAoD,CAAC,KAA0B,EAAW;IAClG,OAAO,CACN,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC7B,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAC1B,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;QACzC,CAAC,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;QAChD,CAAC,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAClD,CAAC;AAAA,CACF;AAED,MAAM,OAAO,oBAAoB;IACf,WAAW,CAAwB;IACnC,6BAA6B,CAAwD;IACrF,UAAU,CAAqB;IAC/B,SAAS,CAAkC;IAC3C,SAAS,CAAuB;IAChC,GAAG,CAAe;IAClB,YAAY,CAA6B;IACzC,iBAAiB,CAA+E;IAChG,SAAS,CAAsB;IACxC,kBAAkB,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IACtD,UAAU,CAAS;IACnB,QAAQ,CAAqB;IAC7B,iBAAiB,CAAqB;IACtC,eAAe,CAAiC;IAChD,gBAAgB,CAAqB;IACrC,aAAa,CAAqB;IAClC,oBAAoB,CAAqB;IAEjD,YAAY,OAAoC,EAAE;QACjD,MAAM,aAAa,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,GAAG,6BAA6B,CAAC,OAAO,CAAC,UAAU,IAAI,+BAA+B,CAAC,CAAC;QACvG,IAAI,CAAC,QAAQ,GAAG,uBAAuB,CAAC,OAAO,CAAC,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;QACpF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACtE,IAAI,CAAC,6BAA6B,GAAG,OAAO,CAAC,6BAA6B,CAAC;QAC3E,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC;QACrG,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAAA,CAC7D;IAED,KAAK,CAAC,IAAI,CAAC,OAAkC,EAAoC;QAChF,OAAO,IAAI,CAAC,yBAAyB,CAAC,KAAK,IAAI,EAAE,CAAC;YACjD,MAAM,kBAAkB,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YACpE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,EAAE,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;YAEvG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACvE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,SAAS,GACd,OAAO,CAAC,SAAS,IAAI,SAAS,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,yCAAyC,CAAC,CAAC;YAC/F,MAAM,UAAU,GAAG,6BAA6B,CAC/C,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,CAC/D,CAAC;YACF,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5E,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC;YAChC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;YAC5B,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;YAClC,IAAI,CAAC,oBAAoB,GAAG,SAAS,CAAC,IAAI,CAAC;YAC3C,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC;gBAC5E,UAAU,EAAE,2BAA2B,CAAC,MAAM,CAAC;gBAC/C,SAAS,EAAE,SAAS,CAAC,IAAI;gBACzB,YAAY,EAAE,UAAU;gBACxB,QAAQ;gBACR,SAAS;gBACT,SAAS;gBACT,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aAC5E,CAAC,CAAC;YAEH,MAAM,OAAO,GAA4B;gBACxC,IAAI,EAAE,gBAAgB;gBACtB,SAAS;gBACT,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC5E,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC3F,MAAM;gBACN,SAAS,EAAE,SAAS,CAAC,IAAI;aACzB,CAAC;YACF,MAAM,MAAM,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;YACtD,MAAM,IAAI,CAAC,GAAG,CAAC;gBACd,IAAI,EAAE,wBAAwB;gBAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE;oBACR,YAAY,EAAE,oBAAoB,CAAC,YAAY;oBAC/C,QAAQ,EAAE,oBAAoB,CAAC,QAAQ;oBACvC,SAAS,EAAE,oBAAoB,CAAC,SAAS;oBACzC,SAAS,EAAE,oBAAoB,CAAC,SAAS;oBACzC,SAAS,EAAE,oBAAoB,CAAC,SAAS;oBACzC,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;iBAC5B;aACD,CAAC,CAAC;YACH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAA,CAC9C,CAAC,CAAC;IAAA,CACH;IAED,KAAK,CAAC,WAAW,GAAgC;QAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;QACtD,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/E,OAAO,OAAO,CAAC;IAAA,CACf;IAED,KAAK,CAAC,YAAY,CAAC,MAAc,EAA6C;QAC7E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACxE,MAAM,IAAI,CAAC,GAAG,CAAC;YACd,IAAI,EAAE,gBAAgB;YACtB,YAAY,EAAE,MAAM;YACpB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB;SACtD,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAAA,CACd;IAED,KAAK,CAAC,kBAAkB,CACvB,MAAc,EACd,gBAAwB,EACxB,MAA8D,EAChB;QAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAC5F,MAAM,IAAI,CAAC,GAAG,CAAC;YACd,IAAI,EAAE,uBAAuB;YAC7B,YAAY,EAAE,MAAM;YACpB,OAAO,EAAE,MAAM,CAAC,EAAE;YAClB,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;YAC5C,OAAO,EAAE,MAAM,CAAC,EAAE;gBACjB,CAAC,CAAC;oBACA,gBAAgB;oBAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ;oBACzC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY;oBACxC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;iBACpD;gBACF,CAAC,CAAC,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE;SAChE,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAAA,CACd;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc,EAAiD;QACxF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/E,MAAM,IAAI,CAAC,GAAG,CAAC;YACd,IAAI,EAAE,wBAAwB;YAC9B,YAAY,EAAE,MAAM;YACpB,OAAO,EAAE,MAAM,CAAC,QAAQ;YACxB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B;SAC/D,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAAA,CACd;IAED,KAAK,CAAC,sBAAsB,CAC3B,MAAc,EACd,SAAiB,EACjB,SAAiB,EACuB;QACxC,OAAO,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAAA,CAC9E;IAED,KAAK,CAAC,cAAc,CAAC,KAAsB,EAAE,YAAoB,EAAgD;QAChH,OAAO,IAAI,CAAC,yBAAyB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;IAAA,CAC9F;IAEO,KAAK,CAAC,gCAAgC,GAAiC;QAC9E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAAA,CAC/D;IAEO,KAAK,CAAC,oBAAoB,CACjC,aAAqB,EACrB,uBAAgC,EACD;QAC/B,MAAM,SAAS,GACd,uBAAuB,IAAI,aAAa,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI;YAC/D,CAAC,CAAC,MAAM,IAAI,CAAC,gCAAgC,EAAE;YAC/C,CAAC,CAAC,uBAAuB,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,aAAa,CAAC,CAAC;QAC/E,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,oDAAoD,aAAa,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,yDAAyD,aAAa,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,SAAS,CAAC;IAAA,CACjB;IAEO,KAAK,CAAC,sBAAsB,CACnC,KAAsB,EACtB,YAAoB,EAC2B;QAC/C,MAAM,IAAI,CAAC,uCAAuC,EAAE,CAAC;QACrD,MAAM,UAAU,GAAG,6BAA6B,CAC/C,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,aAAa;YACtE,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,UAAU,CAAC;YAC7C,CAAC,CAAC,IAAI,CAAC,UAAU,CAClB,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,KAAK,EAAE,YAAY,EAAE;YAC3E,UAAU;YACV,QAAQ,EACP,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,aAAa;gBACtE,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,QAAQ,CAAC;gBACzC,CAAC,CAAC,IAAI,CAAC,QAAQ;YACjB,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;YACjE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