@hansjm10/volt-coding-agent 0.0.0-bootstrap.0 → 0.1.0

package/dist/core/remote/iroh/state.js

@@ -0,0 +1,433 @@
+import { Buffer } from "node:buffer";
+import { readFile } from "node:fs/promises";
+import { writeDurableAtomicFile } from "../../../utils/durable-atomic-write.js";
+import { cloneIrohRemoteRpcGrant, parseIrohRemoteRpcGrant } from "./access-grant.js";
+import { DEFAULT_IROH_REMOTE_ALLOW_TOOLS, isIrohRemoteWorkingDirectory, isIrohRemoteWorktreeId, normalizeIrohRemoteAllowTools, } from "./protocol.js";
+export const MAX_IROH_REMOTE_LIVE_ACTIVITIES_PER_CLIENT = 32;
+export const MAX_IROH_REMOTE_LIVE_ACTIVITY_SCOPE_BYTES = 512;
+export const MAX_IROH_REMOTE_LIVE_ACTIVITY_ID_BYTES = 512;
+export const MAX_IROH_REMOTE_LIVE_ACTIVITY_ID_CODE_POINTS = 128;
+export function createEmptyIrohRemoteHostState() {
+    return {
+        hostSecretKey: undefined,
+        pairingSecretTombstones: [],
+        workspaces: [],
+        worktrees: [],
+        clients: [],
+        revokedClients: [],
+        pendingPairingTickets: [],
+    };
+}
+export async function readIrohRemoteHostState(path) {
+    let parsed;
+    try {
+        parsed = JSON.parse(await readFile(path, "utf8"));
+    }
+    catch (error) {
+        if (isNodeErrorWithCode(error, "ENOENT")) {
+            return createEmptyIrohRemoteHostState();
+        }
+        throw error;
+    }
+    return parseIrohRemoteHostState(parsed);
+}
+export async function writeIrohRemoteHostState(path, state) {
+    await writeDurableAtomicFile(path, `${JSON.stringify(serializeIrohRemoteHostState(state), null, 2)}\n`);
+}
+export function parseIrohRemoteHostState(value) {
+    const state = expectRecord(value, "Iroh remote host state");
+    return {
+        hostSecretKey: parseOptionalByteArray(state.hostSecretKey, "hostSecretKey"),
+        pairingSecretTombstones: parseOptionalArray(state.pairingSecretTombstones, "pairingSecretTombstones", parseIrohRemotePairingSecretTombstone),
+        workspaces: parseArray(state.workspaces, "workspaces", parseIrohRemoteWorkspace),
+        worktrees: parseOptionalArray(state.worktrees, "worktrees", parseIrohRemoteWorkspaceWorktree),
+        clients: parseArray(state.clients, "clients", parseIrohRemoteClient),
+        revokedClients: parseOptionalArray(state.revokedClients, "revokedClients", parseIrohRemoteRevokedClient),
+        pendingPairingTickets: parseOptionalArray(state.pendingPairingTickets, "pendingPairingTickets", parseIrohRemotePendingPairingTicket),
+    };
+}
+function serializeIrohRemoteHostState(state) {
+    return {
+        hostSecretKey: state.hostSecretKey ? [...state.hostSecretKey] : undefined,
+        pairingSecretTombstones: (state.pairingSecretTombstones ?? []).map((tombstone) => ({ ...tombstone })),
+        workspaces: state.workspaces.map((workspace) => ({ ...workspace })),
+        worktrees: (state.worktrees ?? []).map((worktree) => ({ ...worktree, sessionIds: [...worktree.sessionIds] })),
+        clients: state.clients.map((client) => ({
+            ...client,
+            allowedWorkspaces: [...client.allowedWorkspaces],
+            ...(client.rpcGrant === undefined ? {} : { rpcGrant: cloneIrohRemoteRpcGrant(client.rpcGrant) }),
+            ...(client.lastSessionIdByWorkspace
+                ? { lastSessionIdByWorkspace: { ...client.lastSessionIdByWorkspace } }
+                : {}),
+            ...(client.pushTargets
+                ? {
+                    pushTargets: client.pushTargets.map((target) => ({
+                        ...target,
+                        ...(target.liveActivity ? { liveActivity: { ...target.liveActivity } } : {}),
+                    })),
+                }
+                : {}),
+            ...(client.liveActivities
+                ? { liveActivities: client.liveActivities.map((registration) => ({ ...registration })) }
+                : {}),
+        })),
+        revokedClients: (state.revokedClients ?? []).map((client) => ({
+            ...client,
+            allowedWorkspaces: [...client.allowedWorkspaces],
+            ...(client.rpcGrant === undefined ? {} : { rpcGrant: cloneIrohRemoteRpcGrant(client.rpcGrant) }),
+            ...(client.lastSessionIdByWorkspace
+                ? { lastSessionIdByWorkspace: { ...client.lastSessionIdByWorkspace } }
+                : {}),
+        })),
+        pendingPairingTickets: (state.pendingPairingTickets ?? []).map((ticket) => ({
+            ...ticket,
+            ...(ticket.rpcGrant === undefined ? {} : { rpcGrant: cloneIrohRemoteRpcGrant(ticket.rpcGrant) }),
+        })),
+    };
+}
+export function parseIrohRemoteWorkspace(value) {
+    const workspace = expectRecord(value, "Iroh remote workspace");
+    const allowedTools = expectOptionalAllowTools(workspace.allowedTools, "workspace allowedTools");
+    return {
+        name: expectString(workspace.name, "workspace name"),
+        path: expectString(workspace.path, "workspace path"),
+        allowedTools: allowedTools === undefined ? undefined : normalizeIrohRemoteAllowTools(allowedTools),
+    };
+}
+export function parseIrohRemoteWorkspaceWorktree(value) {
+    const worktree = expectRecord(value, "Iroh remote worktree");
