@hansjm10/volt-coding-agent 0.0.0-bootstrap.0 → 0.1.0

package/dist/core/remote/iroh/push.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push.js","sourceRoot":"","sources":["../../../../src/core/remote/iroh/push.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAazC,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,6CAA6C,GAAG,GAAG,CAAC;AACjE,MAAM,CAAC,MAAM,yCAAyC,GAAG,MAAM,CAAC;AAChE,MAAM,CAAC,MAAM,kCAAkC,GAAG,6DAA6D,CAAC;AAuIhH,iFAAiF;AACjF,gFAAgF;AAChF,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAC3C,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC;AACpE,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC;AACpE,MAAM,yCAAyC,GAAG,IAAI,CAAC;AAEvD,MAAM,OAAO,yCAAyC;IACpC,oBAAoB,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEvE,OAAO,CAAC,YAAoB,EAAE,OAAe,EAAW;QACvD,IAAI,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC/D,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,YAAY,GAAG,IAAI,GAAG,EAAE,CAAC;YACzB,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACd,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1B,sEAAsE;QACtE,OAAO,YAAY,CAAC,IAAI,GAAG,6BAA6B,EAAE,CAAC;YAC1D,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAClD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM;YACP,CAAC;YACD,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IAAA,CACZ;IAED,MAAM,CAAC,YAAoB,EAAE,OAAe,EAAQ;QACnD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAAA,CAC7D;CACD;AAED,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAC7C,MAAM,CAAS;IACf,SAAS,CAAU;IAE5B,YAAY,MAAc,EAAE,SAAkB,EAAE,MAAe,EAAE;QAChE,KAAK,CAAC,uCAAuC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAAA,CAC3B;CACD;AAED,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAE1C,mFAAmF;AACnF,KAAK,UAAU,oBAAoB,CAAC,QAAkB,EAA+B;IACpF,IAAI,CAAC;QACJ,MAAM,IAAI,GAAY,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/C,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAA+B,CAAC;QAC/C,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAC/C,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CACrE,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,6BAA6B,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AAAA,CACD;AAED,MAAM,OAAO,6BAA6B;IACxB,SAAS,CAAqB;IAC9B,OAAO,CAAS;IAChB,OAAO,CAA0D;IACjE,SAAS,CAAS;IAEnC,YAAY,OAA6C,EAAE;QAC1D,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,kCAAkC,CAAC;QACtE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC;QAC/D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,yCAAyC,CAAC;IAAA,CAChF;IAED,KAAK,CAAC,gBAAgB,CACrB,OAA+C,EACE;QACjD,OAAO,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC;IAAA,CACvF;IAED,KAAK,CAAC,sBAAsB,CAC3B,OAA+C,EACE;QACjD,OAAO,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC;IAAA,CACzF;IAED,KAAK,CAAC,gBAAgB,CAAC,OAA6C,EAAgD;QACnH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC/F,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;YACxD,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE;YAC7B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;SAC3C,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,4BAA4B,CACrC,QAAQ,CAAC,MAAM,EACf,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,EACtC,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CACpC,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,iBAAiB;YAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC3E,MAAM,IAAI,4BAA4B,CAAC,GAAG,EAAE,IAAI,EAAE,yBAAyB,CAAC,CAAC;IAAA,CAC7E;IAEO,KAAK,CAAC,gBAAgB,CAC7B,IAAY,EACZ,IAGuC,EACU;QACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE;YAC7B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;SAC3C,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC3B,CAAC;QACD,wEAAwE;QACxE,0EAA0E;QAC1E,wEAAsE;QACtE,wEAAwE;QACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACnF,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACrC,CAAC;QACD,MAAM,IAAI,4BAA4B,CACrC,QAAQ,CAAC,MAAM,EACf,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,EACtC,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CACpC,CAAC;IAAA,CACF;IAEO,aAAa,GAA2B;QAC/C,OAAO;YACN,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;IAAA,CACF;CACD;AAED,SAAS,2BAA2B,CACnC,OAA+C,EACN;IACzC,OAAO;QACN,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC5E,IAAI,EAAE,OAAO,CAAC,IAAI;KAClB,CAAC;AAAA,CACF;AAED,SAAS,2BAA2B,CACnC,OAA+C,EACN;IACzC,OAAO;QACN,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACjG,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;QACxF,GAAG,CAAC,OAAO,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,EAAE,CAAC;QAChH,GAAG,CAAC,OAAO,CAAC,yBAAyB,KAAK,SAAS;YAClD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,yBAAyB,EAAE,OAAO,CAAC,yBAAyB,EAAE,CAAC;KACpE,CAAC;AAAA,CACF;AAED,SAAS,yBAAyB,CACjC,OAA6C,EACN;IACvC,OAAO;QACN,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;KAChD,CAAC;AAAA,CACF;AAED,KAAK,UAAU,oBAAoB,CAAC,QAAkB,EAAoC;IACzF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC;QACJ,OAAO,IAAI,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI;gBAAE,MAAM;YACtB,UAAU,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YACrC,IAAI,UAAU,GAAG,yCAAyC,EAAE,CAAC;gBAC5D,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,4BAA4B,CAAC,GAAG,EAAE,IAAI,EAAE,0BAA0B,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACF,CAAC;YAAS,CAAC;QACV,MAAM,CAAC,WAAW,EAAE,CAAC;IACtB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5F,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC7E,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;AAAA,CACD;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACtD,MAAyD,EACzD,WAAsC,EACW;IACjD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAgD,CAAC;IAC9E,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC;QAChD,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChF,aAAa,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,mBAAmB,EAAE,EAAE;YAChE,YAAY,EAAE,MAAM,CAAC,EAAE;YACvB,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;SAC/C,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,kDAAkD,CAAC,CAAC;IAC7F,MAAM,OAAO,GAA0C;QACtD,SAAS,EAAE,eAAe,CAAC,MAAM;QACjC,OAAO,EAAE,CAAC;QACV,aAAa,EAAE,CAAC;QAChB,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM;KAChD,CAAC;IACF,MAAM,gBAAgB,GAAG,WAAW,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACzE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC;QACxC,OAAO,OAAO,CAAC;IAChB,CAAC;IACD,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,MAAM,IAAI,kDAAkD,EAAE,CAAC;QACpH,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,kDAAkD,CAAC,CAAC;QACzG,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1F,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAClC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;YACrB,CAAC;iBAAM,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC9C,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;YAC5B,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED,MAAM,OAAO,oCAAoC;IAC/B,WAAW,CAAoC;IAC/C,YAAY,CAAS;IACrB,OAAO,CAAoC;IAC3C,GAAG,CAAe;IAClB,WAAW,CAA4B;IACvC,aAAa,CAAS;IACtB,YAAY,CAAS;IACrB,YAAY,CAA6B;IACzC,SAAS,CAAqB;IAE/C,YAAY,OAAoD,EAAE;QACjE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,yCAAyC,EAAE,CAAC;QAClF,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,IAAI,6CAA6C,CAAC,CAClF,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAC3B,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,IAAI,6CAA6C,CAAC,CACjF,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAAA,CACnC;IAED,KAAK,CAAC,kBAAkB,CAAC,IAAa,EAA0C;QAC/E,MAAM,YAAY,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,UAAU,GAAyB;gBACxC,EAAE,EAAE,YAAY,CAAC,YAAY;gBAC7B,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;gBACrD,GAAG,CAAC,YAAY,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC;gBACnF,GAAG,CAAC,YAAY,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC;gBACtF,GAAG,CAAC,YAAY,CAAC,YAAY,KAAK,SAAS;oBAC1C,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC;wBACA,YAAY,EAAE;4BACb,UAAU,EAAE,YAAY,CAAC,YAAY,CAAC,UAAU;4BAChD,SAAS,EAAE,YAAY,CAAC,YAAY,CAAC,SAAS;4BAC9C,GAAG,CAAC,YAAY,CAAC,YAAY,CAAC,SAAS,KAAK,SAAS;gCACpD,CAAC,CAAC,EAAE;gCACJ,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;4BACtD,GAAG,CAAC,YAAY,CAAC,YAAY,CAAC,gBAAgB,KAAK,SAAS;gCAC3D,CAAC,CAAC,EAAE;gCACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,YAAY,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;4BACpE,SAAS,EAAE,GAAG;yBACd;qBACD,CAAC;gBACJ,OAAO,EAAE,YAAY,CAAC,OAAO;gBAC7B,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACd,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC7F,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,IAAI,CAAC,GAAG,CAAC;gBACd,IAAI,EAAE,wBAAwB;gBAC9B,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,yBAAyB,CAAC,UAAU,CAAC;aAC9C,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC,YAAY,EAAE,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACzB,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,aAAa,GAClB,YAAY,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC;gBAC5C,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YACnG,MAAM,IAAI,CAAC,GAAG,CAAC;gBACd,IAAI,EAAE,wBAAwB;gBAC9B,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE;oBACR,YAAY,EAAE,YAAY,CAAC,YAAY;oBACvC,QAAQ,EAAE,YAAY,CAAC,QAAQ;oBAC/B,QAAQ,EAAE,YAAY,CAAC,QAAQ;oBAC/B,QAAQ,EAAE,YAAY,CAAC,QAAQ;oBAC/B,SAAS,EAAE,YAAY,CAAC,SAAS;oBACjC,qBAAqB,EAAE,YAAY,CAAC,YAAY,EAAE,SAAS;oBAC3D,4BAA4B,EAAE,YAAY,CAAC,YAAY,EAAE,gBAAgB;oBACzE,OAAO,EAAE,YAAY,CAAC,OAAO;iBAC7B;aACD,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QAChC,CAAC;IAAA,CACD;IAED,KAAK,CAAC,mBAAmB,CACxB,YAA8C,EACM;QACpD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/E,OAAO,WAAW,CAAC;QACpB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACtF,OAAO,gBAAgB,CAAC;QACzB,CAAC;QAED,MAAM,YAAY,GAAG,8BAA8B,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC9E,IAAI,CAAC;YACJ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;YACvE,IAAI,WAAW,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC9F,MAAM,IAAI,CAAC,eAAe,CACzB,UAAU,EACV,YAAY,CAAC,OAAO,EACpB,YAAY,CAAC,IAAI,EACjB,KAAK,EACL,wCAAwC,CACxC,CAAC;gBACF,OAAO,gBAAgB,CAAC;YACzB,CAAC;YACD,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACtF,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACzB,2EAA2E;YAC3E,0EAA0E;YAC1E,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;YAC7D,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9G,OAAO,QAAQ,CAAC;QACjB,CAAC;IAAA,CACD;IAED,KAAK,CAAC,yBAAyB,CAC9B,MAA0C,EACU;QACpD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACnE,OAAO,WAAW,CAAC;QACpB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACpE,MAAM,YAAY,GAAG,8BAA8B,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QACjF,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,oCAAoC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzG,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC;YAChD,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;YACnF,OAAO,gBAAgB,CAAC;QACzB,CAAC;QAED,MAAM,YAAY,GAAG,8BAA8B,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;QACjG,IAAI,CAAC;YACJ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,YAAY,CAAC,CAAC;YAC7E,IAAI,WAAW,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,YAAY,CAAC,sCAAsC,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5G,MAAM,IAAI,CAAC,eAAe,CACzB,UAAU,EACV,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,IAAI,EACX,KAAK,EACL,iDAAiD,EACjD,YAAY,CAAC,SAAS,CACtB,CAAC;gBACF,OAAO,gBAAgB,CAAC;YACzB,CAAC;YACD,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YAC7G,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACzB,2EAA2E;YAC3E,0EAA0E;YAC1E,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,IAAI,CAAC,eAAe,CACzB,UAAU,EACV,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,IAAI,EACX,KAAK,EACL,cAAc,CAAC,KAAK,CAAC,EACrB,YAAY,CAAC,SAAS,CACtB,CAAC;YACF,OAAO,QAAQ,CAAC;QACjB,CAAC;IAAA,CACD;IAEO,KAAK,CAAC,kBAAkB,CAAC,OAAe,EAAE,IAAY,EAAoB;QACjF,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,IAAI,CAAC,GAAG,CAAC;YACd,IAAI,EAAE,gCAAgC;YACtC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;SAC1B,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IAAA,CACb;IAEO,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,IAAY,EAAE,MAAc,EAAiB;QAC3F,MAAM,IAAI,CAAC,GAAG,CAAC;YACd,IAAI,EAAE,4BAA4B;YAClC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;SAClC,CAAC,CAAC;IAAA,CACH;IAEO,KAAK,CAAC,yBAAyB,CACtC,OAA+C,EACE;QACjD,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IAAA,CAC5E;IAEO,KAAK,CAAC,+BAA+B,CAC5C,OAA+C,EACE;QACjD,MAAM,sBAAsB,GAAG,IAAI,CAAC,WAAW,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/F,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;IAAA,CACjE;IAEO,KAAK,CAAC,aAAa,CAC1B,IAA0D,EACT;QACjD,IAAI,SAAkB,CAAC;QACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,aAAa,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC;gBACJ,OAAO,MAAM,IAAI,EAAE,CAAC;YACrB,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACzB,SAAS,GAAG,KAAK,CAAC;gBAClB,IAAI,OAAO,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACxE,MAAM,KAAK,CAAC;gBACb,CAAC;gBACD,MAAM,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,CAAC;YAC1C,CAAC;QACF,CAAC;QACD,MAAM,SAAS,CAAC;IAAA,CAChB;IAEO,KAAK,CAAC,eAAe,CAC5B,UAAgC,EAChC,OAAe,EACf,IAAY,EACZ,OAAgB,EAChB,KAAc,EACd,kBAA2B,EACX;QAChB,MAAM,IAAI,CAAC,GAAG,CAAC;YACd,IAAI,EAAE,6BAA6B;YACnC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO;YACP,KAAK;YACL,OAAO,EAAE;gBACR,OAAO;gBACP,IAAI;gBACJ,YAAY,EAAE,UAAU,CAAC,EAAE;gBAC3B,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,SAAS,EAAE,kBAAkB,IAAI,UAAU,CAAC,SAAS;aACrD;SACD,CAAC,CAAC;IAAA,CACH;IAEO,KAAK,CAAC,GAAG,CAAC,KAAgC,EAAiB;QAClE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACvB,OAAO;QACR,