;YACf,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SACzC,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;YAC/C,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC3B,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACtD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC;IAAA,CACd;IAEO,yBAAyB,CAAI,SAA2B,EAAc;QAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC/D,IAAI,CAAC,kBAAkB,GAAG,GAAG,CAAC,IAAI,CACjC,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CACf,CAAC;QACF,OAAO,GAAG,CAAC;IAAA,CACX;IAED,KAAK,CAAC,aAAa,CAClB,MAAwB,EACxB,YAAoB,EACpB,OAAO,GAAuC,EAAE,EACP;QACzC,IAAI,YAAY,GAAc,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1E,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC;YAC9B,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO,MAAM,IAAI,CAAC,oBAAoB,CACrC,MAAM,EACN,MAAM,IAAI,CAAC,sBAAsB,CAAC,mBAAmB,EAAE,YAAY,CAAC,CACpE,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAG,wBAAwB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YACrE,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;gBACvB,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE;oBAC9C,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,aAAa,CAAC,KAAK;oBAC1B,YAAY;oBACZ,QAAQ,EAAE,gCAAgC,CAAC,aAAa,CAAC,KAAK,EAAE;wBAC/D,UAAU,EAAE,IAAI,CAAC,UAAU;wBAC3B,OAAO,EAAE,aAAa,CAAC,OAAO;wBAC9B,SAAS,EAAE,aAAa,CAAC,SAAS,EAAE,IAAI;qBACxC,CAAC;oBACF,eAAe,EAAE,KAAK;iBACtB,CAAC,CAAC;YACJ,CAAC;YAED,MAAM,aAAa,GAAkC;gBACpD,EAAE,EAAE,IAAI;gBACR,aAAa;gBACb,KAAK;gBACL,YAAY;gBACZ,QAAQ,EAAE,IAAI,CAAC,8BAA8B,CAAC,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,CAAC;gBAC1F,eAAe,EAAE,KAAK;aACtB,CAAC;YACF,IAAI,OAAO,CAAC,oBAAoB,KAAK,KAAK,EAAE,CAAC;gBAC5C,OAAO,aAAa,CAAC;YACtB,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACzB,OAAO,MAAM,IAAI,CAAC,oBAAoB,CACrC,MAAM,EACN,MAAM,IAAI,CAAC,sBAAsB,CAChC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtD,YAAY,EACZ,KAAK,CACL,CACD,CAAC;QACH,CAAC;IAAA,CACD;IAED,aAAa,CAAC,UAAkB,EAAQ;QACvC,IAAI,CAAC,UAAU,GAAG,6BAA6B,CAAC,UAAU,CAAC,CAAC;IAAA,CAC5D;IAED,8BAA8B,CAAC,aAAqB,EAAW;QAC9D,IAAI,IAAI,CAAC,oBAAoB,KAAK,aAAa,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IAAA,CACZ;IAED,KAAK,CAAC,yBAAyB,CAAC,UAAkB,EAAoB;QACrE,OAAO,IAAI,CAAC,yBAAyB,CAAC,KAAK,IAAI,EAAE,CAAC;YACjD,MAAM,iBAAiB,GACtB,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,2BAA2B,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,UAAU,CAAC;YACpG,IAAI,iBAAiB;gBAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACjD,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC;YAC5F,OAAO,iBAAiB,IAAI,oBAAoB,CAAC;QAAA,CACjD,CAAC,CAAC;IAAA,CACH;IAEO,KAAK,CAAC,uCAAuC,GAAkB;QACtE,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,oBAAoB,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAC3F,OAAO;QACR,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QACjD,IAAI,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,OAAO;QACR,CAAC;QACD,IAAI,oDAAoD,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxD,OAAO;QACR,CAAC;QACD,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAAA,CAC1B;IAEO,kBAAkB,GAAS;QAClC,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACnC,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;QAC/B,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;QAClC,IAAI,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAAA,CACtC;IAEO,KAAK,CAAC,sBAAsB,CACnC,KAAa,EACb,YAAuB,EACvB,KAAe,EAC0B;QACzC,MAAM,OAAO,GAAG,KAAK,YAAY,wBAAwB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACtF,MAAM,IAAI,CAAC,GAAG,CAAC;YACd,IAAI,EAAE,oBAAoB;YAC1B,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI;YAC9B,OAAO,EAAE,KAAK;YACd,KAAK;YACL,OAAO,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE;SACxD,CAAC,CAAC;QACH,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK;YACL,YAAY;YACZ,QAAQ,EAAE,gCAAgC,CAAC,KAAK,EAAE;gBACjD,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;aAC7C,CAAC;YACF,eAAe,EAAE,KAAK;SACtB,CAAC;IAAA,CACF;IAEO,8BAA8B,CACrC,KAAsB,EACtB,aAAmD,EACnD,YAAoB,EACpB,OAA2C,EACd;QAC7B,MAAM,MAAM,GAAG;YACd,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,YAAY,EAAE,YAAY;YAC1B,QAAQ,EAAE,CAAC,GAAG,yBAAyB,CAAC;YACxC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU,EAAE,4BAA4B,CAAC;gBACxC,aAAa;gBACb,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,CAAC,GAAG,yBAAyB,CAAC;aACxC,CAAC;YACF,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC,IAAI;SACvC,CAAC;QACF,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACzC,OAAO,gCAAgC,CAAC;gBACvC,GAAG,MAAM;gBACT,kBAAkB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,kBAAkB,CAAC,OAAO,EAAE;aACjE,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;YAC1C,OAAO,gCAAgC,CAAC;gBACvC,GAAG,MAAM;gBACT,mBAAmB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,mBAAmB,CAAC,OAAO,EAAE;aACnE,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;YAC/C,IAAI,OAAO,CAAC,oBAAoB,KAAK,KAAK,EAAE,CAAC;gBAC5C,OAAO,gCAAgC,CAAC,MAAM,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,IAAI,wBAAwB,CACjC,kCAAkC,EAClC,wDAAwD,CACxD,CAAC;QACH,CAAC;QACD,OAAO,gCAAgC,CAAC;YACvC,GAAG,MAAM;YACT,SAAS,EAAE,OAAO,CAAC,mBAAmB,CAAC,SAAS;YAChD,YAAY,EAAE,mCAAmC,CAAC,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC;SACrF,CAAC,CAAC;IAAA,CACH;IAEO,KAAK,CAAC,oBAAoB,CACjC,MAAwB,EACxB,MAAqC,EACI;QACzC,IAAI,CAAC;YACJ,MAAM,gCAAgC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrE,OAAO,EAAE,GAAG,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,oGAAoG;YACpG,OAAO;gBACN,GAAG,MAAM;gBACT,eAAe,EAAE,KAAK;gBACtB,kBAAkB,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC1E,CAAC;QACH,CAAC;IAAA,CACD;IAEO,KAAK,CAAC,yBAAyB,CACtC,MAA2C,EAC3C,YAAoB,EACJ;QAChB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,qBAAqB,IAAI,EAAE,EAAE,CAAC;YACzD,MAAM,IAAI,CAAC,GAAG,CAAC;gBACd,IAAI,EAAE,wBAAwB;gBAC9B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE;oBACR,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC3B;aACD,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;YACjD,OAAO;QACR,CAAC;QACD,MAAM,IAAI,CAAC,GAAG,CAAC;YACd,IAAI,EAAE,yBAAyB;YAC/B,YAAY,EAAE,YAAY;YAC1B,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI;YAChC,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,MAAM,CAAC,qBAAqB;gBACpC,CAAC,CAAC;oBACA,YAAY,EAAE,MAAM,CAAC,qBAAqB,CAAC,YAAY;oBACvD,QAAQ,EAAE,MAAM,CAAC,qBAAqB,CAAC,QAAQ;oBAC/C,SAAS,EAAE,MAAM,CAAC,qBAAqB,CAAC,SAAS;oBACjD,SAAS,EAAE,MAAM,CAAC,qBAAqB,CAAC,SAAS;oBACjD,SAAS,EAAE,MAAM,CAAC,qBAAqB,CAAC,SAAS;iBACjD;gBACF,CAAC,CAAC,SAAS;SACZ,CAAC,CAAC;IAAA,CACH;IAEO,KAAK,CAAC,gBAAgB,CAC7B,KAAsB,EACtB,YAAoB,EACpB,MAA2C,EAC3B;QAChB,MAAM,IAAI,CAAC,GAAG,CAAC;YACd,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,iBAAiB;YACzD,YAAY,EAAE,YAAY;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,MAAM,CAAC,EAAE;YAClB,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK;YAC3C,OAAO,EAAE,MAAM,CAAC,EAAE;gBACjB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;gBAC3B,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE;SACjF,CAAC,CAAC;IAAA,CACH;IAEO,KAAK,CAAC,GAAG,CAAC,KAAgC,EAAiB;QAClE,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,yEAAyE;YACzE,yEAAyE;YACzE,6EAA6E;YAC7E,OAAO,CAAC,KAAK,CACZ,6CAA6C,KAAK,CAAC,IAAI,KACtD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACtD,EAAE,CACF,CAAC;QACH,CAAC;IAAA,CACD;CACD;AAED,MAAM,OAAO,sBAAsB;IACjB,WAAW,CAAwB;IACnC,WAAW,CAAqB;IAChC,YAAY,CAAqB;IACjC,GAAG,CAAe;IAEnC,YAAY,OAAO,GAAkC,EAAE,EAAE;QACxD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACtE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAAA,CACnC;IAED,KAAK,CAAC,qBAAqB,CAAC,MAAc,EAAwC;QACjF,MAAM,OAAO,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAC;QACtD,gCAAgC,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,GAAG,CAAC;YACd,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;SACjE,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAAA,CAC1B;IAED,WAAW,CAAC,OAAgC,EAAmB;QAC9D,OAAO;YACN,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,gBAAgB;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,cAAc;YACpB,YAAY,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;SAChC,CAAC;IAAA,CACF;IAED,KAAK,CAAC,UAAU,CAAC,MAAwB,EAAE,OAAgC,EAA4B;QACtG,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,GAAG,CAAC;YACd,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;SACnC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IAAA,CACb;IAED,KAAK,CAAC,qBAAqB,CAC1B,IAAwB,EACxB,OAAO,GAAiD,EAAE,EACP;QACnD,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnE,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,QAAQ,GAAG,oCAAoC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtE,qCAAqC,CAAC,QAAQ,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC5E,MAAM,IAAI,CAAC,GAAG,CAAC;YACd,IAAI,EAAE,6BAA6B;YACnC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YAC5D,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK;YACpD,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE;SACrE,CAAC,CAAC;QACH,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;IAAA,CAClD;IAEO,KAAK,CAAC,GAAG,CAAC,KAAgC,EAAiB;QAClE,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACR,uEAAuE;QACxE,CAAC;IAAA,CACD;CACD","sourcesContent":["import { Buffer } from \"node:buffer\";\nimport { randomBytes } from \"node:crypto\";\nimport type { IrohBiStreamLike, IrohBytes, IrohRecvStreamLike } from \"../../rpc/index.ts\";\nimport { cloneIrohRemoteRpcGrant, createIrohRemotePresetAccess, type IrohRemoteRpcGrant } from \"./access-grant.ts\";\nimport { type IrohRemoteAuditEventInput, IrohRemoteAuditLogger } from \"./audit.ts\";\nimport {\n\thashIrohRemotePairingSecret,\n\ttype IrohRemoteClientAuthorizationResult,\n\ttype IrohRemoteClientAuthorizationSuccess,\n} from \"./authorization.ts\";\nimport {\n\tassertIrohRemoteHandshakeHostIdentity,\n\tcreateIrohRemoteHandshakeFailure,\n\tcreateIrohRemoteHandshakeSuccess,\n\ttype IrohRemoteConversationHandshakeMetadata,\n\ttype IrohRemoteConversationSelection,\n\tIrohRemoteHandshakeError,\n\ttype IrohRemoteHandshakeFailure,\n\ttype IrohRemoteHandshakeResponse,\n\ttype IrohRemoteHandshakeSuccess,\n\ttype IrohRemoteHello,\n\tparseIrohRemoteHandshakeResponseLine,\n\tparseIrohRemoteHelloLine,\n} from \"./handshake.ts\";\nimport {\n\ttype IrohRemoteHandshakeLineReadOptions,\n\treadIrohRemoteHandshakeLine,\n\twriteIrohRemoteHandshakeResponse,\n\twriteIrohRemoteHello,\n} from \"./handshake-reader.ts\";\nimport { createIrohRemoteHostMetadata } from \"./metadata.ts\";\nimport {\n\tDEFAULT_IROH_REMOTE_ALLOW_TOOLS,\n\tIROH_REMOTE_ALPN,\n\tIROH_REMOTE_HOST_FEATURES,\n\ttype IrohRemoteRelayMode,\n\tnormalizeIrohRemoteAllowTools,\n} from \"./protocol.ts\";\nimport {\n\ttype IrohRemoteClient,\n\ttype IrohRemoteHostState,\n\ttype IrohRemoteWorkspace,\n\tparseIrohRemoteWorkspace,\n} from \"./state.ts\";\nimport type {\n\tIrohRemoteClientAccessUpdateResult,\n\tIrohRemoteClientRePairApprovalResult,\n\tIrohRemoteClientRevocationResult,\n\tIrohRemoteHostStateManager,\n} from \"./state-manager.ts\";\nimport {\n\tassertIrohRemoteTicketNotExpired,\n\tdecodeIrohRemoteTicketPayload,\n\tencodeIrohRemoteTicketPayload,\n\ttype IrohRemoteTicketPayload,\n} from \"./ticket.ts\";\nimport { findIrohRemoteWorkspace, type IrohRemoteWorkspaceAvailabilityClassifier } from \"./workspace.ts\";\n\nexport const DEFAULT_IROH_REMOTE_PAIRING_TICKET_TTL_MS = 10 * 60 * 1000;\n\nexport interface IrohRemoteHostEngineOptions {\n\tallowTools?: string;\n\trpcGrant?: IrohRemoteRpcGrant;\n\tauditLogger?: IrohRemoteAuditLogger;\n\thostNodeId?: string;\n\tnow?: () => number;\n\tpairingExpiresAt?: number;\n\tpairingSecret?: string;\n\trelayMode?: IrohRemoteRelayMode;\n\trelayUrls?: string[];\n\tstateManager: IrohRemoteHostStateManager;\n\tclassifyWorkspaceAvailability?: IrohRemoteWorkspaceAvailabilityClassifier;\n\tvalidateWorkspace?: (workspace: IrohRemoteWorkspace) => boolean | Promise<boolean>;\n\tworkspace: IrohRemoteWorkspace;\n}\n\nexport interface IrohRemoteHostPairOptions {\n\tallowTools?: string;\n\trpcGrant?: IrohRemoteRpcGrant;\n\texpiresAt?: number;\n\tirohTicket: string;\n\tlabelHint?: string;\n\tnodeId?: string;\n\trelayMode?: IrohRemoteRelayMode;\n\trelayUrls?: string[];\n\trelayAuthToken?: string;\n\tsecret?: string;\n\tttlMs?: number;\n\tworkspace?: string;\n}\n\nexport interface IrohRemotePairingTicket {\n\texpiresAt: number;\n\tpayload: IrohRemoteTicketPayload;\n\tsecret: string;\n\tticket: string;\n}\n\nexport type IrohRemoteHostHandshakeResult =\n\t| {\n\t\t\tok: true;\n\t\t\tauthorization: IrohRemoteClientAuthorizationSuccess;\n\t\t\thello: IrohRemoteHello;\n\t\t\tinitialInput: IrohBytes;\n\t\t\tresponse: IrohRemoteHandshakeSuccess;\n\t\t\tresponseWritten: boolean;\n\t\t\tresponseWriteError?: string;\n\t  }\n\t| {\n\t\t\tok: false;\n\t\t\terror: string;\n\t\t\tinitialInput: IrohBytes;\n\t\t\tresponse: IrohRemoteHandshakeFailure;\n\t\t\tresponseWritten: boolean;\n\t\t\tresponseWriteError?: string;\n\t  };\n\nexport interface IrohRemoteHostReadHandshakeOptions extends IrohRemoteHandshakeLineReadOptions {\n\tchild?: string;\n\tconversationSession?: {\n\t\tselection: IrohRemoteConversationSelection;\n\t\tsessionId: string;\n\t\trequestedSessionId?: string;\n\t};\n\twriteSuccessResponse?: boolean;\n}\n\nexport interface IrohRemoteClientEngineOptions {\n\tauditLogger?: IrohRemoteAuditLogger;\n\tclientLabel?: string;\n\tclientNodeId?: string;\n\tnow?: () => number;\n}\n\nexport interface IrohRemoteClientTicketHello {\n\thello: IrohRemoteHello;\n\tpayload: IrohRemoteTicketPayload;\n}\n\nexport interface IrohRemoteClientHandshakeResponseResult {\n\tinitialInput: IrohBytes;\n\tresponse: IrohRemoteHandshakeResponse;\n}\n\nexport interface IrohRemoteClientReadHandshakeResponseOptions extends IrohRemoteHandshakeLineReadOptions {\n\texpectedHostNodeId?: string;\n}\n\nfunction createConversationHandshakeMetadata(\n\thello: IrohRemoteHello,\n\tconversationSession: { selection: IrohRemoteConversationSelection; sessionId: string; requestedSessionId?: string },\n): IrohRemoteConversationHandshakeMetadata {\n\tif (hello.mode !== \"conversation\") {\n\t\tthrow new Error(\"conversation handshake metadata requires a conversation hello\");\n\t}\n\treturn {\n\t\ttarget: hello.conversation.target,\n\t\tsessionId: conversationSession.sessionId,\n\t\tselection: conversationSession.selection,\n\t\t...(conversationSession.requestedSessionId === undefined\n\t\t\t? {}\n\t\t\t: { requestedSessionId: conversationSession.requestedSessionId }),\n\t};\n}\n\nfunction isEmptyIrohRemoteHostStateForRuntimePairingBootstrap(state: IrohRemoteHostState): boolean {\n\treturn (\n\t\tstate.workspaces.length === 0 &&\n\t\tstate.clients.length === 0 &&\n\t\t(state.revokedClients ?? []).length === 0 &&\n\t\t(state.pendingPairingTickets ?? []).length === 0 &&\n\t\t(state.pairingSecretTombstones ?? []).length === 0\n\t);\n}\n\nexport class IrohRemoteHostEngine {\n\tprivate readonly auditLogger: IrohRemoteAuditLogger;\n\tprivate readonly classifyWorkspaceAvailability: IrohRemoteWorkspaceAvailabilityClassifier | undefined;\n\tprivate readonly hostNodeId: string | undefined;\n\tprivate readonly relayMode: IrohRemoteRelayMode | undefined;\n\tprivate readonly relayUrls: string[] | undefined;\n\tprivate readonly now: () => number;\n\tprivate readonly stateManager: IrohRemoteHostStateManager;\n\tprivate readonly validateWorkspace: ((workspace: IrohRemoteWorkspace) => boolean | Promise<boolean>) | undefined;\n\tprivate readonly workspace: IrohRemoteWorkspace;\n\tprivate authorizationQueue: Promise<void> = Promise.resolve();\n\tprivate allowTools: string;\n\tprivate rpcGrant: IrohRemoteRpcGrant;\n\tprivate pairingAllowTools: string | undefined;\n\tprivate pairingRpcGrant: IrohRemoteRpcGrant | undefined;\n\tprivate pairingExpiresAt: number | undefined;\n\tprivate pairingSecret: string | undefined;\n\tprivate pairingWorkspaceName: string | undefined;\n\n\tconstructor(options: IrohRemoteHostEngineOptions) {\n\t\tconst defaultAccess = createIrohRemotePresetAccess(\"coding\");\n\t\tthis.allowTools = normalizeIrohRemoteAllowTools(options.allowTools ?? DEFAULT_IROH_REMOTE_ALLOW_TOOLS);\n\t\tthis.rpcGrant = cloneIrohRemoteRpcGrant(options.rpcGrant ?? defaultAccess.rpcGrant);\n\t\tthis.auditLogger = options.auditLogger ?? new IrohRemoteAuditLogger();\n\t\tthis.classifyWorkspaceAvailability = options.classifyWorkspaceAvailability;\n\t\tthis.hostNodeId = options.hostNodeId;\n\t\tthis.relayMode = options.relayMode;\n\t\tthis.relayUrls = options.relayUrls;\n\t\tthis.now = options.now ?? Date.now;\n\t\tthis.pairingExpiresAt = options.pairingExpiresAt;\n\t\tthis.pairingSecret = options.pairingSecret;\n\t\tthis.pairingWorkspaceName = options.pairingSecret === undefined ? undefined : options.workspace.name;\n\t\tthis.stateManager = options.stateManager;\n\t\tthis.validateWorkspace = options.validateWorkspace;\n\t\tthis.workspace = parseIrohRemoteWorkspace(options.workspace);\n\t}\n\n\tasync pair(options: IrohRemoteHostPairOptions): Promise<IrohRemotePairingTicket> {\n\t\treturn this.runAuthorizationExclusive(async () => {\n\t\t\tconst requestedWorkspace = options.workspace ?? this.workspace.name;\n\t\t\tconst workspace = await this.resolvePairWorkspace(requestedWorkspace, options.workspace === undefined);\n\n\t\t\tconst secret = options.secret ?? randomBytes(24).toString(\"base64url\");\n\t\t\tconst createdAt = this.now();\n\t\t\tconst expiresAt =\n\t\t\t\toptions.expiresAt ?? createdAt + (options.ttlMs ?? DEFAULT_IROH_REMOTE_PAIRING_TICKET_TTL_MS);\n\t\t\tconst allowTools = normalizeIrohRemoteAllowTools(\n\t\t\t\toptions.allowTools ?? workspace.allowedTools ?? this.allowTools,\n\t\t\t);\n\t\t\tconst rpcGrant = cloneIrohRemoteRpcGrant(options.rpcGrant ?? this.rpcGrant);\n\t\t\tthis.pairingAllowTools = allowTools;\n\t\t\tthis.pairingRpcGrant = rpcGrant;\n\t\t\tthis.pairingSecret = secret;\n\t\t\tthis.pairingExpiresAt = expiresAt;\n\t\t\tthis.pairingWorkspaceName = workspace.name;\n\t\t\tconst pendingPairingTicket = await this.stateManager.addPendingPairingTicket({\n\t\t\t\tsecretHash: hashIrohRemotePairingSecret(secret),\n\t\t\t\tworkspace: workspace.name,\n\t\t\t\tallowedTools: allowTools,\n\t\t\t\trpcGrant,\n\t\t\t\texpiresAt,\n\t\t\t\tcreatedAt,\n\t\t\t\t...(options.labelHint === undefined ? {} : { labelHint: options.labelHint }),\n\t\t\t});\n\n\t\t\tconst payload: IrohRemoteTicketPayload = {\n\t\t\t\talpn: IROH_REMOTE_ALPN,\n\t\t\t\texpiresAt,\n\t\t\t\tirohTicket: options.irohTicket,\n\t\t\t\tnodeId: options.nodeId,\n\t\t\t\trelayMode: options.relayMode,\n\t\t\t\t...