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACR,0FAA0F;QAC3F,CAAC;IAAA,CACD;CACD;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAU;IAC9D,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AAAA,CAClF;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAc,EAA6B;IACtF,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;IAC9D,OAAO;QACN,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC3C,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC3C,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,gBAAgB,CAAC;QAC/D,mBAAmB,EAAE,YAAY,CAAC,IAAI,CAAC,mBAAmB,EAAE,wBAAwB,CAAC;QACrF,QAAQ,EAAE,oBAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC;QAC/D,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC;QAClE,YAAY,EAAE,qCAAqC,CAAC,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC;QAC3F,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC;KACpD,CAAC;AAAA,CACF;AAED,SAAS,qCAAqC,CAC7C,KAAc,EACd,KAAa,EAC+B;IAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChD,OAAO;QACN,UAAU,EAAE,YAAY,CAAC,YAAY,CAAC,UAAU,EAAE,GAAG,KAAK,aAAa,CAAC;QACxE,SAAS,EAAE,YAAY,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,KAAK,YAAY,CAAC;QACrE,SAAS,EAAE,oBAAoB,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,KAAK,YAAY,CAAC;QAC7E,gBAAgB,EAAE,kCAAkC,CAAC,YAAY,CAAC,gBAAgB,EAAE,GAAG,KAAK,mBAAmB,CAAC;KAChH,CAAC;AAAA,CACF;AAED,SAAS,uBAAuB,CAAC,WAAmC,EAAoC;IACvG,OAAO,WAAW;SAChB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;SAClC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAAA,CAC5E;AAED,SAAS,8BAA8B,CACtC,UAAgC,EAChC,YAA8C,EACL;IACzC,MAAM,SAAS,GAAG,4BAA4B,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACvE,OAAO;QACN,YAAY,EAAE,UAAU,CAAC,EAAE;QAC3B,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;QACnD,OAAO,EAAE,YAAY,CAAC,OAAO;QAC7B,IAAI,EAAE,YAAY,CAAC,IAAI;QACvB,KAAK,EAAE,YAAY,CAAC,KAAK;QACzB,IAAI,EAAE,YAAY,CAAC,IAAI;QACvB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;QACjD,IAAI,EAAE;YACL,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,GAAG,CAAC,YAAY,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC;YACtF,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;SACjD;KACD,CAAC;AAAA,CACF;AAED,SAAS,4BAA4B,CAAC,SAA6B,EAAsB;IACxF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvG,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED,SAAS,8BAA8B,CACtC,UAAgC,EAChC,MAA0C,EAC1C,UAAU,GAAG,UAAU,CAAC,YAAY,EAAE,UAAU,EACP;IACzC,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO;QACN,YAAY,EAAE,UAAU,CAAC,EAAE;QAC3B,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;QACnD,UAAU;QACV,iBAAiB,EAAE,UAAU,CAAC,YAAY,CAAC,SAAS;QACpD,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,gBAAgB,KAAK,SAAS;YACzD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;QAClE,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;QACtF,GAAG,CAAC,MAAM,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAC9G,GAAG,CAAC,MAAM,CAAC,yBAAyB,KAAK,SAAS;YACjD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,yBAAyB,EAAE,MAAM,CAAC,yBAAyB,EAAE,CAAC;KACnE,CAAC;AAAA,CACF;AAED,SAAS,yBAAyB,CAAC,UAAgC,EAA2B;IAC7F,OAAO;QACN,YAAY,EAAE,UAAU,CAAC,EAAE;QAC3B,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,qBAAqB,EAAE,UAAU,CAAC,YAAY,EAAE,SAAS;QACzD,4BAA4B,EAAE,UAAU,CAAC,YAAY,EAAE,gBAAgB;QACvE,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;KAC/B,CAAC;AAAA,CACF;AAED,SAAS,8BAA8B,CACtC,MAAoC,EACpC,YAAgD,EACC;IACjD,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,CAAC;IACjD,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC;IACzC,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,MAAM,EAAE,cAAc,IAAI,EAAE,CAAC;SACnC,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC;QACzB,OAAO,YAAY,CAAC,aAAa,KAAK,aAAa,IAAI,YAAY,CAAC,SAAS,KAAK,SAAS,CAAC;IAAA,CAC5F,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAAA,CAC5E;AAED,SAAS,oCAAoC,CAC5C,MAAoC,EACpC,YAAgD,EACb;IACnC,OAAO,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5C,OAAO,CACN,MAAM,CAAC,EAAE,KAAK,YAAY,CAAC,YAAY;YACvC,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ;YACzC,MAAM,CAAC,YAAY,EAAE,SAAS,KAAK,YAAY,CAAC,SAAS;YACzD,MAAM,CAAC,YAAY,CAAC,gBAAgB,KAAK,YAAY,CAAC,gBAAgB,CACtE,CAAC;IAAA,CACF,CAAC,CAAC;AAAA,CACH;AAED,SAAS,yBAAyB,CAAC,KAAc,EAAW;IAC3D,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC,SAAS,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,SAAS,qBAAqB,CAAC,MAAc,EAAW;IACvD,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;AAAA,CAC7F;AAED,SAAS,cAAc,CAAC,KAAc,EAAU;IAC/C,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAAA,CAC9D;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa,EAA2B;IAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAgC,CAAC;AAAA,CACxC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa,EAAU;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,KAAa,EAAsB;IAChF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAAA,CAClC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa,EAAW;IAC9D,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAgC;IACzE,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAAA,CAC7C;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAgC;IACzE,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAAA,CAC7C;AAED,SAAS,kCAAkC,CAAC,KAAc,EAAE,KAAa,EAA8C;IACtH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QACvD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;AAAA,CAC9D;AAED,SAAS,KAAK,CAAC,EAAU,EAAiB;IACzC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QACd,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/B,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAAA,CACxB,CAAC,CAAC;AAAA,CACH","sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { RpcRegisterPushTargetArgs, RpcRegisterPushTargetResponse } from \"../../rpc/types.ts\";\nimport type { IrohRemoteAuditEventInput, IrohRemoteAuditLogger } from \"./audit.ts\";\nimport type {\n\tIrohRemoteClient,\n\tIrohRemoteLiveActivityRegistration,\n\tIrohRemotePushTarget,\n\tIrohRemotePushTargetPlatform,\n\tIrohRemotePushTargetProvider,\n\tIrohRemotePushTokenEnvironment,\n} from \"./state.ts\";\nimport type { IrohRemoteHostStateManager } from \"./state-manager.ts\";\n\nexport const DEFAULT_IROH_REMOTE_PUSH_RELAY_RETRY_ATTEMPTS = 3;\nexport const DEFAULT_IROH_REMOTE_PUSH_RELAY_RETRY_DELAY_MS = 250;\nexport const DEFAULT_IROH_REMOTE_PUSH_RELAY_TIMEOUT_MS = 10_000;\nexport const DEFAULT_IROH_REMOTE_PUSH_RELAY_URL = \"https://us-central1-volt-3fae7.cloudfunctions.net/pushRelay\";\n\nexport type IrohRemotePushTargetRegistrationRequest = RpcRegisterPushTargetArgs;\nexport type IrohRemotePushTargetRegistrationResult = RpcRegisterPushTargetResponse;\n\nexport interface IrohRemotePushNotificationIntent {\n\teventId: string;\n\tkind: string;\n\ttitle: string;\n\tbody: string;\n\tsessionId?: string;\n\tworkspace?: string;\n}\n\nexport interface IrohRemoteLiveActivityToolGlyph {\n\tname: string;\n\tsymbolName: string;\n\tstatus: \"started\" | \"completed\" | \"failed\";\n}\n\nexport interface IrohRemoteLiveActivityContentState {\n\tstatus: \"running\" | \"completed\" | \"failed\" | \"waiting\";\n\tstatusText: string;\n\tcurrentTool?: IrohRemoteLiveActivityToolGlyph;\n\trecentTools: IrohRemoteLiveActivityToolGlyph[];\n\tsessionID?: string;\n\tworkspaceName?: string;\n\tupdatedAtEpochSeconds: number;\n}\n\nexport interface IrohRemoteLiveActivityUpdateIntent {\n\teventId: string;\n\tkind: string;\n\tactivityEvent?: \"update\" | \"end\";\n\tcontentState: IrohRemoteLiveActivityContentState;\n\tstaleDateEpochSeconds?: number;\n\tdismissalDateEpochSeconds?: number;\n}\n\nexport interface IrohRemotePushRelayNotificationRequest {\n\tpushTargetId: string;\n\tpushTargetAuthToken: string;\n\teventId: string;\n\tkind: string;\n\ttitle: string;\n\tbody: string;\n\tworkspace?: string;\n\tdata: {\n\t\teventId: string;\n\t\tkind: string;\n\t\tsessionId?: string;\n\t\tworkspace?: string;\n\t};\n}\n\nexport interface IrohRemotePushRelayLiveActivityRequest {\n\tpushTargetId: string;\n\tpushTargetAuthToken: string;\n\tactivityId: string;\n\tactivityPushToken: string;\n\t/** APNs environment of the activity push token, when the client reported one. */\n\ttokenEnvironment?: IrohRemotePushTokenEnvironment;\n\teventId: string;\n\tkind: string;\n\tcontentState: IrohRemoteLiveActivityContentState;\n\tactivityEvent?: \"update\" | \"end\";\n\tstaleDateEpochSeconds?: number;\n\tdismissalDateEpochSeconds?: number;\n}\n\nexport interface IrohRemotePushRelayRevocationRequest {\n\tpushTargetId: string;\n\tpushTargetAuthToken: string;\n}\n\nexport type IrohRemotePushRelayNotificationResult = { status: \"sent\" } | { status: \"invalid_target\" };\nexport type IrohRemotePushRelayRevocationResult = { status: \"revoked\" } | { status: \"already_absent\" };\n\nexport interface IrohRemotePushRelayClient {\n\tsendNotification(request: IrohRemotePushRelayNotificationRequest): Promise<IrohRemotePushRelayNotificationResult>;\n\tsendLiveActivityUpdate?(\n\t\trequest: IrohRemotePushRelayLiveActivityRequest,\n\t): Promise<IrohRemotePushRelayNotificationResult>;\n\trevokePushTarget?(request: IrohRemotePushRelayRevocationRequest): Promise<IrohRemotePushRelayRevocationResult>;\n}\n\nexport interface IrohRemotePushTargetRevocationSummary {\n\tattempted: number;\n\trevoked: number;\n\talreadyAbsent: number;\n\tfailed: number;\n\tskipped: number;\n}\n\nexport type IrohRemotePushNotificationDeliveryStatus =\n\t| \"sent\"\n\t| \"no_push_target\"\n\t| \"duplicate\"\n\t| \"failed\"\n\t| \"invalid_target\";\n\nexport interface IrohRemotePushNotificationDelivery {\n\tdeliverNotification(\n\t\tnotification: IrohRemotePushNotificationIntent,\n\t): Promise<IrohRemotePushNotificationDeliveryStatus>;\n\tdeliverLiveActivityUpdate?(\n\t\tupdate: IrohRemoteLiveActivityUpdateIntent,\n\t): Promise<IrohRemotePushNotificationDeliveryStatus>;\n}\n\nexport interface IrohRemotePushNotificationDeduper {\n\ttryMark(clientNodeId: string, eventId: string): boolean;\n\t/** Release a mark claimed by tryMark when the corresponding delivery did not succeed. */\n\tunmark(clientNodeId: string, eventId: string): void;\n}\n\nexport interface IrohRemotePushNotificationDispatcherOptions {\n\tauditLogger?: IrohRemoteAuditLogger;\n\tclientNodeId: string;\n\tdeduper?: IrohRemotePushNotificationDeduper;\n\tnow?: () => number;\n\trelayClient: IrohRemotePushRelayClient;\n\tretryAttempts?: number;\n\tretryDelayMs?: number;\n\tstateManager: IrohRemoteHostStateManager;\n\tworkspace?: string;\n}\n\nexport interface IrohRemotePushRelayHttpClientOptions {\n\tauthToken?: string;\n\tbaseUrl?: string;\n\tfetcher?: (input: string, init: RequestInit) => Promise<Response>;\n\ttimeoutMs?: number;\n}\n\n// The deduper lives for the daemon's whole lifetime, so the per-client id set is\n// bounded. Re-marking an evicted id at most re-sends one very old notification.\nconst MAX_SENT_EVENT_IDS_PER_CLIENT = 1000;\nexport const MAX_IROH_REMOTE_PUSH_TARGET_REVOCATIONS_PER_CLIENT = 8;\nexport const MAX_IROH_REMOTE_PUSH_TARGET_REVOCATION_CONCURRENCY = 4;\nconst MAX_IROH_REMOTE_PUSH_RELAY_RESPONSE_BYTES = 1024;\n\nexport class IrohRemoteInMemoryPushNotificationDeduper implements IrohRemotePushNotificationDeduper {\n\tprivate readonly sentEventIdsByClient = new Map<string, Set<string>>();\n\n\ttryMark(clientNodeId: string, eventId: string): boolean {\n\t\tlet sentEventIds = this.sentEventIdsByClient.get(clientNodeId);\n\t\tif (!sentEventIds) {\n\t\t\tsentEventIds = new Set();\n\t\t\tthis.sentEventIdsByClient.set(clientNodeId, sentEventIds);\n\t\t}\n\t\tif (sentEventIds.has(eventId)) {\n\t\t\treturn false;\n\t\t}\n\t\tsentEventIds.add(eventId);\n\t\t// Evict oldest ids (Sets preserve insertion order) once over the cap.\n\t\twhile (sentEventIds.size > MAX_SENT_EVENT_IDS_PER_CLIENT) {\n\t\t\tconst oldest = sentEventIds.values().next().value;\n\t\t\tif (oldest === undefined) {\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tsentEventIds.delete(oldest);\n\t\t}\n\t\treturn true;\n\t}\n\n\tunmark(clientNodeId: string, eventId: string): void {\n\t\tthis.sentEventIdsByClient.get(clientNodeId)?.delete(eventId);\n\t}\n}\n\nexport class IrohRemotePushRelayHttpError extends Error {\n\treadonly status: number;\n\treadonly transient: boolean;\n\n\tconstructor(status: number, transient: boolean, detail?: string) {\n\t\tsuper(`Push relay request failed with HTTP ${status}${detail ? ` (${detail})` : \"\"}`);\n\t\tthis.name = \"IrohRemotePushRelayHttpError\";\n\t\tthis.status = status;\n\t\tthis.transient = transient;\n\t}\n}\n\nconst MAX_RELAY_ERROR_DETAIL_LENGTH = 200;\n\n/** Best-effort extraction of the relay's `{ error, code }` body for audit logs. */\nasync function readRelayErrorDetail(response: Response): Promise<string | undefined> {\n\ttry {\n\t\tconst body: unknown = await readBoundedRelayJson(response);\n\t\tif (typeof body !== \"object\" || body === null) {\n\t\t\treturn undefined;\n\t\t}\n\t\tconst record = body as Record<string, unknown>;\n\t\tconst parts = [record.error, record.code].filter(\n\t\t\t(part): part is string => typeof part === \"string\" && part.length > 0,\n\t\t);\n\t\tif (parts.length === 0) {\n\t\t\treturn undefined;\n\t\t}\n\t\treturn parts.join(\": \").slice(0, MAX_RELAY_ERROR_DETAIL_LENGTH);\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nexport class IrohRemotePushRelayHttpClient implements IrohRemotePushRelayClient {\n\tprivate readonly authToken: string | undefined;\n\tprivate readonly baseUrl: string;\n\tprivate readonly fetcher: (input: string, init: RequestInit) => Promise<Response>;\n\tprivate readonly timeoutMs: number;\n\n\tconstructor(options: IrohRemotePushRelayHttpClientOptions) {\n\t\tthis.authToken = options.authToken;\n\t\tconst baseUrl = options.baseUrl ?? DEFAULT_IROH_REMOTE_PUSH_RELAY_URL;\n\t\tthis.baseUrl = baseUrl.endsWith(\"/\") ? baseUrl : `${baseUrl}/`;\n\t\tthis.fetcher = options.fetcher ?? ((input, init) => fetch(input, init));\n\t\tthis.timeoutMs = options.timeoutMs ?? DEFAULT_IROH_REMOTE_PUSH_RELAY_TIMEOUT_MS;\n\t}\n\n\tasync sendNotification(\n\t\trequest: IrohRemotePushRelayNotificationRequest,\n\t): Promise<IrohRemotePushRelayNotificationResult> {\n\t\treturn this.sendRelayRequest(\"v1/notifications\", createRelayNotificationBody(request));\n\t}\n\n\tasync sendLiveActivityUpdate(\n\t\trequest: IrohRemotePushRelayLiveActivityRequest,\n\t): Promise<IrohRemotePushRelayNotificationResult> {\n\t\treturn this.sendRelayRequest(\"v1/live-activities\", createRelayLiveActivityBody(request));\n\t}\n\n\tasync revokePushTarget(request: IrohRemotePushRelayRevocationRequest): Promise<IrohRemotePushRelayRevocationResult> {\n\t\tconst response = await this.fetcher(new URL(\"v1/push-targets/revoke\", this.baseUrl).toString(), {\n\t\t\tbody: JSON.stringify(createRelayRevocationBody(request)),\n\t\t\theaders: this.createHeaders(),\n\t\t\tmethod: \"POST\",\n\t\t\tsignal: AbortSignal.timeout(this.timeoutMs),\n\t\t});\n\t\tif (response.status === 404 || response.status === 410) {\n\t\t\treturn { status: \"already_absent\" };\n\t\t}\n\t\tif (!response.ok) {\n\t\t\tthrow new IrohRemotePushRelayHttpError(\n\t\t\t\tresponse.status,\n\t\t\t\tisTransientHttpStatus(response.status),\n\t\t\t\tawait readRelayErrorDetail(response),\n\t\t\t);\n\t\t}\n\t\tconst body = await readBoundedRelayJson(response);\n\t\tif (body.status === \"revoked\") return { status: \"revoked\" };\n\t\tif (body.status === \"already_revoked\") return { status: \"already_absent\" };\n\t\tthrow new IrohRemotePushRelayHttpError(502, true, \"invalid revoke response\");\n\t}\n\n\tprivate async sendRelayRequest(\n\t\tpath: string,\n\t\tbody:\n\t\t\t| IrohRemotePushRelayNotificationRequest\n\t\t\t| IrohRemotePushRelayLiveActivityRequest\n\t\t\t| IrohRemotePushRelayRevocationRequest,\n\t): Promise<IrohRemotePushRelayNotificationResult> {\n\t\tconst response = await this.fetcher(new URL(path, this.baseUrl).toString(), {\n\t\t\tbody: JSON.stringify(body),\n\t\t\theaders: this.createHeaders(),\n\t\t\tmethod: \"POST\",\n\t\t\tsignal: AbortSignal.timeout(this.timeoutMs),\n\t\t});\n\t\tif (response.ok) {\n\t\t\treturn { status: \"sent\" };\n\t\t}\n\t\t// 404/410: target unknown or disabled. 422: the relay cannot deliver to\n\t\t// this target at all (e.g. a development-environment Live Activity token,\n\t\t// which FCM cannot reach) — treat as invalid so the caller prunes the\n\t\t// registration instead of retrying a permanently undeliverable channel.\n\t\tif (response.status === 404 || response.status === 410 || response.status === 422) {\n\t\t\treturn { status: \"invalid_target\" };\n\t\t}\n\t\tthrow new IrohRemotePushRelayHttpError(\n\t\t\tresponse.status,\n\t\t\tisTransientHttpStatus(response.status),\n\t\t\tawait readRelayErrorDetail(response),\n\t\t);\n\t}\n\n\tprivate createHeaders(): Record<string, string> {\n\t\treturn {\n\t\t\t\"content-type\": \"application/json\",\n\t\t\t...(this.authToken ? { authorization: `Bearer ${this.authToken}` } : {}),\n\t\t};\n\t}\n}\n\nfunction createRelayNotificationBody(\n\trequest: IrohRemotePushRelayNotificationRequest,\n): IrohRemotePushRelayNotificationRequest {\n\treturn {\n\t\tpushTargetId: request.pushTargetId,\n\t\tpushTargetAuthToken: request.pushTargetAuthToken,\n\t\teventId: request.eventId,\n\t\tkind: request.kind,\n\t\ttitle: request.title,\n\t\tbody: request.body,\n\t\t...(request.workspace === undefined ? {} : { workspace: request.workspace }),\n\t\tdata: request.data,\n\t};\n}\n\nfunction createRelayLiveActivityBody(\n\trequest: IrohRemotePushRelayLiveActivityRequest,\n): IrohRemotePushRelayLiveActivityRequest {\n\treturn {\n\t\tpushTargetId: request.pushTargetId,\n\t\tpushTargetAuthToken: request.pushTargetAuthToken,\n\t\tactivityId: request.activityId,\n\t\tactivityPushToken: request.activityPushToken,\n\t\t...(request.tokenEnvironment === undefined ? {} : { tokenEnvironment: request.tokenEnvironment }),\n\t\teventId: request.eventId,\n\t\tkind: request.kind,\n\t\tcontentState: request.contentState,\n\t\t...(request.activityEvent === undefined ? {} : { activityEvent: request.activityEvent }),\n\t\t...(request.staleDateEpochSeconds === undefined ? {} : { staleDateEpochSeconds: request.staleDateEpochSeconds }),\n\t\t...(request.dismissalDateEpochSeconds === undefined\n\t\t\t? {}\n\t\t\t: { dismissalDateEpochSeconds: request.dismissalDateEpochSeconds }),\n\t};\n}\n\nfunction createRelayRevocationBody(\n\trequest: IrohRemotePushRelayRevocationRequest,\n): IrohRemotePushRelayRevocationRequest {\n\treturn {\n\t\tpushTargetId: request.pushTargetId,\n\t\tpushTargetAuthToken: request.pushTargetAuthToken,\n\t};\n}\n\nasync function readBoundedRelayJson(response: Response): Promise<Record<string, unknown>> {\n\tconst reader = response.body?.getReader();\n\tif (!reader) return {};\n\tconst chunks: Uint8Array[] = [];\n\tlet totalBytes = 0;\n\ttry {\n\t\twhile (true) {\n\t\t\tconst chunk = await reader.read();\n\t\t\tif (chunk.done) break;\n\t\t\ttotalBytes += chunk.value.byteLength;\n\t\t\tif (totalBytes > MAX_IROH_REMOTE_PUSH_RELAY_RESPONSE_BYTES) {\n\t\t\t\tawait reader.cancel();\n\t\t\t\tthrow new IrohRemotePushRelayHttpError(502, true, \"relay response too large\");\n\t\t\t}\n\t\t\tchunks.push(chunk.value);\n\t\t}\n\t} finally {\n\t\treader.releaseLock();\n\t}\n\tconst bytes = new Uint8Array(totalBytes);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\tbytes.set(chunk, offset);\n\t\toffset += chunk.byteLength;\n\t}\n\ttry {\n\t\tconst parsed: unknown = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes));\n\t\treturn typeof parsed === \"object\" && parsed !== null && !Array.isArray(parsed)\n\t\t\t? (parsed as Record<string, unknown>)\n\t\t\t: {};\n\t} catch {\n\t\treturn {};\n\t}\n}\n\n/**\n * Best-effort cleanup after local client revocation. Local authority is already\n * gone before this runs, so relay failures are summarized rather than thrown.\n * The call count is capped to keep a corrupted or malicious state file from\n * turning one control request into unbounded outbound work; relay TTL bounds any\n * skipped or failed credential's remaining lifetime.\n */\nexport async function revokeIrohRemoteClientPushTargets(\n\tclient: Pick<IrohRemoteClient, \"pushTargets\"> | undefined,\n\trelayClient: IrohRemotePushRelayClient,\n): Promise<IrohRemotePushTargetRevocationSummary> {\n\tconst uniqueTargets = new Map<string, IrohRemotePushRelayRevocationRequest>();\n\tfor (const target of client?.pushTargets ?? []) {\n\t\tif (target.id.length === 0 || target.pushTargetAuthToken.length === 0) continue;\n\t\tuniqueTargets.set(`${target.id}\\0${target.pushTargetAuthToken}`, {\n\t\t\tpushTargetId: target.id,\n\t\t\tpushTargetAuthToken: target.pushTargetAuthToken,\n\t\t});\n\t}\n\tconst targets = Array.from(uniqueTargets.values());\n\tconst selectedTargets = targets.slice(0, MAX_IROH_REMOTE_PUSH_TARGET_REVOCATIONS_PER_CLIENT);\n\tconst summary: IrohRemotePushTargetRevocationSummary = {\n\t\tattempted: selectedTargets.length,\n\t\trevoked: 0,\n\t\talreadyAbsent: 0,\n\t\tfailed: 0,\n\t\tskipped: targets.length - selectedTargets.length,\n\t};\n\tconst revokePushTarget = relayClient.revokePushTarget?.bind(relayClient);\n\tif (!revokePushTarget) {\n\t\tsummary.failed = selectedTargets.length;\n\t\treturn summary;\n\t}\n\tfor (let offset = 0; offset < selectedTargets.length; offset += MAX_IROH_REMOTE_PUSH_TARGET_REVOCATION_CONCURRENCY) {\n\t\tconst batch = selectedTargets.slice(offset, offset + MAX_IROH_REMOTE_PUSH_TARGET_REVOCATION_CONCURRENCY);\n\t\tconst results = await Promise.allSettled(batch.map((target) => revokePushTarget(target)));\n\t\tfor (const result of results) {\n\t\t\tif (result.status === \"rejected\") {\n\t\t\t\tsummary.failed += 1;\n\t\t\t} else if (result.value.status === \"revoked\") {\n\t\t\t\tsummary.revoked += 1;\n\t\t\t} else {\n\t\t\t\tsummary.alreadyAbsent += 1;\n\t\t\t}\n\t\t}\n\t}\n\treturn summary;\n}\n\nexport class IrohRemotePushNotificationDispatcher implements IrohRemotePushNotificationDelivery {\n\tprivate readonly auditLogger: IrohRemoteAuditLogger | undefined;\n\tprivate readonly clientNodeId: string;\n\tprivate readonly deduper: IrohRemotePushNotificationDeduper;\n\tprivate readonly now: () => number;\n\tprivate readonly relayClient: IrohRemotePushRelayClient;\n\tprivate readonly retryAttempts: number;\n\tprivate readonly retryDelayMs: number;\n\tprivate readonly stateManager: IrohRemoteHostStateManager;\n\tprivate readonly workspace: string | undefined;\n\n\tconstructor(options: IrohRemotePushNotificationDispatcherOptions) {\n\t\tthis.auditLogger = options.auditLogger;\n\t\tthis.clientNodeId = options.clientNodeId;\n\t\tthis.deduper = options.deduper ?? new IrohRemoteInMemoryPushNotificationDeduper();\n\t\tthis.now = options.now ?? Date.now;\n\t\tthis.relayClient = options.relayClient;\n\t\tthis.retryAttempts = Math.max(\n\t\t\t1,\n\t\t\tMath.trunc(options.retryAttempts ?? DEFAULT_IROH_REMOTE_PUSH_RELAY_RETRY_ATTEMPTS),\n\t\t);\n\t\tthis.retryDelayMs = Math.max(\n\t\t\t0,\n\t\t\tMath.trunc(options.retryDelayMs ?? DEFAULT_IROH_REMOTE_PUSH_RELAY_RETRY_DELAY_MS),\n\t\t);\n\t\tthis.stateManager = options.stateManager;\n\t\tthis.workspace = options.workspace;\n\t}\n\n\tasync registerPushTarget(args: unknown): Promise<RpcRegisterPushTargetResponse> {\n\t\tconst registration = parseRegisterPushTargetArgs(args);\n\t\ttry {\n\t\t\tconst now = this.now();\n\t\t\tconst pushTarget: IrohRemotePushTarget = {\n\t\t\t\tid: registration.pushTargetId,\n\t\t\t\tprovider: registration.provider,\n\t\t\t\tplatform: registration.platform,\n\t\t\t\tpushTargetAuthToken: registration.pushTargetAuthToken,\n\t\t\t\t...(registration.relayUrl === undefined ? {} : { relayUrl: registration.relayUrl }),\n\t\t\t\t...(registration.tokenHash === undefined ? {} : { tokenHash: registration.tokenHash }),\n\t\t\t\t...(registration.liveActivity === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: {\n\t\t\t\t\t\t\tliveActivity: {\n\t\t\t\t\t\t\t\tactivityId: registration.liveActivity.activityId,\n\t\t\t\t\t\t\t\tpushToken: registration.liveActivity.pushToken,\n\t\t\t\t\t\t\t\t...(registration.liveActivity.tokenHash === undefined\n\t\t\t\t\t\t\t\t\t? {}\n\t\t\t\t\t\t\t\t\t: { tokenHash: registration.liveActivity.tokenHash }),\n\t\t\t\t\t\t\t\t...(registration.liveActivity.tokenEnvironment === undefined\n\t\t\t\t\t\t\t\t\t? {}\n\t\t\t\t\t\t\t\t\t: { tokenEnvironment: registration.liveActivity.tokenEnvironment }),\n\t\t\t\t\t\t\t\tupdatedAt: now,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}),\n\t\t\t\tenabled: registration.enabled,\n\t\t\t\tcreatedAt: now,\n\t\t\t\tupdatedAt: now,\n\t\t\t};\n\t\t\tconst client = await this.stateManager.upsertClientPushTarget(this.clientNodeId, pushTarget);\n\t\t\tif (!client) {\n\t\t\t\tthrow new Error(\"paired client not found\");\n\t\t\t}\n\t\t\tawait this.log({\n\t\t\t\ttype: \"push_target_registered\",\n\t\t\t\tclientNodeId: this.clientNodeId,\n\t\t\t\tworkspace: this.workspace,\n\t\t\t\tsuccess: true,\n\t\t\t\tdetails: getPushTargetAuditDetails(pushTarget),\n\t\t\t});\n\t\t\treturn { status: \"registered\", pushTargetId: registration.pushTargetId };\n\t\t} catch (error: unknown) {\n\t\t\tconst errorMessage = toErrorMessage(error);\n\t\t\tconst redactedError =\n\t\t\t\tregistration.pushTargetAuthToken.length === 0\n\t\t\t\t\t? errorMessage\n\t\t\t\t\t: errorMessage.split(registration.pushTargetAuthToken).join(\"[redacted-push-target-auth-token]\");\n\t\t\tawait this.log({\n\t\t\t\ttype: \"push_target_registered\",\n\t\t\t\tclientNodeId: this.clientNodeId,\n\t\t\t\tworkspace: this.workspace,\n\t\t\t\tsuccess: false,\n\t\t\t\terror: redactedError,\n\t\t\t\tdetails: {\n\t\t\t\t\tpushTargetId: registration.pushTargetId,\n\t\t\t\t\tprovider: registration.provider,\n\t\t\t\t\tplatform: registration.platform,\n\t\t\t\t\trelayUrl: registration.relayUrl,\n\t\t\t\t\ttokenHash: registration.tokenHash,\n\t\t\t\t\tliveActivityTokenHash: registration.liveActivity?.tokenHash,\n\t\t\t\t\tliveActivityTokenEnvironment: registration.liveActivity?.tokenEnvironment,\n\t\t\t\t\tenabled: registration.enabled,\n\t\t\t\t},\n\t\t\t});\n\t\t\tthrow new Error(redactedError);\n\t\t}\n\t}\n\n\tasync deliverNotification(\n\t\tnotification: IrohRemotePushNotificationIntent,\n\t): Promise<IrohRemotePushNotificationDeliveryStatus> {\n\t\tif (!(await this.markDeliveryIntent(notification.eventId, notification.kind))) {\n\t\t\treturn \"duplicate\";\n\t\t}\n\n\t\tconst client = await this.stateManager.getClient(this.clientNodeId);\n\t\tconst pushTarget = selectEnabledPushTarget(client?.pushTargets ?? []);\n\t\tif (!pushTarget) {\n\t\t\tawait this.logPushFallback(notification.eventId, notification.kind, \"no_push_target\");\n\t\t\treturn \"no_push_target\";\n\t\t}\n\n\t\tconst relayRequest = createRelayNotificationRequest(pushTarget, notification);\n\t\ttry {\n\t\t\tconst relayResult = await this.sendNotificationWithRetry(relayRequest);\n\t\t\tif (relayResult.status === \"invalid_target\") {\n\t\t\t\tawait this.stateManager.disableClientPushTarget(this.clientNodeId, pushTarget.id, this.now());\n\t\t\t\tawait this.logPushDelivery(\n\t\t\t\t\tpushTarget,\n\t\t\t\t\tnotification.eventId,\n\t\t\t\t\tnotification.kind,\n\t\t\t\t\tfalse,\n\t\t\t\t\t\"push target is invalid or unregistered\",\n\t\t\t\t);\n\t\t\t\treturn \"invalid_target\";\n\t\t\t}\n\t\t\tawait this.logPushDelivery(pushTarget, notification.eventId, notification.kind, true);\n\t\t\treturn \"sent\";\n\t\t} catch (error: unknown) {\n\t\t\t// Release the dedup claim so a transient relay failure can be retried on a\n\t\t\t// later re-emission instead of being permanently suppressed as delivered.