(options.relayUrls === undefined ? {} : { relayUrls: options.relayUrls }),\n\t\t\t\t...(options.relayAuthToken === undefined ? {} : { relayAuthToken: options.relayAuthToken }),\n\t\t\t\tsecret,\n\t\t\t\tworkspace: workspace.name,\n\t\t\t};\n\t\t\tconst ticket = encodeIrohRemoteTicketPayload(payload);\n\t\t\tawait this.log({\n\t\t\t\ttype: \"pairing_ticket_created\",\n\t\t\t\tworkspace: payload.workspace,\n\t\t\t\tdetails: {\n\t\t\t\t\tallowedTools: pendingPairingTicket.allowedTools,\n\t\t\t\t\trpcGrant: pendingPairingTicket.rpcGrant,\n\t\t\t\t\tcreatedAt: pendingPairingTicket.createdAt,\n\t\t\t\t\texpiresAt: pendingPairingTicket.expiresAt,\n\t\t\t\t\tlabelHint: pendingPairingTicket.labelHint,\n\t\t\t\t\tnodeId: options.nodeId,\n\t\t\t\t\trelayMode: options.relayMode,\n\t\t\t\t},\n\t\t\t});\n\t\t\treturn { expiresAt, payload, secret, ticket };\n\t\t});\n\t}\n\n\tasync listClients(): Promise<IrohRemoteClient[]> {\n\t\tconst clients = await this.stateManager.listClients();\n\t\tawait this.log({ type: \"clients_listed\", details: { count: clients.length } });\n\t\treturn clients;\n\t}\n\n\tasync revokeClient(nodeId: string): Promise<IrohRemoteClientRevocationResult> {\n\t\tconst result = await this.stateManager.revokeClient(nodeId, this.now());\n\t\tawait this.log({\n\t\t\ttype: \"client_revoked\",\n\t\t\tclientNodeId: nodeId,\n\t\t\tsuccess: result.revoked,\n\t\t\terror: result.revoked ? undefined : \"client not found\",\n\t\t});\n\t\treturn result;\n\t}\n\n\tasync updateClientAccess(\n\t\tnodeId: string,\n\t\texpectedRevision: number,\n\t\taccess: { allowedTools: string; rpcGrant: IrohRemoteRpcGrant },\n\t): Promise<IrohRemoteClientAccessUpdateResult> {\n\t\tconst result = await this.stateManager.updateClientAccess(nodeId, expectedRevision, access);\n\t\tawait this.log({\n\t\t\ttype: \"client_access_updated\",\n\t\t\tclientNodeId: nodeId,\n\t\t\tsuccess: result.ok,\n\t\t\terror: result.ok ? undefined : result.reason,\n\t\t\tdetails: result.ok\n\t\t\t\t? {\n\t\t\t\t\t\texpectedRevision,\n\t\t\t\t\t\trevision: result.client.rpcGrant.revision,\n\t\t\t\t\t\tallowedTools: result.client.allowedTools,\n\t\t\t\t\t\trpcCapabilities: result.client.rpcGrant.capabilities,\n\t\t\t\t\t}\n\t\t\t\t: { expectedRevision, currentRevision: result.currentRevision },\n\t\t});\n\t\treturn result;\n\t}\n\n\tasync approveClientRePair(nodeId: string): Promise<IrohRemoteClientRePairApprovalResult> {\n\t\tconst result = await this.stateManager.approveClientRePair(nodeId, this.now());\n\t\tawait this.log({\n\t\t\ttype: \"client_repair_approved\",\n\t\t\tclientNodeId: nodeId,\n\t\t\tsuccess: result.approved,\n\t\t\terror: result.approved ? undefined : \"revoked client not found\",\n\t\t});\n\t\treturn result;\n\t}\n\n\tasync setClientLastSessionId(\n\t\tnodeId: string,\n\t\tworkspace: string,\n\t\tsessionId: string,\n\t): Promise<IrohRemoteClient | undefined> {\n\t\treturn this.stateManager.setClientLastSessionId(nodeId, workspace, sessionId);\n\t}\n\n\tasync authorizeHello(hello: IrohRemoteHello, remoteNodeId: string): Promise<IrohRemoteClientAuthorizationResult> {\n\t\treturn this.runAuthorizationExclusive(() => this.authorizeHelloUnlocked(hello, remoteNodeId));\n\t}\n\n\tprivate async ensurePrimaryWorkspaceRegistered(): Promise<IrohRemoteWorkspace> {\n\t\tconst state = await this.stateManager.getState();\n\t\tconst workspace = findIrohRemoteWorkspace(state, this.workspace.name);\n\t\tif (workspace) {\n\t\t\treturn workspace;\n\t\t}\n\t\treturn await this.stateManager.upsertWorkspace(this.workspace);\n\t}\n\n\tprivate async resolvePairWorkspace(\n\t\tworkspaceName: string,\n\t\tregisterPrimaryFallback: boolean,\n\t): Promise<IrohRemoteWorkspace> {\n\t\tconst workspace =\n\t\t\tregisterPrimaryFallback && workspaceName === this.workspace.name\n\t\t\t\t? await this.ensurePrimaryWorkspaceRegistered()\n\t\t\t\t: findIrohRemoteWorkspace(await this.stateManager.getState(), workspaceName);\n\t\tif (!workspace) {\n\t\t\tthrow new Error(`workspace_unavailable: workspace not registered: ${workspaceName}`);\n\t\t}\n\t\tif (this.validateWorkspace !== undefined && !(await this.validateWorkspace(workspace))) {\n\t\t\tthrow new Error(`workspace_unavailable: workspace path is unavailable: ${workspaceName}`);\n\t\t}\n\t\treturn workspace;\n\t}\n\n\tprivate async authorizeHelloUnlocked(\n\t\thello: IrohRemoteHello,\n\t\tremoteNodeId: string,\n\t): Promise<IrohRemoteClientAuthorizationResult> {\n\t\tawait this.ensureRuntimePairingWorkspaceRegistered();\n\t\tconst allowTools = normalizeIrohRemoteAllowTools(\n\t\t\tthis.pairingSecret !== undefined && hello.secret === this.pairingSecret\n\t\t\t\t? (this.pairingAllowTools ?? this.allowTools)\n\t\t\t\t: this.allowTools,\n\t\t);\n\t\tconst result = await this.stateManager.authorizeClient(hello, remoteNodeId, {\n\t\t\tallowTools,\n\t\t\trpcGrant:\n\t\t\t\tthis.pairingSecret !== undefined && hello.secret === this.pairingSecret\n\t\t\t\t\t? (this.pairingRpcGrant ?? this.rpcGrant)\n\t\t\t\t\t: this.rpcGrant,\n\t\t\tclassifyWorkspaceAvailability: this.classifyWorkspaceAvailability,\n\t\t\tnow: this.now(),\n\t\t\tpairingExpiresAt: this.pairingExpiresAt,\n\t\t\tpairingSecret: this.pairingSecret,\n\t\t\tvalidateWorkspace: this.validateWorkspace,\n\t\t});\n\n\t\tif (result.ok && result.pairingSecretConsumed) {\n\t\t\tthis.clearPairingSecret();\n\t\t} else if (!result.ok && result.pairingSecretExpired) {\n\t\t\tthis.clearPairingSecret();\n\t\t}\n\n\t\tawait this.logPairingTicketLifecycle(result, remoteNodeId);\n\t\tawait this.logAuthorization(hello, remoteNodeId, result);\n\t\treturn result;\n\t}\n\n\tprivate runAuthorizationExclusive<T>(operation: () => Promise<T>): Promise<T> {\n\t\tconst run = this.authorizationQueue.then(operation, operation);\n\t\tthis.authorizationQueue = run.then(\n\t\t\t() => undefined,\n\t\t\t() => undefined,\n\t\t);\n\t\treturn run;\n\t}\n\n\tasync readHandshake(\n\t\tstream: IrohBiStreamLike,\n\t\tremoteNodeId: string,\n\t\toptions: IrohRemoteHostReadHandshakeOptions = {},\n\t): Promise<IrohRemoteHostHandshakeResult> {\n\t\tlet initialInput: IrohBytes = Buffer.alloc(0);\n\t\ttry {\n\t\t\tconst handshake = await readIrohRemoteHandshakeLine(stream.recv, options);\n\t\t\tinitialInput = handshake.rest;\n\t\t\tif (handshake.line === undefined) {\n\t\t\t\treturn await this.writeHandshakeResult(\n\t\t\t\t\tstream,\n\t\t\t\t\tawait this.createHandshakeFailure(\"missing handshake\", initialInput),\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst hello = parseIrohRemoteHelloLine(handshake.line);\n\t\t\tconst authorization = await this.authorizeHello(hello, remoteNodeId);\n\t\t\tif (!authorization.ok) {\n\t\t\t\treturn await this.writeHandshakeResult(stream, {\n\t\t\t\t\tok: false,\n\t\t\t\t\terror: authorization.error,\n\t\t\t\t\tinitialInput,\n\t\t\t\t\tresponse: createIrohRemoteHandshakeFailure(authorization.error, {\n\t\t\t\t\t\thostNodeId: this.hostNodeId,\n\t\t\t\t\t\toutcome: authorization.outcome,\n\t\t\t\t\t\tworkspace: authorization.workspace?.name,\n\t\t\t\t\t}),\n\t\t\t\t\tresponseWritten: false,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tconst successResult: IrohRemoteHostHandshakeResult = {\n\t\t\t\tok: true,\n\t\t\t\tauthorization,\n\t\t\t\thello,\n\t\t\t\tinitialInput,\n\t\t\t\tresponse: this.createHandshakeSuccessResponse(hello, authorization, remoteNodeId, options),\n\t\t\t\tresponseWritten: false,\n\t\t\t};\n\t\t\tif (options.writeSuccessResponse === false) {\n\t\t\t\treturn successResult;\n\t\t\t}\n\t\t\treturn await this.writeHandshakeResult(stream, successResult);\n\t\t} catch (error: unknown) {\n\t\t\treturn await this.writeHandshakeResult(\n\t\t\t\tstream,\n\t\t\t\tawait this.createHandshakeFailure(\n\t\t\t\t\terror instanceof Error ? error.message : String(error),\n\t\t\t\t\tinitialInput,\n\t\t\t\t\terror,\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t}\n\n\tsetAllowTools(allowTools: string): void {\n\t\tthis.allowTools = normalizeIrohRemoteAllowTools(allowTools);\n\t}\n\n\tclearPairingSecretForWorkspace(workspaceName: string): boolean {\n\t\tif (this.pairingWorkspaceName !== workspaceName) {\n\t\t\treturn false;\n\t\t}\n\t\tthis.clearPairingSecret();\n\t\treturn true;\n\t}\n\n\tasync cancelPairingSecretByHash(secretHash: string): Promise<boolean> {\n\t\treturn this.runAuthorizationExclusive(async () => {\n\t\t\tconst liveSecretMatches =\n\t\t\t\tthis.pairingSecret !== undefined && hashIrohRemotePairingSecret(this.pairingSecret) === secretHash;\n\t\t\tif (liveSecretMatches) this.clearPairingSecret();\n\t\t\tconst removedPendingTicket = await this.stateManager.removePendingPairingTicket(secretHash);\n\t\t\treturn liveSecretMatches || removedPendingTicket;\n\t\t});\n\t}\n\n\tprivate async ensureRuntimePairingWorkspaceRegistered(): Promise<void> {\n\t\tif (this.pairingSecret === undefined || this.pairingWorkspaceName !== this.workspace.name) {\n\t\t\treturn;\n\t\t}\n\t\tconst state = await this.stateManager.getState();\n\t\tif (findIrohRemoteWorkspace(state, this.workspace.name)) {\n\t\t\treturn;\n\t\t}\n\t\tif (isEmptyIrohRemoteHostStateForRuntimePairingBootstrap(state)) {\n\t\t\tawait this.stateManager.upsertWorkspace(this.workspace);\n\t\t\treturn;\n\t\t}\n\t\tthis.clearPairingSecret();\n\t}\n\n\tprivate clearPairingSecret(): void {\n\t\tthis.pairingAllowTools = undefined;\n\t\tthis.pairingRpcGrant = undefined;\n\t\tthis.pairingSecret = undefined;\n\t\tthis.pairingExpiresAt = undefined;\n\t\tthis.pairingWorkspaceName = undefined;\n\t}\n\n\tprivate async createHandshakeFailure(\n\t\terror: string,\n\t\tinitialInput: IrohBytes,\n\t\tcause?: unknown,\n\t): Promise<IrohRemoteHostHandshakeResult> {\n\t\tconst outcome = cause instanceof IrohRemoteHandshakeError ? cause.outcome : undefined;\n\t\tawait this.log({\n\t\t\ttype: \"handshake_rejected\",\n\t\t\tworkspace: this.workspace.name,\n\t\t\tsuccess: false,\n\t\t\terror,\n\t\t\tdetails: outcome === undefined ? undefined : { outcome },\n\t\t});\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror,\n\t\t\tinitialInput,\n\t\t\tresponse: createIrohRemoteHandshakeFailure(error, {\n\t\t\t\thostNodeId: this.hostNodeId,\n\t\t\t\t...(outcome === undefined ? {} : { outcome }),\n\t\t\t}),\n\t\t\tresponseWritten: false,\n\t\t};\n\t}\n\n\tprivate createHandshakeSuccessResponse(\n\t\thello: IrohRemoteHello,\n\t\tauthorization: IrohRemoteClientAuthorizationSuccess,\n\t\tremoteNodeId: string,\n\t\toptions: IrohRemoteHostReadHandshakeOptions,\n\t): IrohRemoteHandshakeSuccess {\n\t\tconst common = {\n\t\t\tchild: options.child,\n\t\t\tclientNodeId: remoteNodeId,\n\t\t\tfeatures: [...IROH_REMOTE_HOST_FEATURES],\n\t\t\thostNodeId: this.hostNodeId,\n\t\t\tremoteHost: createIrohRemoteHostMetadata({\n\t\t\t\tauthorization,\n\t\t\t\thostNodeId: this.hostNodeId,\n\t\t\t\trelayMode: this.relayMode,\n\t\t\t\trelayUrls: this.relayUrls,\n\t\t\t\tfeatures: [...IROH_REMOTE_HOST_FEATURES],\n\t\t\t}),\n\t\t\tworkspace: authorization.workspace.name,\n\t\t};\n\t\tif (hello.mode === \"workspaceDiscovery\") {\n\t\t\treturn createIrohRemoteHandshakeSuccess({\n\t\t\t\t...common,\n\t\t\t\tworkspaceDiscovery: { purpose: hello.workspaceDiscovery.purpose },\n\t\t\t});\n\t\t}\n\t\tif (hello.mode === \"workspaceManagement\") {\n\t\t\treturn createIrohRemoteHandshakeSuccess({\n\t\t\t\t...common,\n\t\t\t\tworkspaceManagement: { purpose: hello.workspaceManagement.purpose },\n\t\t\t});\n\t\t}\n\t\tif (options.conversationSession === undefined) {\n\t\t\tif (options.writeSuccessResponse === false) {\n\t\t\t\treturn createIrohRemoteHandshakeSuccess(common);\n\t\t\t}\n\t\t\tthrow new IrohRemoteHandshakeError(\n\t\t\t\t\"conversation_streams_unsupported\",\n\t\t\t\t\"conversation stream requires resolved session metadata\",\n\t\t\t);\n\t\t}\n\t\treturn createIrohRemoteHandshakeSuccess({\n\t\t\t...common,\n\t\t\tsessionId: options.conversationSession.sessionId,\n\t\t\tconversation: createConversationHandshakeMetadata(hello, options.conversationSession),\n\t\t});\n\t}\n\n\tprivate async writeHandshakeResult(\n\t\tstream: IrohBiStreamLike,\n\t\tresult: IrohRemoteHostHandshakeResult,\n\t): Promise<IrohRemoteHostHandshakeResult> {\n\t\ttry {\n\t\t\tawait writeIrohRemoteHandshakeResponse(stream.send, result.response);\n\t\t\treturn { ...result, responseWritten: true };\n\t\t} catch (error) {\n\t\t\t// Authorization may already be committed; response write failures should not reclassify the result.