\n\t\t\tthis.deduper.unmark(this.clientNodeId, notification.eventId);\n\t\t\tawait this.logPushDelivery(pushTarget, notification.eventId, notification.kind, false, toErrorMessage(error));\n\t\t\treturn \"failed\";\n\t\t}\n\t}\n\n\tasync deliverLiveActivityUpdate(\n\t\tupdate: IrohRemoteLiveActivityUpdateIntent,\n\t): Promise<IrohRemotePushNotificationDeliveryStatus> {\n\t\tif (!(await this.markDeliveryIntent(update.eventId, update.kind))) {\n\t\t\treturn \"duplicate\";\n\t\t}\n\n\t\tconst client = await this.stateManager.getClient(this.clientNodeId);\n\t\tconst registration = selectLiveActivityRegistration(client, update.contentState);\n\t\tconst pushTarget = registration ? findRegisteredLiveActivityPushTarget(client, registration) : undefined;\n\t\tif (!registration || !pushTarget?.liveActivity) {\n\t\t\tawait this.logPushFallback(update.eventId, update.kind, \"no_live_activity_target\");\n\t\t\treturn \"no_push_target\";\n\t\t}\n\n\t\tconst relayRequest = createRelayLiveActivityRequest(pushTarget, update, registration.activityId);\n\t\ttry {\n\t\t\tconst relayResult = await this.sendLiveActivityUpdateWithRetry(relayRequest);\n\t\t\tif (relayResult.status === \"invalid_target\") {\n\t\t\t\tawait this.stateManager.pruneClientLiveActivityDeliveryChannel(this.clientNodeId, registration, this.now());\n\t\t\t\tawait this.logPushDelivery(\n\t\t\t\t\tpushTarget,\n\t\t\t\t\tupdate.eventId,\n\t\t\t\t\tupdate.kind,\n\t\t\t\t\tfalse,\n\t\t\t\t\t\"live activity target is invalid or unregistered\",\n\t\t\t\t\tregistration.tokenHash,\n\t\t\t\t);\n\t\t\t\treturn \"invalid_target\";\n\t\t\t}\n\t\t\tawait this.logPushDelivery(pushTarget, update.eventId, update.kind, true, undefined, registration.tokenHash);\n\t\t\treturn \"sent\";\n\t\t} catch (error: unknown) {\n\t\t\t// Release the dedup claim so a transient relay failure can be retried on a\n\t\t\t// later re-emission instead of being permanently suppressed as delivered.\n\t\t\tthis.deduper.unmark(this.clientNodeId, update.eventId);\n\t\t\tawait this.logPushDelivery(\n\t\t\t\tpushTarget,\n\t\t\t\tupdate.eventId,\n\t\t\t\tupdate.kind,\n\t\t\t\tfalse,\n\t\t\t\ttoErrorMessage(error),\n\t\t\t\tregistration.tokenHash,\n\t\t\t);\n\t\t\treturn \"failed\";\n\t\t}\n\t}\n\n\tprivate async markDeliveryIntent(eventId: string, kind: string): Promise<boolean> {\n\t\tif (this.deduper.tryMark(this.clientNodeId, eventId)) {\n\t\t\treturn true;\n\t\t}\n\t\tawait this.log({\n\t\t\ttype: \"push_notification_deduplicated\",\n\t\t\tclientNodeId: this.clientNodeId,\n\t\t\tworkspace: this.workspace,\n\t\t\tsuccess: true,\n\t\t\tdetails: { eventId, kind },\n\t\t});\n\t\treturn false;\n\t}\n\n\tprivate async logPushFallback(eventId: string, kind: string, reason: string): Promise<void> {\n\t\tawait this.log({\n\t\t\ttype: \"push_notification_fallback\",\n\t\t\tclientNodeId: this.clientNodeId,\n\t\t\tworkspace: this.workspace,\n\t\t\tsuccess: true,\n\t\t\tdetails: { eventId, kind, reason },\n\t\t});\n\t}\n\n\tprivate async sendNotificationWithRetry(\n\t\trequest: IrohRemotePushRelayNotificationRequest,\n\t): Promise<IrohRemotePushRelayNotificationResult> {\n\t\treturn this.sendWithRetry(() => this.relayClient.sendNotification(request));\n\t}\n\n\tprivate async sendLiveActivityUpdateWithRetry(\n\t\trequest: IrohRemotePushRelayLiveActivityRequest,\n\t): Promise<IrohRemotePushRelayNotificationResult> {\n\t\tconst sendLiveActivityUpdate = this.relayClient.sendLiveActivityUpdate?.bind(this.relayClient);\n\t\tif (!sendLiveActivityUpdate) {\n\t\t\tthrow new Error(\"push relay does not support live activity updates\");\n\t\t}\n\t\treturn this.sendWithRetry(() => sendLiveActivityUpdate(request));\n\t}\n\n\tprivate async sendWithRetry(\n\t\tsend: () => Promise<IrohRemotePushRelayNotificationResult>,\n\t): Promise<IrohRemotePushRelayNotificationResult> {\n\t\tlet lastError: unknown;\n\t\tfor (let attempt = 1; attempt <= this.retryAttempts; attempt += 1) {\n\t\t\ttry {\n\t\t\t\treturn await send();\n\t\t\t} catch (error: unknown) {\n\t\t\t\tlastError = error;\n\t\t\t\tif (attempt >= this.retryAttempts || !isTransientPushRelayError(error)) {\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\tawait delay(this.retryDelayMs * attempt);\n\t\t\t}\n\t\t}\n\t\tthrow lastError;\n\t}\n\n\tprivate async logPushDelivery(\n\t\tpushTarget: IrohRemotePushTarget,\n\t\teventId: string,\n\t\tkind: string,\n\t\tsuccess: boolean,\n\t\terror?: string,\n\t\tdeliveredTokenHash?: string,\n\t): Promise<void> {\n\t\tawait this.log({\n\t\t\ttype: \"push_notification_delivered\",\n\t\t\tclientNodeId: this.clientNodeId,\n\t\t\tworkspace: this.workspace,\n\t\t\tsuccess,\n\t\t\terror,\n\t\t\tdetails: {\n\t\t\t\teventId,\n\t\t\t\tkind,\n\t\t\t\tpushTargetId: pushTarget.id,\n\t\t\t\tprovider: pushTarget.provider,\n\t\t\t\tplatform: pushTarget.platform,\n\t\t\t\ttokenHash: deliveredTokenHash ?? pushTarget.tokenHash,\n\t\t\t},\n\t\t});\n\t}\n\n\tprivate async log(event: IrohRemoteAuditEventInput): Promise<void> {\n\t\tif (!this.auditLogger) {\n\t\t\treturn;\n\t\t}\n\t\ttry {\n\t\t\tawait this.auditLogger.log(event);\n\t\t} catch {\n\t\t\t// Push relay side effects should not be reinterpreted as RPC failures if audit I/O fails.\n\t\t}\n\t}\n}\n\nexport function hashIrohRemotePushToken(token: string): string {\n\treturn `sha256:${createHash(\"sha256\").update(token, \"utf8\").digest(\"base64url\")}`;\n}\n\nexport function parseRegisterPushTargetArgs(value: unknown): RpcRegisterPushTargetArgs {\n\tconst args = expectRecord(value, \"register_push_target args\");\n\treturn {\n\t\tprovider: expectPushProvider(args.provider),\n\t\tplatform: expectPushPlatform(args.platform),\n\t\tpushTargetId: expectString(args.pushTargetId, \"push target id\"),\n\t\tpushTargetAuthToken: expectString(args.pushTargetAuthToken, \"push target auth token\"),\n\t\trelayUrl: expectOptionalString(args.relayUrl, \"push relay URL\"),\n\t\ttokenHash: expectOptionalString(args.tokenHash, \"push token hash\"),\n\t\tliveActivity: parseOptionalLiveActivityRegistration(args.liveActivity, \"push liveActivity\"),\n\t\tenabled: expectBoolean(args.enabled, \"push enabled\"),\n\t};\n}\n\nfunction parseOptionalLiveActivityRegistration(\n\tvalue: unknown,\n\tlabel: string,\n): RpcRegisterPushTargetArgs[\"liveActivity\"] {\n\tif (value === undefined) {\n\t\treturn undefined;\n\t}\n\tconst liveActivity = expectRecord(value, label);\n\treturn {\n\t\tactivityId: expectString(liveActivity.activityId, `${label} activityId`),\n\t\tpushToken: expectString(liveActivity.pushToken, `${label} pushToken`),\n\t\ttokenHash: expectOptionalString(liveActivity.tokenHash, `${label} tokenHash`),\n\t\ttokenEnvironment: expectOptionalPushTokenEnvironment(liveActivity.tokenEnvironment, `${label} tokenEnvironment`),\n\t};\n}\n\nfunction selectEnabledPushTarget(pushTargets: IrohRemotePushTarget[]): IrohRemotePushTarget | undefined {\n\treturn pushTargets\n\t\t.filter((target) => target.enabled)\n\t\t.sort((a, b) => b.updatedAt - a.updatedAt || b.createdAt - a.createdAt)[0];\n}\n\nfunction createRelayNotificationRequest(\n\tpushTarget: IrohRemotePushTarget,\n\tnotification: IrohRemotePushNotificationIntent,\n): IrohRemotePushRelayNotificationRequest {\n\tconst workspace = getSafeNotificationWorkspace(notification.workspace);\n\treturn {\n\t\tpushTargetId: pushTarget.id,\n\t\tpushTargetAuthToken: pushTarget.pushTargetAuthToken,\n\t\teventId: notification.eventId,\n\t\tkind: notification.kind,\n\t\ttitle: notification.title,\n\t\tbody: notification.body,\n\t\t...(workspace === undefined ? {} : { workspace }),\n\t\tdata: {\n\t\t\teventId: notification.eventId,\n\t\t\tkind: notification.kind,\n\t\t\t...(notification.sessionId === undefined ? {} : { sessionId: notification.sessionId }),\n\t\t\t...(workspace === undefined ? {} : { workspace }),\n\t\t},\n\t};\n}\n\nfunction getSafeNotificationWorkspace(workspace: string | undefined): string | undefined {\n\tif (workspace === undefined) {\n\t\treturn undefined;\n\t}\n\tconst trimmed = workspace.trim();\n\tif (trimmed.length === 0 || trimmed.includes(\"/\") || trimmed.includes(\"\\\\\") || trimmed.includes(\"\\0\")) {\n\t\treturn undefined;\n\t}\n\treturn trimmed;\n}\n\nfunction createRelayLiveActivityRequest(\n\tpushTarget: IrohRemotePushTarget,\n\tupdate: IrohRemoteLiveActivityUpdateIntent,\n\tactivityId = pushTarget.liveActivity?.activityId,\n): IrohRemotePushRelayLiveActivityRequest {\n\tif (!pushTarget.liveActivity) {\n\t\tthrow new Error(\"push target has no live activity token\");\n\t}\n\tif (!activityId) {\n\t\tthrow new Error(\"live activity registration has no activity id\");\n\t}\n\treturn {\n\t\tpushTargetId: pushTarget.id,\n\t\tpushTargetAuthToken: pushTarget.pushTargetAuthToken,\n\t\tactivityId,\n\t\tactivityPushToken: pushTarget.liveActivity.pushToken,\n\t\t...(pushTarget.liveActivity.tokenEnvironment === undefined\n\t\t\t? {}\n\t\t\t: { tokenEnvironment: pushTarget.liveActivity.tokenEnvironment }),\n\t\teventId: update.eventId,\n\t\tkind: update.kind,\n\t\tcontentState: update.contentState,\n\t\t...(update.activityEvent === undefined ? {} : { activityEvent: update.activityEvent }),\n\t\t...(update.staleDateEpochSeconds === undefined ? {} : { staleDateEpochSeconds: update.staleDateEpochSeconds }),\n\t\t...(update.dismissalDateEpochSeconds === undefined\n\t\t\t? {}\n\t\t\t: { dismissalDateEpochSeconds: update.dismissalDateEpochSeconds }),\n\t};\n}\n\nfunction getPushTargetAuditDetails(pushTarget: IrohRemotePushTarget): Record<string, unknown> {\n\treturn {\n\t\tpushTargetId: pushTarget.id,\n\t\tprovider: pushTarget.provider,\n\t\tplatform: pushTarget.platform,\n\t\trelayUrl: pushTarget.relayUrl,\n\t\ttokenHash: pushTarget.tokenHash,\n\t\tliveActivityTokenHash: pushTarget.liveActivity?.tokenHash,\n\t\tliveActivityTokenEnvironment: pushTarget.liveActivity?.tokenEnvironment,\n\t\tenabled: pushTarget.enabled,\n\t\tcreatedAt: pushTarget.createdAt,\n\t\tupdatedAt: pushTarget.updatedAt,\n\t};\n}\n\nfunction selectLiveActivityRegistration(\n\tclient: IrohRemoteClient | undefined,\n\tcontentState: IrohRemoteLiveActivityContentState,\n): IrohRemoteLiveActivityRegistration | undefined {\n\tconst workspaceName = contentState.workspaceName;\n\tconst sessionId = contentState.sessionID;\n\tif (!workspaceName || !sessionId) {\n\t\treturn undefined;\n\t}\n\treturn (client?.liveActivities ?? [])\n\t\t.filter((registration) => {\n\t\t\treturn registration.workspaceName === workspaceName && registration.sessionId === sessionId;\n\t\t})\n\t\t.sort((a, b) => b.updatedAt - a.updatedAt || b.createdAt - a.createdAt)[0];\n}\n\nfunction findRegisteredLiveActivityPushTarget(\n\tclient: IrohRemoteClient | undefined,\n\tregistration: IrohRemoteLiveActivityRegistration,\n): IrohRemotePushTarget | undefined {\n\treturn client?.pushTargets?.find((target) => {\n\t\treturn (\n\t\t\ttarget.id === registration.pushTargetId &&\n\t\t\ttarget.platform === registration.platform &&\n\t\t\ttarget.liveActivity?.tokenHash === registration.tokenHash &&\n\t\t\ttarget.liveActivity.tokenEnvironment === registration.tokenEnvironment\n\t\t);\n\t});\n}\n\nfunction isTransientPushRelayError(error: unknown): boolean {\n\tif (error instanceof IrohRemotePushRelayHttpError) {\n\t\treturn error.transient;\n\t}\n\treturn true;\n}\n\nfunction isTransientHttpStatus(status: number): boolean {\n\treturn status === 408 || status === 409 || status === 425 || status === 429 || status >= 500;\n}\n\nfunction toErrorMessage(error: unknown): string {\n\treturn error instanceof Error ? error.message : String(error);\n}\n\nfunction expectRecord(value: unknown, label: string): Record<string, unknown> {\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n\t\tthrow new Error(`${label} must be an object`);\n\t}\n\treturn value as Record<string, unknown>;\n}\n\nfunction expectString(value: unknown, label: string): string {\n\tif (typeof value !== \"string\" || value.length === 0) {\n\t\tthrow new Error(`${label} must be a non-empty string`);\n\t}\n\treturn value;\n}\n\nfunction expectOptionalString(value: unknown, label: string): string | undefined {\n\tif (value === undefined) {\n\t\treturn undefined;\n\t}\n\treturn expectString(value, label);\n}\n\nfunction expectBoolean(value: unknown, label: string): boolean {\n\tif (typeof value !== \"boolean\") {\n\t\tthrow new Error(`${label} must be a boolean`);\n\t}\n\treturn value;\n}\n\nfunction expectPushProvider(value: unknown): IrohRemotePushTargetProvider {\n\tif (value === \"fcm\") {\n\t\treturn value;\n\t}\n\tthrow new Error(\"push provider must be fcm\");\n}\n\nfunction expectPushPlatform(value: unknown): IrohRemotePushTargetPlatform {\n\tif (value === \"ios\") {\n\t\treturn value;\n\t}\n\tthrow new Error(\"push platform must be ios\");\n}\n\nfunction expectOptionalPushTokenEnvironment(value: unknown, label: string): IrohRemotePushTokenEnvironment | undefined {\n\tif (value === undefined) {\n\t\treturn undefined;\n\t}\n\tif (value === \"development\" || value === \"production\") {\n\t\treturn value;\n\t}\n\tthrow new Error(`${label} must be development or production`);\n}\n\nfunction delay(ms: number): Promise<void> {\n\tif (ms === 0) {\n\t\treturn Promise.resolve();\n\t}\n\treturn new Promise((resolve) => {\n\t\tsetTimeout(resolve, ms);\n\t});\n}\n"]}

package/dist/core/remote/iroh/qr.d.ts

@@ -0,0 +1,12 @@
+export interface IrohRemoteTicketQrCode {
+    modules: boolean[][];
+    size: number;
+    version: number;
+}
+export interface IrohRemoteTicketQrCodeFormatOptions {
+    small?: boolean;
+}
+export declare function createIrohRemoteTicketQrCode(ticket: string): IrohRemoteTicketQrCode;
+export declare function formatIrohRemoteTicketQrCode(ticket: string, options?: IrohRemoteTicketQrCodeFormatOptions): string;
+export declare function formatIrohRemoteTicketQrCodeTerminal(ticket: string, options?: IrohRemoteTicketQrCodeFormatOptions): string;
+//# sourceMappingURL=qr.d.ts.map

package/dist/core/remote/iroh/qr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qr.d.ts","sourceRoot":"","sources":["../../../../src/core/remote/iroh/qr.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,sBAAsB;IACtC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mCAAmC;IACnD,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,sBAAsB,CAUnF;AAED,wBAAgB,4BAA4B,CAC3C,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,mCAAwC,GAC/C,MAAM,CAER;AAED,wBAAgB,oCAAoC,CACnD,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,mCAAwC,GAC/C,MAAM,CAOR","sourcesContent":["import QRCodeTerminal from \"qrcode-terminal\";\nimport QRCode from \"qrcode-terminal/vendor/QRCode/index.js\";\nimport QRErrorCorrectLevel from \"qrcode-terminal/vendor/QRCode/QRErrorCorrectLevel.js\";\n\nconst IROH_REMOTE_QR_ERROR_CORRECTION_LEVEL = \"M\";\n\nexport interface IrohRemoteTicketQrCode {\n\tmodules: boolean[][];\n\tsize: number;\n\tversion: number;\n}\n\nexport interface IrohRemoteTicketQrCodeFormatOptions {\n\tsmall?: boolean;\n}\n\nexport function createIrohRemoteTicketQrCode(ticket: string): IrohRemoteTicketQrCode {\n\tconst qrCode = new QRCode(-1, QRErrorCorrectLevel[IROH_REMOTE_QR_ERROR_CORRECTION_LEVEL]);\n\tqrCode.addData(ticket);\n\tqrCode.make();\n\tconst size = qrCode.getModuleCount();\n\treturn {\n\t\tmodules: qrCode.modules.map((row) => row.map((module) => module === true)),\n\t\tsize,\n\t\tversion: Math.floor((size - 17) / 4),\n\t};\n}\n\nexport function formatIrohRemoteTicketQrCode(\n\tticket: string,\n\toptions: IrohRemoteTicketQrCodeFormatOptions = {},\n): string {\n\treturn formatIrohRemoteTicketQrCodeTerminal(ticket, options);\n}\n\nexport function formatIrohRemoteTicketQrCodeTerminal(\n\tticket: string,\n\toptions: IrohRemoteTicketQrCodeFormatOptions = {},\n): string {\n\tlet output = \"\";\n\tQRCodeTerminal.setErrorLevel(IROH_REMOTE_QR_ERROR_CORRECTION_LEVEL);\n\tQRCodeTerminal.generate(ticket, { small: options.small ?? true }, (qrCode) => {\n\t\toutput = qrCode;\n\t});\n\treturn output;\n}\n"]}

package/dist/core/remote/iroh/qr.js

@@ -0,0 +1,27 @@
+import QRCodeTerminal from "qrcode-terminal";
+import QRCode from "qrcode-terminal/vendor/QRCode/index.js";
+import QRErrorCorrectLevel from "qrcode-terminal/vendor/QRCode/QRErrorCorrectLevel.js";
+const IROH_REMOTE_QR_ERROR_CORRECTION_LEVEL = "M";
+export function createIrohRemoteTicketQrCode(ticket) {
+    const qrCode = new QRCode(-1, QRErrorCorrectLevel[IROH_REMOTE_QR_ERROR_CORRECTION_LEVEL]);
+    qrCode.addData(ticket);
+    qrCode.make();
+    const size = qrCode.getModuleCount();
+    return {
+        modules: qrCode.modules.map((row) => row.map((module) => module === true)),
+        size,
+        version: Math.floor((size - 17) / 4),
+    };
+}
+export function formatIrohRemoteTicketQrCode(ticket, options = {}) {
+    return formatIrohRemoteTicketQrCodeTerminal(ticket, options);
+}
+export function formatIrohRemoteTicketQrCodeTerminal(ticket, options = {}) {
+    let output = "";
+    QRCodeTerminal.setErrorLevel(IROH_REMOTE_QR_ERROR_CORRECTION_LEVEL);
+    QRCodeTerminal.generate(ticket, { small: options.small ?? true }, (qrCode) => {
+        output = qrCode;
+    });
+    return output;
+}
+//# sourceMappingURL=qr.js.map

package/dist/core/remote/iroh/qr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"qr.js","sourceRoot":"","sources":["../../../../src/core/remote/iroh/qr.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iBAAiB,CAAC;AAC7C,OAAO,MAAM,MAAM,wCAAwC,CAAC;AAC5D,OAAO,mBAAmB,MAAM,sDAAsD,CAAC;AAEvF,MAAM,qCAAqC,GAAG,GAAG,CAAC;AAYlD,MAAM,UAAU,4BAA4B,CAAC,MAAc,EAA0B;IACpF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC,qCAAqC,CAAC,CAAC,CAAC;IAC1F,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvB,MAAM,CAAC,IAAI,EAAE,CAAC;IACd,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;IACrC,OAAO;QACN,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;QAC1E,IAAI;QACJ,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;KACpC,CAAC;AAAA,CACF;AAED,MAAM,UAAU,4BAA4B,CAC3C,MAAc,EACd,OAAO,GAAwC,EAAE,EACxC;IACT,OAAO,oCAAoC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAAA,CAC7D;AAED,MAAM,UAAU,oCAAoC,CACnD,MAAc,EACd,OAAO,GAAwC,EAAE,EACxC;IACT,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,cAAc,CAAC,aAAa,CAAC,qCAAqC,CAAC,CAAC;IACpE,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7E,MAAM,GAAG,MAAM,CAAC;IAAA,CAChB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAAA,CACd","sourcesContent":["import QRCodeTerminal from \"qrcode-terminal\";\nimport QRCode from \"qrcode-terminal/vendor/QRCode/index.js\";\nimport QRErrorCorrectLevel from \"qrcode-terminal/vendor/QRCode/QRErrorCorrectLevel.js\";\n\nconst IROH_REMOTE_QR_ERROR_CORRECTION_LEVEL = \"M\";\n\nexport interface IrohRemoteTicketQrCode {\n\tmodules: boolean[][];\n\tsize: number;\n\tversion: number;\n}\n\nexport interface IrohRemoteTicketQrCodeFormatOptions {\n\tsmall?: boolean;\n}\n\nexport function createIrohRemoteTicketQrCode(ticket: string): IrohRemoteTicketQrCode {\n\tconst qrCode = new QRCode(-1, QRErrorCorrectLevel[IROH_REMOTE_QR_ERROR_CORRECTION_LEVEL]);\n\tqrCode.addData(ticket);\n\tqrCode.make();\n\tconst size = qrCode.getModuleCount();\n\treturn {\n\t\tmodules: qrCode.modules.map((row) => row.map((module) => module === true)),\n\t\tsize,\n\t\tversion: Math.floor((size - 17) / 4),\n\t};\n}\n\nexport function formatIrohRemoteTicketQrCode(\n\tticket: string,\n\toptions: IrohRemoteTicketQrCodeFormatOptions = {},\n): string {\n\treturn formatIrohRemoteTicketQrCodeTerminal(ticket, options);\n}\n\nexport function formatIrohRemoteTicketQrCodeTerminal(\n\tticket: string,\n\toptions: IrohRemoteTicketQrCodeFormatOptions = {},\n): string {\n\tlet output = \"\";\n\tQRCodeTerminal.setErrorLevel(IROH_REMOTE_QR_ERROR_CORRECTION_LEVEL);\n\tQRCodeTerminal.generate(ticket, { small: options.small ?? true }, (qrCode) => {\n\t\toutput = qrCode;\n\t});\n\treturn output;\n}\n"]}

package/dist/core/remote/iroh/rpc-command-filter.d.ts

@@ -0,0 +1,47 @@
+import { type IrohRemoteRpcCapability, type IrohRemoteRpcGrant } from "./access-grant.ts";
+export declare const IROH_REMOTE_RPC_CANCELLATION_TYPES: Set<string>;
+export declare const IROH_REMOTE_RPC_UNSUPPORTED_TYPES: Set<string>;
+export declare const IROH_REMOTE_RPC_PASSTHROUGH_TYPES: Set<string>;
+export interface IrohRemoteRpcCommand extends Record<string, unknown> {
+    type: string;
+}
+export interface IrohRemoteRpcCapabilityDeniedError {
+    code: "rpc_capability_denied";
+    message: string;
+    requiredCapability: IrohRemoteRpcCapability;
+}
+export interface IrohRemoteRpcErrorResponse {
+    id?: string;
+    type: "response";
+    command: string;
+    success: false;
+    error: string;
+}
+export interface IrohRemoteRpcCapabilityDeniedResponse {
+    id?: string;
+    type: "response";
+    command: string;
+    success: false;
+    error: IrohRemoteRpcCapabilityDeniedError;
+}
+export type IrohRemoteStaticRpcFilterResult = {
+    allowed: true;
+    command: IrohRemoteRpcCommand;
+} | {
+    allowed: false;
+    response: IrohRemoteRpcErrorResponse;
+};
+export type IrohRemoteRpcFilterResult = {
+    allowed: true;
+    command: IrohRemoteRpcCommand;
+} | {
+    allowed: false;
+    response: IrohRemoteRpcErrorResponse | IrohRemoteRpcCapabilityDeniedResponse;
+};
+export declare function getIrohRemoteRpcFilterResult(line: string, rpcGrant: IrohRemoteRpcGrant): IrohRemoteRpcFilterResult;
+/** Low-level syntax and hard-allowlist classifier. Remote serving must also apply an RPC grant. */
+export declare function getStaticIrohRemoteRpcFilterResult(line: string): IrohRemoteStaticRpcFilterResult;
+export declare function serializeIrohRemoteRpcFilterRejection(response: IrohRemoteRpcErrorResponse | IrohRemoteRpcCapabilityDeniedResponse): string;
+export declare function createIrohRemoteRpcErrorResponse(id: string | undefined, command: string, error: string): IrohRemoteRpcErrorResponse;
+export declare function createIrohRemoteRpcCapabilityDeniedResponse(id: string | undefined, command: string, requiredCapability: IrohRemoteRpcCapability): IrohRemoteRpcCapabilityDeniedResponse;
+//# sourceMappingURL=rpc-command-filter.d.ts.map