\n\t\t\treturn {\n\t\t\t\t...result,\n\t\t\t\tresponseWritten: false,\n\t\t\t\tresponseWriteError: error instanceof Error ? error.message : String(error),\n\t\t\t};\n\t\t}\n\t}\n\n\tprivate async logPairingTicketLifecycle(\n\t\tresult: IrohRemoteClientAuthorizationResult,\n\t\tremoteNodeId: string,\n\t): Promise<void> {\n\t\tfor (const ticket of result.expiredPairingTickets ?? []) {\n\t\t\tawait this.log({\n\t\t\t\ttype: \"pairing_ticket_expired\",\n\t\t\t\tworkspace: ticket.workspace,\n\t\t\t\tsuccess: false,\n\t\t\t\tdetails: {\n\t\t\t\t\tallowedTools: ticket.allowedTools,\n\t\t\t\t\trpcGrant: ticket.rpcGrant,\n\t\t\t\t\tcreatedAt: ticket.createdAt,\n\t\t\t\t\texpiresAt: ticket.expiresAt,\n\t\t\t\t},\n\t\t\t});\n\t\t}\n\t\tif (!result.ok || !result.pairingSecretConsumed) {\n\t\t\treturn;\n\t\t}\n\t\tawait this.log({\n\t\t\ttype: \"pairing_ticket_consumed\",\n\t\t\tclientNodeId: remoteNodeId,\n\t\t\tworkspace: result.workspace.name,\n\t\t\tsuccess: true,\n\t\t\tdetails: result.consumedPairingTicket\n\t\t\t\t? {\n\t\t\t\t\t\tallowedTools: result.consumedPairingTicket.allowedTools,\n\t\t\t\t\t\trpcGrant: result.consumedPairingTicket.rpcGrant,\n\t\t\t\t\t\tcreatedAt: result.consumedPairingTicket.createdAt,\n\t\t\t\t\t\texpiresAt: result.consumedPairingTicket.expiresAt,\n\t\t\t\t\t\tlabelHint: result.consumedPairingTicket.labelHint,\n\t\t\t\t\t}\n\t\t\t\t: undefined,\n\t\t});\n\t}\n\n\tprivate async logAuthorization(\n\t\thello: IrohRemoteHello,\n\t\tremoteNodeId: string,\n\t\tresult: IrohRemoteClientAuthorizationResult,\n\t): Promise<void> {\n\t\tawait this.log({\n\t\t\ttype: result.ok ? \"client_authorized\" : \"client_rejected\",\n\t\t\tclientNodeId: remoteNodeId,\n\t\t\tworkspace: hello.workspace,\n\t\t\tsuccess: result.ok,\n\t\t\terror: result.ok ? undefined : result.error,\n\t\t\tdetails: result.ok\n\t\t\t\t? { paired: result.paired }\n\t\t\t\t: { outcome: result.outcome, pairingSecretExpired: result.pairingSecretExpired },\n\t\t});\n\t}\n\n\tprivate async log(event: IrohRemoteAuditEventInput): Promise<void> {\n\t\ttry {\n\t\t\tawait this.auditLogger.log(event);\n\t\t} catch (error) {\n\t\t\t// A valid handshake must not be reclassified as a failure when audit I/O\n\t\t\t// fails, but a dropped security-relevant event must not vanish silently.\n\t\t\t// Surface it to the daemon log (captured stderr) so the omission is visible.\n\t\t\tconsole.error(\n\t\t\t\t`[iroh-remote] failed to write audit event ${event.type}: ${\n\t\t\t\t\terror instanceof Error ? error.message : String(error)\n\t\t\t\t}`,\n\t\t\t);\n\t\t}\n\t}\n}\n\nexport class IrohRemoteClientEngine {\n\tprivate readonly auditLogger: IrohRemoteAuditLogger;\n\tprivate readonly clientLabel: string | undefined;\n\tprivate readonly clientNodeId: string | undefined;\n\tprivate readonly now: () => number;\n\n\tconstructor(options: IrohRemoteClientEngineOptions = {}) {\n\t\tthis.auditLogger = options.auditLogger ?? new IrohRemoteAuditLogger();\n\t\tthis.clientLabel = options.clientLabel;\n\t\tthis.clientNodeId = options.clientNodeId;\n\t\tthis.now = options.now ?? Date.now;\n\t}\n\n\tasync createHelloFromTicket(ticket: string): Promise<IrohRemoteClientTicketHello> {\n\t\tconst payload = decodeIrohRemoteTicketPayload(ticket);\n\t\tassertIrohRemoteTicketNotExpired(payload, this.now());\n\t\tconst hello = this.createHello(payload);\n\t\tawait this.log({\n\t\t\ttype: \"ticket_loaded\",\n\t\t\tworkspace: payload.workspace,\n\t\t\tdetails: { nodeId: payload.nodeId, relayMode: payload.relayMode },\n\t\t});\n\t\treturn { hello, payload };\n\t}\n\n\tcreateHello(payload: IrohRemoteTicketPayload): IrohRemoteHello {\n\t\treturn {\n\t\t\ttype: \"volt_iroh_hello\",\n\t\t\tprotocol: IROH_REMOTE_ALPN,\n\t\t\tworkspace: payload.workspace,\n\t\t\tsecret: payload.secret,\n\t\t\tclientLabel: this.clientLabel,\n\t\t\tclientNodeId: this.clientNodeId,\n\t\t\tmode: \"conversation\",\n\t\t\tconversation: { target: \"last\" },\n\t\t};\n\t}\n\n\tasync writeHello(stream: IrohBiStreamLike, payload: IrohRemoteTicketPayload): Promise<IrohRemoteHello> {\n\t\tconst hello = this.createHello(payload);\n\t\tawait writeIrohRemoteHello(stream.send, hello);\n\t\tawait this.log({\n\t\t\ttype: \"hello_sent\",\n\t\t\tworkspace: payload.workspace,\n\t\t\tdetails: { nodeId: payload.nodeId },\n\t\t});\n\t\treturn hello;\n\t}\n\n\tasync readHandshakeResponse(\n\t\trecv: IrohRecvStreamLike,\n\t\toptions: IrohRemoteClientReadHandshakeResponseOptions = {},\n\t): Promise<IrohRemoteClientHandshakeResponseResult> {\n\t\tconst handshake = await readIrohRemoteHandshakeLine(recv, options);\n\t\tif (handshake.line === undefined) {\n\t\t\tthrow new Error(\"missing handshake response\");\n\t\t}\n\t\tconst response = parseIrohRemoteHandshakeResponseLine(handshake.line);\n\t\tassertIrohRemoteHandshakeHostIdentity(response, options.expectedHostNodeId);\n\t\tawait this.log({\n\t\t\ttype: \"handshake_response_received\",\n\t\t\tworkspace: response.success ? response.workspace : undefined,\n\t\t\tsuccess: response.success,\n\t\t\terror: response.success ? undefined : response.error,\n\t\t\tdetails: response.success ? undefined : { outcome: response.outcome },\n\t\t});\n\t\treturn { initialInput: handshake.rest, response };\n\t}\n\n\tprivate async log(event: IrohRemoteAuditEventInput): Promise<void> {\n\t\ttry {\n\t\t\tawait this.auditLogger.log(event);\n\t\t} catch {\n\t\t\t// Client-side protocol progress should not fail after audit I/O fails.\n\t\t}\n\t}\n}\n"]}

package/dist/core/remote/iroh/handshake-reader.d.ts

@@ -0,0 +1,19 @@
+import { type IrohBytes, type IrohRecvStreamLike, type IrohSendStreamLike } from "../../rpc/index.ts";
+import type { IrohRemoteHandshakeResponse, IrohRemoteHello } from "./handshake.ts";
+export declare const DEFAULT_IROH_REMOTE_HANDSHAKE_MAX_LINE_BYTES: number;
+export declare const DEFAULT_IROH_REMOTE_HANDSHAKE_TIMEOUT_MS = 15000;
+export interface IrohRemoteHandshakeLineReadOptions {
+    initialInput?: IrohBytes;
+    maxLineBytes?: number;
+    readLimit?: number;
+    timeoutStopErrorCode?: bigint;
+    timeoutMs?: number;
+}
+export interface IrohRemoteHandshakeLineReadResult {
+    line: string | undefined;
+    rest: IrohBytes;
+}
+export declare function readIrohRemoteHandshakeLine(recv: IrohRecvStreamLike, options?: IrohRemoteHandshakeLineReadOptions): Promise<IrohRemoteHandshakeLineReadResult>;
+export declare function writeIrohRemoteHello(send: IrohSendStreamLike, hello: IrohRemoteHello): Promise<void>;
+export declare function writeIrohRemoteHandshakeResponse(send: IrohSendStreamLike, response: IrohRemoteHandshakeResponse): Promise<void>;
+//# sourceMappingURL=handshake-reader.d.ts.map

package/dist/core/remote/iroh/handshake-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handshake-reader.d.ts","sourceRoot":"","sources":["../../../../src/core/remote/iroh/handshake-reader.ts"],"names":[],"mappings":"AACA,OAAO,EAEN,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EAEvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEnF,eAAO,MAAM,4CAA4C,QAAY,CAAC;AACtE,eAAO,MAAM,wCAAwC,QAAS,CAAC;AAE/D,MAAM,WAAW,kCAAkC;IAClD,YAAY,CAAC,EAAE,SAAS,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iCAAiC;IACjD,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,IAAI,EAAE,SAAS,CAAC;CAChB;AAED,wBAAsB,2BAA2B,CAChD,IAAI,EAAE,kBAAkB,EACxB,OAAO,GAAE,kCAAuC,GAC9C,OAAO,CAAC,iCAAiC,CAAC,CAY5C;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1G;AAED,wBAAsB,gCAAgC,CACrD,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,2BAA2B,GACnC,OAAO,CAAC,IAAI,CAAC,CAEf","sourcesContent":["import { Buffer } from \"node:buffer\";\nimport {\n\tDEFAULT_IROH_READ_LIMIT,\n\ttype IrohBytes,\n\ttype IrohRecvStreamLike,\n\ttype IrohSendStreamLike,\n\tserializeJsonLine,\n} from \"../../rpc/index.ts\";\nimport type { IrohRemoteHandshakeResponse, IrohRemoteHello } from \"./handshake.ts\";\n\nexport const DEFAULT_IROH_REMOTE_HANDSHAKE_MAX_LINE_BYTES = 16 * 1024;\nexport const DEFAULT_IROH_REMOTE_HANDSHAKE_TIMEOUT_MS = 15_000;\n\nexport interface IrohRemoteHandshakeLineReadOptions {\n\tinitialInput?: IrohBytes;\n\tmaxLineBytes?: number;\n\treadLimit?: number;\n\ttimeoutStopErrorCode?: bigint;\n\ttimeoutMs?: number;\n}\n\nexport interface IrohRemoteHandshakeLineReadResult {\n\tline: string | undefined;\n\trest: IrohBytes;\n}\n\nexport async function readIrohRemoteHandshakeLine(\n\trecv: IrohRecvStreamLike,\n\toptions: IrohRemoteHandshakeLineReadOptions = {},\n): Promise<IrohRemoteHandshakeLineReadResult> {\n\tconst timeoutMs = options.timeoutMs ?? DEFAULT_IROH_REMOTE_HANDSHAKE_TIMEOUT_MS;\n\treturn withTimeout(readBoundedIrohLine(recv, options), timeoutMs, \"Iroh remote handshake timed out\", () => {\n\t\ttry {\n\t\t\tconst stopResult = recv.stop?.(options.timeoutStopErrorCode ?? 0n);\n\t\t\tif (stopResult) {\n\t\t\t\tvoid Promise.resolve(stopResult).catch(() => {});\n\t\t\t}\n\t\t} catch {\n\t\t\t// Timeout cleanup is best-effort; callers should receive the timeout error.\n\t\t}\n\t});\n}\n\nexport async function writeIrohRemoteHello(send: IrohSendStreamLike, hello: IrohRemoteHello): Promise<void> {\n\tawait send.writeAll(textToBytes(serializeJsonLine(hello)));\n}\n\nexport async function writeIrohRemoteHandshakeResponse(\n\tsend: IrohSendStreamLike,\n\tresponse: IrohRemoteHandshakeResponse,\n): Promise<void> {\n\tawait send.writeAll(textToBytes(serializeJsonLine(response)));\n}\n\nasync function readBoundedIrohLine(\n\trecv: IrohRecvStreamLike,\n\toptions: IrohRemoteHandshakeLineReadOptions,\n): Promise<IrohRemoteHandshakeLineReadResult> {\n\tconst maxLineBytes = normalizePositiveInteger(\n\t\toptions.maxLineBytes ?? DEFAULT_IROH_REMOTE_HANDSHAKE_MAX_LINE_BYTES,\n\t\t\"maxLineBytes\",\n\t);\n\tconst requestedReadLimit = normalizePositiveInteger(options.readLimit ?? DEFAULT_IROH_READ_LIMIT, \"readLimit\");\n\tconst readLimit = Math.min(requestedReadLimit, maxLineBytes + 1);\n\tlet buffer = options.initialInput ? bytesToBuffer(options.initialInput) : Buffer.alloc(0);\n\n\twhile (true) {\n\t\tconst newlineIndex = buffer.indexOf(10);\n\t\tif (newlineIndex !== -1) {\n\t\t\tlet lineBuffer = buffer.subarray(0, newlineIndex);\n\t\t\tif (lineBuffer.length > 0 && lineBuffer[lineBuffer.length - 1] === 13) {\n\t\t\t\tlineBuffer = lineBuffer.subarray(0, lineBuffer.length - 1);\n\t\t\t}\n\t\t\tassertLineWithinLimit(lineBuffer.length, maxLineBytes);\n\t\t\treturn {\n\t\t\t\tline: lineBuffer.toString(\"utf8\"),\n\t\t\t\trest: buffer.subarray(newlineIndex + 1),\n\t\t\t};\n\t\t}\n\n\t\tassertLineWithinLimit(buffer.length, maxLineBytes);\n\t\tconst chunk = await recv.read(readLimit);\n\t\tif (!chunk || chunk.length === 0) {\n\t\t\treturn { line: undefined, rest: buffer };\n\t\t}\n\t\tbuffer = Buffer.concat([buffer, bytesToBuffer(chunk)]);\n\t}\n}\n\nfunction assertLineWithinLimit(length: number, maxLineBytes: number): void {\n\tif (length > maxLineBytes) {\n\t\tthrow new Error(`Iroh remote handshake line exceeds maximum size of ${maxLineBytes} bytes`);\n\t}\n}\n\nfunction normalizePositiveInteger(value: number, label: string): number {\n\tif (!Number.isInteger(value) || value <= 0) {\n\t\tthrow new Error(`${label} must be a positive integer`);\n\t}\n\treturn value;\n}\n\nasync function withTimeout<T>(\n\tpromise: Promise<T>,\n\ttimeoutMs: number,\n\tmessage: string,\n\tonTimeout: () => void,\n): Promise<T> {\n\tnormalizePositiveInteger(timeoutMs, \"timeoutMs\");\n\tlet timeout: NodeJS.Timeout | undefined;\n\ttry {\n\t\treturn await Promise.race([\n\t\t\tpromise,\n\t\t\tnew Promise<T>((_resolve, reject) => {\n\t\t\t\ttimeout = setTimeout(() => {\n\t\t\t\t\treject(new Error(message));\n\t\t\t\t\tonTimeout();\n\t\t\t\t}, timeoutMs);\n\t\t\t}),\n\t\t]);\n\t} finally {\n\t\tif (timeout) {\n\t\t\tclearTimeout(timeout);\n\t\t}\n\t}\n}\n\nfunction bytesToBuffer(bytes: IrohBytes): Buffer {\n\tif (Buffer.isBuffer(bytes)) {\n\t\treturn bytes;\n\t}\n\treturn Buffer.from(Array.from(bytes));\n}\n\nfunction textToBytes(text: string): Array<number> {\n\treturn Array.from(Buffer.from(text, \"utf8\"));\n}\n"]}