package/dist/core/remote/iroh/rpc-command-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc-command-filter.d.ts","sourceRoot":"","sources":["../../../../src/core/remote/iroh/rpc-command-filter.ts"],"names":[],"mappings":"AAEA,OAAO,EAGN,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAEvB,MAAM,mBAAmB,CAAC;AAE3B,eAAO,MAAM,kCAAkC,aAAqB,CAAC;AAErE,eAAO,MAAM,iCAAiC,aAA4B,CAAC;AAE3E,eAAO,MAAM,iCAAiC,aAiD5C,CAAC;AAIH,MAAM,WAAW,oBAAqB,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACpE,IAAI,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kCAAkC;IAClD,IAAI,EAAE,uBAAuB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,uBAAuB,CAAC;CAC5C;AAED,MAAM,WAAW,0BAA0B;IAC1C,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,qCAAqC;IACrD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,EAAE,kCAAkC,CAAC;CAC1C;AAED,MAAM,MAAM,+BAA+B,GACxC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GAChD;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,0BAA0B,CAAA;CAAE,CAAC;AAE5D,MAAM,MAAM,yBAAyB,GAClC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GAChD;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,0BAA0B,GAAG,qCAAqC,CAAA;CAAE,CAAC;AAEpG,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,yBAAyB,CAyClH;AAED,mGAAmG;AACnG,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,MAAM,GAAG,+BAA+B,CAiEhG;AA6DD,wBAAgB,qCAAqC,CACpD,QAAQ,EAAE,0BAA0B,GAAG,qCAAqC,GAC1E,MAAM,CAER;AAED,wBAAgB,gCAAgC,CAC/C,EAAE,EAAE,MAAM,GAAG,SAAS,EACtB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACX,0BAA0B,CAE5B;AAED,wBAAgB,2CAA2C,CAC1D,EAAE,EAAE,MAAM,GAAG,SAAS,EACtB,OAAO,EAAE,MAAM,EACf,kBAAkB,EAAE,uBAAuB,GACzC,qCAAqC,CAYvC","sourcesContent":["import { isRemoteSafeBuiltinHostActionId } from \"../../host-actions.ts\";\nimport { serializeJsonLine } from \"../../rpc/jsonl.ts\";\nimport {\n\tgetIrohRemoteRpcCommandCapabilities,\n\tgetMissingIrohRemoteRpcCapability,\n\ttype IrohRemoteRpcCapability,\n\ttype IrohRemoteRpcGrant,\n\tparseIrohRemoteRpcGrant,\n} from \"./access-grant.ts\";\n\nexport const IROH_REMOTE_RPC_CANCELLATION_TYPES = new Set([\"abort\"]);\n\nexport const IROH_REMOTE_RPC_UNSUPPORTED_TYPES = new Set([\"get_messages\"]);\n\nexport const IROH_REMOTE_RPC_PASSTHROUGH_TYPES = new Set([\n\t\"prompt\",\n\t\"steer\",\n\t\"follow_up\",\n\t...IROH_REMOTE_RPC_CANCELLATION_TYPES,\n\t\"new_session\",\n\t\"set_client_capabilities\",\n\t\"get_pending_host_actions\",\n\t\"host_action_response\",\n\t\"get_state\",\n\t\"get_transcript\",\n\t\"get_message_images\",\n\t\"get_mcp_capabilities\",\n\t\"list_mcp_servers\",\n\t\"get_mcp_server\",\n\t\"connect_mcp_server\",\n\t\"refresh_mcp_server\",\n\t\"set_mcp_server_enabled\",\n\t\"list_mcp_recent_calls\",\n\t\"list_mcp_tools\",\n\t\"get_mcp_tool\",\n\t\"list_mcp_resources\",\n\t\"read_mcp_resource\",\n\t\"list_mcp_prompts\",\n\t\"get_mcp_prompt\",\n\t\"disconnect_mcp_server\",\n\t\"poll_mcp_server_auth\",\n\t\"cancel_mcp_server_auth\",\n\t\"logout_mcp_server\",\n\t\"get_ui_capabilities\",\n\t\"get_ui_actions\",\n\t\"list_sessions\",\n\t\"switch_session_by_id\",\n\t\"register_push_target\",\n\t\"register_live_activity\",\n\t\"unregister_live_activity\",\n\t\"unregister_workspace\",\n\t// worktrees.v1: create/list only — remove_worktree is management-stream-only.\n\t\"create_worktree\",\n\t\"list_worktrees\",\n\t\"set_keep_awake\",\n\t\"get_keep_awake\",\n\t\"set_web_search_key\",\n\t\"get_web_search_status\",\n\t\"upload_device_logs\",\n\t\"extension_ui_response\",\n\t\"get_available_models\",\n\t\"set_model\",\n\t\"set_thinking_level\",\n]);\n\nconst IROH_REMOTE_UI_ACTION_PREFIXES = [\"extension.command.\", \"prompt.template.\", \"skill.\"] as const;\n\nexport interface IrohRemoteRpcCommand extends Record<string, unknown> {\n\ttype: string;\n}\n\nexport interface IrohRemoteRpcCapabilityDeniedError {\n\tcode: \"rpc_capability_denied\";\n\tmessage: string;\n\trequiredCapability: IrohRemoteRpcCapability;\n}\n\nexport interface IrohRemoteRpcErrorResponse {\n\tid?: string;\n\ttype: \"response\";\n\tcommand: string;\n\tsuccess: false;\n\terror: string;\n}\n\nexport interface IrohRemoteRpcCapabilityDeniedResponse {\n\tid?: string;\n\ttype: \"response\";\n\tcommand: string;\n\tsuccess: false;\n\terror: IrohRemoteRpcCapabilityDeniedError;\n}\n\nexport type IrohRemoteStaticRpcFilterResult =\n\t| { allowed: true; command: IrohRemoteRpcCommand }\n\t| { allowed: false; response: IrohRemoteRpcErrorResponse };\n\nexport type IrohRemoteRpcFilterResult =\n\t| { allowed: true; command: IrohRemoteRpcCommand }\n\t| { allowed: false; response: IrohRemoteRpcErrorResponse | IrohRemoteRpcCapabilityDeniedResponse };\n\nexport function getIrohRemoteRpcFilterResult(line: string, rpcGrant: IrohRemoteRpcGrant): IrohRemoteRpcFilterResult {\n\tconst staticResult = getStaticIrohRemoteRpcFilterResult(line);\n\tif (!staticResult.allowed) {\n\t\treturn staticResult;\n\t}\n\tlet granted: IrohRemoteRpcGrant;\n\ttry {\n\t\tgranted = parseIrohRemoteRpcGrant(rpcGrant, \"remote RPC grant\");\n\t} catch {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tresponse: createIrohRemoteRpcErrorResponse(\n\t\t\t\ttypeof staticResult.command.id === \"string\" ? staticResult.command.id : undefined,\n\t\t\t\tstaticResult.command.type,\n\t\t\t\t\"Remote RPC grant is missing or malformed\",\n\t\t\t),\n\t\t};\n\t}\n\tconst required = getIrohRemoteRpcCommandCapabilities(staticResult.command);\n\tif (required === undefined) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tresponse: createIrohRemoteRpcErrorResponse(\n\t\t\t\ttypeof staticResult.command.id === \"string\" ? staticResult.command.id : undefined,\n\t\t\t\tstaticResult.command.type,\n\t\t\t\t`RPC command has no capability classification: ${staticResult.command.type}`,\n\t\t\t),\n\t\t};\n\t}\n\tconst missing = getMissingIrohRemoteRpcCapability(granted, required);\n\tif (missing === undefined) {\n\t\treturn staticResult;\n\t}\n\treturn {\n\t\tallowed: false,\n\t\tresponse: createIrohRemoteRpcCapabilityDeniedResponse(\n\t\t\ttypeof staticResult.command.id === \"string\" ? staticResult.command.id : undefined,\n\t\t\tstaticResult.command.type,\n\t\t\tmissing,\n\t\t),\n\t};\n}\n\n/** Low-level syntax and hard-allowlist classifier. Remote serving must also apply an RPC grant. */\nexport function getStaticIrohRemoteRpcFilterResult(line: string): IrohRemoteStaticRpcFilterResult {\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(line);\n\t} catch (error: unknown) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tresponse: createIrohRemoteRpcErrorResponse(\n\t\t\t\tundefined,\n\t\t\t\t\"parse\",\n\t\t\t\t`Failed to parse command: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t),\n\t\t};\n\t}\n\n\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tresponse: createIrohRemoteRpcErrorResponse(\n\t\t\t\tundefined,\n\t\t\t\t\"unknown\",\n\t\t\t\t\"RPC command must be a JSON object with a string type\",\n\t\t\t),\n\t\t};\n\t}\n\tconst command = parsed as Record<string, unknown>;\n\tconst responseId = typeof command.id === \"string\" ? command.id : undefined;\n\tif (typeof command.type !== \"string\") {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tresponse: createIrohRemoteRpcErrorResponse(\n\t\t\t\tresponseId,\n\t\t\t\t\"unknown\",\n\t\t\t\t\"RPC command must be a JSON object with a string type\",\n\t\t\t),\n\t\t};\n\t}\n\n\tif (command.type === \"invoke_ui_action\" || command.type === \"get_ui_action_completions\") {\n\t\treturn getIrohRemoteUiActionCommandResult(command, responseId, command.type);\n\t}\n\n\tif (command.type === \"start_mcp_server_auth\") {\n\t\treturn getIrohRemoteMcpAuthCommandResult(command, responseId);\n\t}\n\n\tif (IROH_REMOTE_RPC_UNSUPPORTED_TYPES.has(command.type)) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tresponse: createIrohRemoteRpcErrorResponse(responseId, command.type, \"unsupported_remote_command\"),\n\t\t};\n\t}\n\n\tif (IROH_REMOTE_RPC_PASSTHROUGH_TYPES.has(command.type)) {\n\t\treturn { allowed: true, command: command as IrohRemoteRpcCommand };\n\t}\n\n\treturn {\n\t\tallowed: false,\n\t\tresponse: createIrohRemoteRpcErrorResponse(\n\t\t\tresponseId,\n\t\t\tcommand.type,\n\t\t\t`RPC command not allowed over remote host: ${command.type}`,\n\t\t),\n\t};\n}\n\nfunction getIrohRemoteMcpAuthCommandResult(\n\tcommand: Record<string, unknown>,\n\tresponseId: string | undefined,\n): IrohRemoteStaticRpcFilterResult {\n\tif (command.flow !== \"device\") {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tresponse: createIrohRemoteRpcErrorResponse(\n\t\t\t\tresponseId,\n\t\t\t\t\"start_mcp_server_auth\",\n\t\t\t\t\"Only MCP device-code auth can be started over remote host\",\n\t\t\t),\n\t\t};\n\t}\n\tif (typeof command.redirectUrl === \"string\") {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tresponse: createIrohRemoteRpcErrorResponse(\n\t\t\t\tresponseId,\n\t\t\t\t\"start_mcp_server_auth\",\n\t\t\t\t\"MCP browser redirect auth is not available over remote host\",\n\t\t\t),\n\t\t};\n\t}\n\treturn { allowed: true, command: command as IrohRemoteRpcCommand };\n}\n\nfunction getIrohRemoteUiActionCommandResult(\n\tcommand: Record<string, unknown>,\n\tresponseId: string | undefined,\n\tcommandType: \"invoke_ui_action\" | \"get_ui_action_completions\",\n): IrohRemoteStaticRpcFilterResult {\n\tconst action = command.action;\n\tif (typeof action !== \"string\" || action.length === 0) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tresponse: createIrohRemoteRpcErrorResponse(responseId, commandType, \"UI action id must be a non-empty string\"),\n\t\t};\n\t}\n\tif (!isIrohRemoteUiActionId(action)) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tresponse: createIrohRemoteRpcErrorResponse(\n\t\t\t\tresponseId,\n\t\t\t\tcommandType,\n\t\t\t\t`UI action not available over remote host: ${action}`,\n\t\t\t),\n\t\t};\n\t}\n\treturn { allowed: true, command: command as IrohRemoteRpcCommand };\n}\n\nfunction isIrohRemoteUiActionId(action: string): boolean {\n\treturn (\n\t\tisRemoteSafeBuiltinHostActionId(action) ||\n\t\tIROH_REMOTE_UI_ACTION_PREFIXES.some((prefix) => action.startsWith(prefix))\n\t);\n}\n\nexport function serializeIrohRemoteRpcFilterRejection(\n\tresponse: IrohRemoteRpcErrorResponse | IrohRemoteRpcCapabilityDeniedResponse,\n): string {\n\treturn serializeJsonLine(response);\n}\n\nexport function createIrohRemoteRpcErrorResponse(\n\tid: string | undefined,\n\tcommand: string,\n\terror: string,\n): IrohRemoteRpcErrorResponse {\n\treturn { id, type: \"response\", command, success: false, error };\n}\n\nexport function createIrohRemoteRpcCapabilityDeniedResponse(\n\tid: string | undefined,\n\tcommand: string,\n\trequiredCapability: IrohRemoteRpcCapability,\n): IrohRemoteRpcCapabilityDeniedResponse {\n\treturn {\n\t\tid,\n\t\ttype: \"response\",\n\t\tcommand,\n\t\tsuccess: false,\n\t\terror: {\n\t\t\tcode: \"rpc_capability_denied\",\n\t\t\tmessage: `RPC capability required: ${requiredCapability}`,\n\t\t\trequiredCapability,\n\t\t},\n\t};\n}\n"]}

package/dist/core/remote/iroh/rpc-command-filter.js

@@ -0,0 +1,188 @@
+import { isRemoteSafeBuiltinHostActionId } from "../../host-actions.js";
+import { serializeJsonLine } from "../../rpc/jsonl.js";
+import { getIrohRemoteRpcCommandCapabilities, getMissingIrohRemoteRpcCapability, parseIrohRemoteRpcGrant, } from "./access-grant.js";
+export const IROH_REMOTE_RPC_CANCELLATION_TYPES = new Set(["abort"]);
+export const IROH_REMOTE_RPC_UNSUPPORTED_TYPES = new Set(["get_messages"]);
+export const IROH_REMOTE_RPC_PASSTHROUGH_TYPES = new Set([
+    "prompt",
+    "steer",
+    "follow_up",
+    ...IROH_REMOTE_RPC_CANCELLATION_TYPES,
+    "new_session",
+    "set_client_capabilities",
+    "get_pending_host_actions",
+    "host_action_response",
+    "get_state",
+    "get_transcript",
+    "get_message_images",
+    "get_mcp_capabilities",
+    "list_mcp_servers",
+    "get_mcp_server",
+    "connect_mcp_server",
+    "refresh_mcp_server",
+    "set_mcp_server_enabled",
+    "list_mcp_recent_calls",
+    "list_mcp_tools",
+    "get_mcp_tool",
+    "list_mcp_resources",
+    "read_mcp_resource",
+    "list_mcp_prompts",
+    "get_mcp_prompt",
+    "disconnect_mcp_server",
+    "poll_mcp_server_auth",
+    "cancel_mcp_server_auth",
+    "logout_mcp_server",
+    "get_ui_capabilities",
+    "get_ui_actions",
+    "list_sessions",
+    "switch_session_by_id",
+    "register_push_target",
+    "register_live_activity",
+    "unregister_live_activity",
+    "unregister_workspace",
+    // worktrees.v1: create/list only — remove_worktree is management-stream-only.
+    "create_worktree",
+    "list_worktrees",
+    "set_keep_awake",
+    "get_keep_awake",
+    "set_web_search_key",
+    "get_web_search_status",
+    "upload_device_logs",
+    "extension_ui_response",
+    "get_available_models",
+    "set_model",
+    "set_thinking_level",
+]);
+const IROH_REMOTE_UI_ACTION_PREFIXES = ["extension.command.", "prompt.template.", "skill."];
+export function getIrohRemoteRpcFilterResult(line, rpcGrant) {
+    const staticResult = getStaticIrohRemoteRpcFilterResult(line);
+    if (!staticResult.allowed) {
+        return staticResult;
+    }
+    let granted;
+    try {
+        granted = parseIrohRemoteRpcGrant(rpcGrant, "remote RPC grant");
+    }
+    catch {
+        return {
+            allowed: false,
+            response: createIrohRemoteRpcErrorResponse(typeof staticResult.command.id === "string" ? staticResult.command.id : undefined, staticResult.command.type, "Remote RPC grant is missing or malformed"),
+        };
+    }
+    const required = getIrohRemoteRpcCommandCapabilities(staticResult.command);
+    if (required === undefined) {
+        return {
+            allowed: false,
+            response: createIrohRemoteRpcErrorResponse(typeof staticResult.command.id === "string" ? staticResult.command.id : undefined, staticResult.command.type, `RPC command has no capability classification: ${staticResult.command.type}`),
+        };
+    }
+    const missing = getMissingIrohRemoteRpcCapability(granted, required);
+    if (missing === undefined) {
+        return staticResult;
+    }
+    return {
+        allowed: false,
+        response: createIrohRemoteRpcCapabilityDeniedResponse(typeof staticResult.command.id === "string" ? staticResult.command.id : undefined, staticResult.command.type, missing),
+    };
+}
+/** Low-level syntax and hard-allowlist classifier. Remote serving must also apply an RPC grant. */
+export function getStaticIrohRemoteRpcFilterResult(line) {
+    let parsed;
+    try {
+        parsed = JSON.parse(line);
+    }
+    catch (error) {
+        return {
+            allowed: false,
+            response: createIrohRemoteRpcErrorResponse(undefined, "parse", `Failed to parse command: ${error instanceof Error ? error.message : String(error)}`),
+        };
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        return {
+            allowed: false,
+            response: createIrohRemoteRpcErrorResponse(undefined, "unknown", "RPC command must be a JSON object with a string type"),
+        };
+    }
+    const command = parsed;
+    const responseId = typeof command.id === "string" ? command.id : undefined;
+    if (typeof command.type !== "string") {
+        return {
+            allowed: false,
+            response: createIrohRemoteRpcErrorResponse(responseId, "unknown", "RPC command must be a JSON object with a string type"),
+        };
+    }
+    if (command.type === "invoke_ui_action" || command.type === "get_ui_action_completions") {
+        return getIrohRemoteUiActionCommandResult(command, responseId, command.type);
+    }
+    if (command.type === "start_mcp_server_auth") {
+        return getIrohRemoteMcpAuthCommandResult(command, responseId);
+    }
+    if (IROH_REMOTE_RPC_UNSUPPORTED_TYPES.has(command.type)) {
+        return {
+            allowed: false,
+            response: createIrohRemoteRpcErrorResponse(responseId, command.type, "unsupported_remote_command"),
+        };
+    }
+    if (IROH_REMOTE_RPC_PASSTHROUGH_TYPES.has(command.type)) {
+        return { allowed: true, command: command };
+    }
+    return {
+        allowed: false,
+        response: createIrohRemoteRpcErrorResponse(responseId, command.type, `RPC command not allowed over remote host: ${command.type}`),
+    };
+}
+function getIrohRemoteMcpAuthCommandResult(command, responseId) {
+    if (command.flow !== "device") {
+        return {
+            allowed: false,
+            response: createIrohRemoteRpcErrorResponse(responseId, "start_mcp_server_auth", "Only MCP device-code auth can be started over remote host"),
+        };
+    }
+    if (typeof command.redirectUrl === "string") {
+        return {
+            allowed: false,
+            response: createIrohRemoteRpcErrorResponse(responseId, "start_mcp_server_auth", "MCP browser redirect auth is not available over remote host"),
+        };
+    }
+    return { allowed: true, command: command };
+}
+function getIrohRemoteUiActionCommandResult(command, responseId, commandType) {
+    const action = command.action;
+    if (typeof action !== "string" || action.length === 0) {
+        return {
+            allowed: false,
+            response: createIrohRemoteRpcErrorResponse(responseId, commandType, "UI action id must be a non-empty string"),
+        };
+    }
+    if (!isIrohRemoteUiActionId(action)) {
+        return {
+            allowed: false,
+            response: createIrohRemoteRpcErrorResponse(responseId, commandType, `UI action not available over remote host: ${action}`),
+        };
+    }
+    return { allowed: true, command: command };
+}
+function isIrohRemoteUiActionId(action) {
+    return (isRemoteSafeBuiltinHostActionId(action) ||
+        IROH_REMOTE_UI_ACTION_PREFIXES.some((prefix) => action.startsWith(prefix)));
+}
+export function serializeIrohRemoteRpcFilterRejection(response) {
+    return serializeJsonLine(response);
+}
+export function createIrohRemoteRpcErrorResponse(id, command, error) {
+    return { id, type: "response", command, success: false, error };
+}
+export function createIrohRemoteRpcCapabilityDeniedResponse(id, command, requiredCapability) {
+    return {
+        id,
+        type: "response",
+        command,
+        success: false,
+        error: {
+            code: "rpc_capability_denied",
+            message: `RPC capability required: ${requiredCapability}`,
+            requiredCapability,
+        },
+    };
+}
+//# sourceMappingURL=rpc-command-filter.js.map

package/dist/core/remote/iroh/rpc-command-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc-command-filter.js","sourceRoot":"","sources":["../../../../src/core/remote/iroh/rpc-command-filter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACN,mCAAmC,EACnC,iCAAiC,EAGjC,uBAAuB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAErE,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAAC;IACxD,QAAQ;IACR,OAAO;IACP,WAAW;IACX,GAAG,kCAAkC;IACrC,aAAa;IACb,yBAAyB;IACzB,0BAA0B;IAC1B,sBAAsB;IACtB,WAAW;IACX,gBAAgB;IAChB,oBAAoB;IACpB,sBAAsB;IACtB,kBAAkB;IAClB,gBAAgB;IAChB,oBAAoB;IACpB,oBAAoB;IACpB,wBAAwB;IACxB,uBAAuB;IACvB,gBAAgB;IAChB,cAAc;IACd,oBAAoB;IACpB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,uBAAuB;IACvB,sBAAsB;IACtB,wBAAwB;IACxB,mBAAmB;IACnB,qBAAqB;IACrB,gBAAgB;IAChB,eAAe;IACf,sBAAsB;IACtB,sBAAsB;IACtB,wBAAwB;IACxB,0BAA0B;IAC1B,sBAAsB;IACtB,gFAA8E;IAC9E,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,oBAAoB;IACpB,uBAAuB;IACvB,oBAAoB;IACpB,uBAAuB;IACvB,sBAAsB;IACtB,WAAW;IACX,oBAAoB;CACpB,CAAC,CAAC;AAEH,MAAM,8BAA8B,GAAG,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,QAAQ,CAAU,CAAC;AAoCrG,MAAM,UAAU,4BAA4B,CAAC,IAAY,EAAE,QAA4B,EAA6B;IACnH,MAAM,YAAY,GAAG,kCAAkC,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO,YAAY,CAAC;IACrB,CAAC;IACD,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACJ,OAAO,GAAG,uBAAuB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO;YACN,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,gCAAgC,CACzC,OAAO,YAAY,CAAC,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EACjF,YAAY,CAAC,OAAO,CAAC,IAAI,EACzB,0CAA0C,CAC1C;SACD,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,mCAAmC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAC3E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACN,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,gCAAgC,CACzC,OAAO,YAAY,CAAC,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EACjF,YAAY,CAAC,OAAO,CAAC,IAAI,EACzB,iDAAiD,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAC5E;SACD,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,iCAAiC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,YAAY,CAAC;IACrB,CAAC;IACD,OAAO;QACN,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,2CAA2C,CACpD,OAAO,YAAY,CAAC,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EACjF,YAAY,CAAC,OAAO,CAAC,IAAI,EACzB,OAAO,CACP;KACD,CAAC;AAAA,CACF;AAED,mGAAmG;AACnG,MAAM,UAAU,kCAAkC,CAAC,IAAY,EAAmC;IACjG,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACzB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,gCAAgC,CACzC,SAAS,EACT,OAAO,EACP,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACpF;SACD,CAAC;IACH,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,OAAO;YACN,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,gCAAgC,CACzC,SAAS,EACT,SAAS,EACT,sDAAsD,CACtD;SACD,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAiC,CAAC;IAClD,MAAM,UAAU,GAAG,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,gCAAgC,CACzC,UAAU,EACV,SAAS,EACT,sDAAsD,CACtD;SACD,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,IAAI,OAAO,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;QACzF,OAAO,kCAAkC,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAC9C,OAAO,iCAAiC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,iCAAiC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,OAAO;YACN,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,gCAAgC,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,4BAA4B,CAAC;SAClG,CAAC;IACH,CAAC;IAED,IAAI,iCAAiC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAA+B,EAAE,CAAC;IACpE,CAAC;IAED,OAAO;QACN,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,gCAAgC,CACzC,UAAU,EACV,OAAO,CAAC,IAAI,EACZ,6CAA6C,OAAO,CAAC,IAAI,EAAE,CAC3D;KACD,CAAC;AAAA,CACF;AAED,SAAS,iCAAiC,CACzC,OAAgC,EAChC,UAA8B,EACI;IAClC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO;YACN,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,gCAAgC,CACzC,UAAU,EACV,uBAAuB,EACvB,2DAA2D,CAC3D;SACD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO;YACN,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,gCAAgC,CACzC,UAAU,EACV,uBAAuB,EACvB,6DAA6D,CAC7D;SACD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAA+B,EAAE,CAAC;AAAA,CACnE;AAED,SAAS,kCAAkC,CAC1C,OAAgC,EAChC,UAA8B,EAC9B,WAA6D,EAC3B;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO;YACN,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,gCAAgC,CAAC,UAAU,EAAE,WAAW,EAAE,yCAAyC,CAAC;SAC9G,CAAC;IACH,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,gCAAgC,CACzC,UAAU,EACV,WAAW,EACX,6CAA6C,MAAM,EAAE,CACrD;SACD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAA+B,EAAE,CAAC;AAAA,CACnE;AAED,SAAS,sBAAsB,CAAC,MAAc,EAAW;IACxD,OAAO,CACN,+BAA+B,CAAC,MAAM,CAAC;QACvC,8BAA8B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAC1E,CAAC;AAAA,CACF;AAED,MAAM,UAAU,qCAAqC,CACpD,QAA4E,EACnE;IACT,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AAAA,CACnC;AAED,MAAM,UAAU,gCAAgC,CAC/C,EAAsB,EACtB,OAAe,EACf,KAAa,EACgB;IAC7B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAAA,CAChE;AAED,MAAM,UAAU,2CAA2C,CAC1D,EAAsB,EACtB,OAAe,EACf,kBAA2C,EACH;IACxC,OAAO;QACN,EAAE;QACF,IAAI,EAAE,UAAU;QAChB,OAAO;QACP,OAAO,EAAE,KAAK;QACd,KAAK,EAAE;YACN,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,4BAA4B,kBAAkB,EAAE;YACzD,kBAAkB;SAClB;KACD,CAAC;AAAA,CACF","sourcesContent":["import { isRemoteSafeBuiltinHostActionId } from \"../../host-actions.ts\";\nimport { serializeJsonLine } from \"../../rpc/jsonl.ts\";\nimport {\n\tgetIrohRemoteRpcCommandCapabilities,\n\tgetMissingIrohRemoteRpcCapability,\n\ttype IrohRemoteRpcCapability,\n\ttype IrohRemoteRpcGrant,\n\tparseIrohRemoteRpcGrant,\n} from \"./access-grant.ts\";\n\nexport const IROH_REMOTE_RPC_CANCELLATION_TYPES = new Set([\"abort\"]);\n\nexport const IROH_REMOTE_RPC_UNSUPPORTED_TYPES = new Set([\"get_messages\"]);\n\nexport const IROH_REMOTE_RPC_PASSTHROUGH_TYPES = new Set([\n\t\"prompt\",\n\t\"steer\",\n\t\"follow_up\",\n\t...IROH_REMOTE_RPC_CANCELLATION_TYPES,\n\t\"new_session\",\n\t\"set_client_capabilities\",\n\t\"get_pending_host_actions\",\n\t\"host_action_response\",\n\t\"get_state\",\n\t\"get_transcript\",\n\t\"get_message_images\",\n\t\"get_mcp_capabilities\",\n\t\"list_mcp_servers\",\n\t\"get_mcp_server\",\n\t\"connect_mcp_server\",\n\t\"refresh_mcp_server\",\n\t\"set_mcp_server_enabled\",\n\t\"list_mcp_recent_calls\",\n\t\"list_mcp_tools\",\n\t\"get_mcp_tool\",\n\t\"list_mcp_resources\",\n\t\"read_mcp_resource\",\n\t\"list_mcp_prompts\",\n\t\"get_mcp_prompt\",\n\t\"disconnect_mcp_server\",\n\t\"poll_mcp_server_auth\",\n\t\"cancel_mcp_server_auth\",\n\t\"logout_mcp_server\",\n\t\"get_ui_capabilities\",\n\t\"get_ui_actions\",\n\t\"list_sessions\",\n\t\"switch_session_by_id\",\n\t\"register_push_target\",\n\t\"register_live_activity\",\n\t\"unregister_live_activity\",\n\t\"unregister_workspace\",\n\t// worktrees.v1: create/list only — remove_worktree is management-stream-only.\n\t\"create_worktree\",\n\t\"list_worktrees\",\n\t\"set_keep_awake\",\n\t\"get_keep_awake\",\n\t\"set_web_search_key\",\n\t\"get_web_search_status\",\n\t\"upload_device_logs\",\n\t\"extension_ui_response\",\n\t\"get_available_models\",\n\t\"set_model\",\n\t\"set_thinking_level\",\n]);\n\nconst IROH_REMOTE_UI_ACTION_PREFIXES = [\"extension.command.\", \"prompt.template.\", \"skill.\"] as const;\n\nexport interface IrohRemoteRpcCommand extends Record<string, unknown> {\n\ttype: string;\n}\n\nexport interface IrohRemoteRpcCapabilityDeniedError {\n\tcode: \"rpc_capability_denied\";\n\tmessage: string;\n\trequiredCapability: IrohRemoteRpcCapability;\n}\n\nexport interface IrohRemoteRpcErrorResponse {\n\tid?: string;\n\ttype: \"response\";\n\tcommand: string;\n\tsuccess: false;\n\terror: string;\n}\n\nexport interface IrohRemoteRpcCapabilityDeniedResponse {\n\tid?: string;\n\ttype: \"response\";\n\tcommand: string;\n\tsuccess: false;\n\terror: IrohRemoteRpcCapabilityDeniedError;\n}\n\nexport type IrohRemoteStaticRpcFilterResult =\n\t| { allowed: true; command: IrohRemoteRpcCommand }\n\t| { allowed: false; response: IrohRemoteRpcErrorResponse };\n\nexport type IrohRemoteRpcFilterResult =\n\t| { allowed: true; command: IrohRemoteRpcCommand }\n\t| { allowed: false; response: IrohRemoteRpcErrorResponse | IrohRemoteRpcCapabilityDeniedResponse };\n\nexport function getIrohRemoteRpcFilterResult(line: string, rpcGrant: IrohRemoteRpcGrant): IrohRemoteRpcFilterResult {\n\tconst staticResult = getStaticIrohRemoteRpcFilterResult(line);\n\tif (!staticResult.allowed) {\n\t\treturn staticResult;\n\t}\n\tlet granted: IrohRemoteRpcGrant;\n\ttry {\n\t\tgranted = parseIrohRemoteRpcGrant(rpcGrant, \"remote RPC grant\");\n\t} catch {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tresponse: createIrohRemoteRpcErrorResponse(\n\t\t\t\ttypeof staticResult.command.id === \"string\" ? staticResult.command.id : undefined,\n\t\t\t\tstaticResult.command.type,\n\t\t\t\t\"Remote RPC grant is missing or malformed\",\n\t\t\t),\n\t\t};\n\t}\n\tconst required = getIrohRemoteRpcCommandCapabilities(staticResult.command);\n\tif (required === undefined) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tresponse: createIrohRemoteRpcErrorResponse(\n\t\t\t\ttypeof staticResult.command.id === \"string\" ? staticResult.command.id : undefined,\n\t\t\t\tstaticResult.command.type,\n\t\t\t\t`RPC command has no capability classification: ${staticResult.command.type}`,\n\t\t\t),\n\t\t};\n\t}\n\tconst missing = getMissingIrohRemoteRpcCapability(granted, required);\n\tif (missing === undefined) {\n\t\treturn staticResult;\n\t}\n\treturn {\n\t\tallowed: false,\n\t\tresponse: createIrohRemoteRpcCapabilityDeniedResponse(\n\t\t\ttypeof staticResult.command.id === \"string\" ? staticResult.command.id : undefined,\n\t\t\tstaticResult.command.type,\n\t\t\tmissing,\n\t\t),\n\t};\n}\n\n/** Low-level syntax and hard-allowlist classifier. Remote serving must also apply an RPC grant. */\nexport function getStaticIrohRemoteRpcFilterResult(line: string): IrohRemoteStaticRpcFilterResult {\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(line);\n\t} catch (error: unknown) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tresponse: createIrohRemoteRpcErrorResponse(\n\t\t\t\tundefined,\n\t\t\t\t\"parse\",\n\t\t\t\t`Failed to parse command: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t),\n\t\t};\n\t}\n\n\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tresponse: createIrohRemoteRpcErrorResponse(\n\t\t\t\tundefined,\n\t\t\t\t\"unknown\",\n\t\t\t\t\"RPC command must be a JSON object with a string type\",\n\t\t\t),\n\t\t};\n\t}\n\tconst command = parsed as Record<string, unknown>;\n\tconst responseId = typeof command.id === \"string\" ? command.id : undefined;\n\tif (typeof command.type !== \"string\") {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tresponse: createIrohRemoteRpcErrorResponse(\n\t\t\t\tresponseId,\n\t\t\t\t\"unknown\",\n\t\t\t\t\"RPC command must be a JSON object with a string type\",\n\t\t\t),\n\t\t};\n\t}\n\n\tif (command.type === \"invoke_ui_action\" || command.type === \"get_ui_action_completions\") {\n\t\treturn getIrohRemoteUiActionCommandResult(command, responseId, command.type);\n\t}\n\n\tif (command.type === \"start_mcp_server_auth\") {\n\t\treturn getIrohRemoteMcpAuthCommandResult(command, responseId);\n\t}\n\n\tif (IROH_REMOTE_RPC_UNSUPPORTED_TYPES.has(command.type)) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tresponse: createIrohRemoteRpcErrorResponse(responseId, command.type, \"unsupported_remote_command\"),\n\t\t};\n\t}\n\n\tif (IROH_REMOTE_RPC_PASSTHROUGH_TYPES.has(command.type)) {\n\t\treturn { allowed: true, command: command as IrohRemoteRpcCommand };\n\t}\n\n\treturn {\n\t\tallowed: false,\n\t\tresponse: createIrohRemoteRpcErrorResponse(\n\t\t\tresponseId,\n\t\t\tcommand.type,\n\t\t\t`RPC command not allowed over remote host: ${command.type}`,\n\t\t),\n\t};\n}\n\nfunction getIrohRemoteMcpAuthCommandResult(\n\tcommand: Record<string, unknown>,\n\tresponseId: string | undefined,\n): IrohRemoteStaticRpcFilterResult {\n\tif (command.flow !== \"device\") {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tresponse: createIrohRemoteRpcErrorResponse(\n\t\t\t\tresponseId,\n\t\t\t\t\"start_mcp_server_auth\",\n\t\t\t\t\"Only MCP device-code auth can be started over remote host\",\n\t\t\t),\n\t\t};\n\t}\n\tif (typeof command.redirectUrl === \"string\") {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tresponse: createIrohRemoteRpcErrorResponse(\n\t\t\t\tresponseId,\n\t\t\t\t\"start_mcp_server_auth\",\n\t\t\t\t\"MCP browser redirect auth is not available over remote host\",\n\t\t\t),\n\t\t};\n\t}\n\treturn { allowed: true, command: command as IrohRemoteRpcCommand };\n}\n\nfunction getIrohRemoteUiActionCommandResult(\n\tcommand: Record<string, unknown>,\n\tresponseId: string | undefined,\n\tcommandType: \"invoke_ui_action\" | \"get_ui_action_completions\",\n): IrohRemoteStaticRpcFilterResult {\n\tconst action = command.action;\n\tif (typeof action !== \"string\" || action.length === 0) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tresponse: createIrohRemoteRpcErrorResponse(responseId, commandType, \"UI action id must be a non-empty string\"),\n\t\t};\n\t}\n\tif (!isIrohRemoteUiActionId(action)) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tresponse: createIrohRemoteRpcErrorResponse(\n\t\t\t\tresponseId,\n\t\t\t\tcommandType,\n\t\t\t\t`UI action not available over remote host: ${action}`,\n\t\t\t),\n\t\t};\n\t}\n\treturn { allowed: true, command: command as IrohRemoteRpcCommand };\n}\n\nfunction isIrohRemoteUiActionId(action: string): boolean {\n\treturn (\n\t\tisRemoteSafeBuiltinHostActionId(action) ||\n\t\tIROH_REMOTE_UI_ACTION_PREFIXES.some((prefix) => action.startsWith(prefix))\n\t);\n}\n\nexport function serializeIrohRemoteRpcFilterRejection(\n\tresponse: IrohRemoteRpcErrorResponse | IrohRemoteRpcCapabilityDeniedResponse,\n): string {\n\treturn serializeJsonLine(response);\n}\n\nexport function createIrohRemoteRpcErrorResponse(\n\tid: string | undefined,\n\tcommand: string,\n\terror: string,\n): IrohRemoteRpcErrorResponse {\n\treturn { id, type: \"response\", command, success: false, error };\n}\n\nexport function createIrohRemoteRpcCapabilityDeniedResponse(\n\tid: string | undefined,\n\tcommand: string,\n\trequiredCapability: IrohRemoteRpcCapability,\n): IrohRemoteRpcCapabilityDeniedResponse {\n\treturn {\n\t\tid,\n\t\ttype: \"response\",\n\t\tcommand,\n\t\tsuccess: false,\n\t\terror: {\n\t\t\tcode: \"rpc_capability_denied\",\n\t\t\tmessage: `RPC capability required: ${requiredCapability}`,\n\t\t\trequiredCapability,\n\t\t},\n\t};\n}\n"]}

package/dist/core/remote/iroh/rpc-transport.d.ts

@@ -0,0 +1,21 @@
+import { type IrohRpcTransportOptions, type RpcTransport } from "../../rpc/index.ts";
+import type { IrohRemoteRpcGrant } from "./access-grant.ts";
+export interface IrohRemoteFilteredRpcTransportOptions {
+    transport: RpcTransport;
+    /** Persisted grant snapshot for this authorized remote stream. */
+    rpcGrant: IrohRemoteRpcGrant;
+}
+/**
+ * Wrap an RPC transport with the remote Iroh command policy.
+ *
+ * Allowed commands are forwarded to the in-process RPC mode unchanged.
+ * Disallowed or malformed commands are rejected on the same transport without
+ * reaching Volt RPC handlers.
+ */
+export declare function createIrohRemoteFilteredRpcTransport(options: IrohRemoteFilteredRpcTransportOptions): RpcTransport & {
+    setRpcModeStartupComplete?(startupComplete: boolean): void;
+};
+export declare function createIrohRemoteRpcTransport(options: IrohRpcTransportOptions & {
+    rpcGrant: IrohRemoteRpcGrant;
+}): RpcTransport;
+//# sourceMappingURL=rpc-transport.d.ts.map

package/dist/core/remote/iroh/rpc-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc-transport.d.ts","sourceRoot":"","sources":["../../../../src/core/remote/iroh/rpc-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,KAAK,uBAAuB,EAG5B,KAAK,YAAY,EACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,MAAM,WAAW,qCAAqC;IACrD,SAAS,EAAE,YAAY,CAAC;IACxB,kEAAkE;IAClE,QAAQ,EAAE,kBAAkB,CAAC;CAC7B;AAMD;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CACnD,OAAO,EAAE,qCAAqC,GAC5C,YAAY,GAAG;IAAE,yBAAyB,CAAC,CAAC,eAAe,EAAE,OAAO,GAAG,IAAI,CAAA;CAAE,CA6F/E;AAED,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE,uBAAuB,GAAG;IAAE,QAAQ,EAAE,kBAAkB,CAAA;CAAE,GACjE,YAAY,CAKd","sourcesContent":["import {\n\tcreateIrohRpcTransport,\n\ttype IrohRpcTransportOptions,\n\ttype RpcCloseHandler,\n\ttype RpcLineHandler,\n\ttype RpcTransport,\n} from \"../../rpc/index.ts\";\nimport type { IrohRemoteRpcGrant } from \"./access-grant.ts\";\nimport { getIrohRemoteRpcFilterResult } from \"./rpc-command-filter.ts\";\n\nexport interface IrohRemoteFilteredRpcTransportOptions {\n\ttransport: RpcTransport;\n\t/** Persisted grant snapshot for this authorized remote stream. */\n\trpcGrant: IrohRemoteRpcGrant;\n}\n\ninterface StartupAwareRpcTransport extends RpcTransport {\n\tsetRpcModeStartupComplete?(startupComplete: boolean): void;\n}\n\n/**\n * Wrap an RPC transport with the remote Iroh command policy.\n *\n * Allowed commands are forwarded to the in-process RPC mode unchanged.\n * Disallowed or malformed commands are rejected on the same transport without\n * reaching Volt RPC handlers.\n */\nexport function createIrohRemoteFilteredRpcTransport(\n\toptions: IrohRemoteFilteredRpcTransportOptions,\n): RpcTransport & { setRpcModeStartupComplete?(startupComplete: boolean): void } {\n\tconst pendingRejections = new Set<Promise<void>>();\n\tlet pendingRejectionError: Error | undefined;\n\tconst startupAwareTransport = options.transport as StartupAwareRpcTransport;\n\n\tconst recordRejectionError = (error: unknown): Error => {\n\t\tconst rejectionError = error instanceof Error ? error : new Error(String(error));\n\t\tpendingRejectionError ??= rejectionError;\n\t\treturn rejectionError;\n\t};\n\n\tconst trackRejectionWrite = (result: void | Promise<void>): void => {\n\t\tif (!result) {\n\t\t\treturn;\n\t\t}\n\t\tconst pending = Promise.resolve(result)\n\t\t\t.catch((error: unknown) => {\n\t\t\t\trecordRejectionError(error);\n\t\t\t})\n\t\t\t.finally(() => {\n\t\t\t\tpendingRejections.delete(pending);\n\t\t\t});\n\t\tpendingRejections.add(pending);\n\t};\n\n\tconst waitForRejectionWrites = async (): Promise<void> => {\n\t\twhile (pendingRejections.size > 0) {\n\t\t\tawait Promise.allSettled(pendingRejections);\n\t\t}\n\t\tif (!pendingRejectionError) {\n\t\t\treturn;\n\t\t}\n\t\tconst error = pendingRejectionError;\n\t\tpendingRejectionError = undefined;\n\t\tthrow error;\n\t};\n\n\treturn {\n\t\tsetRpcModeStartupComplete(startupComplete: boolean) {\n\t\t\tstartupAwareTransport.setRpcModeStartupComplete?.(startupComplete);\n\t\t},\n\t\twrite(value) {\n\t\t\treturn options.transport.write(value);\n\t\t},\n\t\tonLine(handler: RpcLineHandler): () => void {\n\t\t\treturn options.transport.onLine(async (line) => {\n\t\t\t\tconst filterResult = getIrohRemoteRpcFilterResult(line, options.rpcGrant);\n\t\t\t\tif (filterResult.allowed) {\n\t\t\t\t\tawait handler(line);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\ttry {\n\t\t\t\t\tconst writeResult = options.transport.write(filterResult.response);\n\t\t\t\t\ttrackRejectionWrite(writeResult);\n\t\t\t\t\tawait writeResult;\n\t\t\t\t} catch (error: unknown) {\n\t\t\t\t\trecordRejectionError(error);\n\t\t\t\t}\n\t\t\t});\n\t\t},\n\t\tonClose(handler: RpcCloseHandler): () => void {\n\t\t\treturn options.transport.onClose?.(handler) ?? (() => {});\n\t\t},\n\t\tasync waitForBackpressure() {\n\t\t\tawait waitForRejectionWrites();\n\t\t\tawait options.transport.waitForBackpressure?.();\n\t\t},\n\t\tasync flush() {\n\t\t\tawait waitForRejectionWrites();\n\t\t\tawait options.transport.flush?.();\n\t\t},\n\t\tasync close() {\n\t\t\tlet rejectionError: unknown;\n\t\t\ttry {\n\t\t\t\tawait waitForRejectionWrites();\n\t\t\t} catch (error: unknown) {\n\t\t\t\trejectionError = error;\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tawait options.transport.close();\n\t\t\t} catch (closeError: unknown) {\n\t\t\t\tif (!rejectionError) {\n\t\t\t\t\tthrow closeError;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (rejectionError) {\n\t\t\t\tthrow rejectionError;\n\t\t\t}\n\t\t},\n\t};\n}\n\nexport function createIrohRemoteRpcTransport(\n\toptions: IrohRpcTransportOptions & { rpcGrant: IrohRemoteRpcGrant },\n): RpcTransport {\n\treturn createIrohRemoteFilteredRpcTransport({\n\t\ttransport: createIrohRpcTransport(options),\n\t\trpcGrant: options.rpcGrant,\n\t});\n}\n"]}