+    const baseRef = expectOptionalString(worktree.baseRef, "worktree baseRef");
+    const sourceRootRelativePath = expectOptionalWorkspaceRelativePath(worktree.sourceRootRelativePath, "worktree sourceRootRelativePath");
+    return {
+        id: expectWorktreeId(worktree.id),
+        workspaceName: expectString(worktree.workspaceName, "worktree workspaceName"),
+        path: expectString(worktree.path, "worktree path"),
+        ...(sourceRootRelativePath === undefined ? {} : { sourceRootRelativePath }),
+        branch: expectString(worktree.branch, "worktree branch"),
+        ...(baseRef === undefined ? {} : { baseRef }),
+        createdAt: expectNumber(worktree.createdAt, "worktree createdAt"),
+        sessionIds: parseArray(worktree.sessionIds, "worktree sessionIds", (entry) => expectString(entry, "worktree session id")),
+    };
+}
+function expectWorktreeId(value) {
+    if (!isIrohRemoteWorktreeId(value)) {
+        throw new Error("worktree id must match lowercase worktree id syntax");
+    }
+    return value;
+}
+function expectOptionalWorkspaceRelativePath(value, label) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!isIrohRemoteWorkingDirectory(value)) {
+        throw new Error(`${label} must be a relative workspace path`);
+    }
+    return value;
+}
+export function parseIrohRemoteClient(value) {
+    const client = expectRecord(value, "Iroh remote client");
+    return {
+        nodeId: expectString(client.nodeId, "client nodeId"),
+        label: expectString(client.label, "client label"),
+        allowedWorkspaces: parseArray(client.allowedWorkspaces, "client allowedWorkspaces", (entry) => expectString(entry, "client allowed workspace")),
+        allowedTools: normalizeIrohRemoteAllowTools(expectOptionalAllowTools(client.allowedTools, "client allowedTools") ?? DEFAULT_IROH_REMOTE_ALLOW_TOOLS),
+        rpcGrant: parseIrohRemoteRpcGrant(client.rpcGrant, "client rpcGrant"),
+        pairedAt: expectNumber(client.pairedAt, "client pairedAt"),
+        lastSeenAt: expectNumber(client.lastSeenAt, "client lastSeenAt"),
+        ...parseOptionalStringRecordProperty(client.lastSessionIdByWorkspace, "client lastSessionIdByWorkspace", "client last session workspace", "client last session id"),
+        ...parseOptionalPushTargetsProperty(client.pushTargets, "client pushTargets"),
+        ...parseOptionalLiveActivityRegistrationsProperty(client.liveActivities, "client liveActivities"),
+    };
+}
+export function parseIrohRemotePushTarget(value) {
+    const target = expectRecord(value, "push target");
+    return {
+        id: expectString(target.id, "push target id"),
+        provider: expectPushTargetProvider(target.provider, "push target provider"),
+        platform: expectPushTargetPlatform(target.platform, "push target platform"),
+        pushTargetAuthToken: expectString(target.pushTargetAuthToken, "push target pushTargetAuthToken"),
+        relayUrl: expectOptionalString(target.relayUrl, "push target relayUrl"),
+        tokenHash: expectOptionalString(target.tokenHash, "push target tokenHash"),
+        liveActivity: parseOptionalIrohRemoteLiveActivityTarget(target.liveActivity, "push target liveActivity"),
+        enabled: expectBoolean(target.enabled, "push target enabled"),
+        createdAt: expectNumber(target.createdAt, "push target createdAt"),
+        updatedAt: expectNumber(target.updatedAt, "push target updatedAt"),
+    };
+}
+function parseOptionalIrohRemoteLiveActivityTarget(value, label) {
+    if (value === undefined) {
+        return undefined;
+    }
+    const target = expectRecord(value, label);
+    return {
+        activityId: expectString(target.activityId, `${label} activityId`),
+        pushToken: expectString(target.pushToken, `${label} pushToken`),
+        tokenHash: expectOptionalString(target.tokenHash, `${label} tokenHash`),
+        tokenEnvironment: expectOptionalPushTokenEnvironment(target.tokenEnvironment, `${label} tokenEnvironment`),
+        updatedAt: expectNumber(target.updatedAt, `${label} updatedAt`),
+    };
+}
+export function parseIrohRemoteLiveActivityRegistration(value) {
+    const registration = expectRecord(value, "live activity registration");
+    return {
+        workspaceName: expectBoundedUtf8String(registration.workspaceName, "live activity workspaceName", MAX_IROH_REMOTE_LIVE_ACTIVITY_SCOPE_BYTES),
+        sessionId: expectBoundedUtf8String(registration.sessionId, "live activity sessionId", MAX_IROH_REMOTE_LIVE_ACTIVITY_SCOPE_BYTES),
+        activityId: expectBoundedUtf8String(registration.activityId, "live activity activityId", MAX_IROH_REMOTE_LIVE_ACTIVITY_ID_BYTES, MAX_IROH_REMOTE_LIVE_ACTIVITY_ID_CODE_POINTS),
+        tokenHash: expectSha256Hex(registration.tokenHash, "live activity tokenHash"),
+        tokenEnvironment: expectPushTokenEnvironment(registration.tokenEnvironment, "live activity tokenEnvironment"),
+        platform: expectPushTargetPlatform(registration.platform, "live activity platform"),
+        pushTargetId: expectBoundedUtf8String(registration.pushTargetId, "live activity pushTargetId", MAX_IROH_REMOTE_LIVE_ACTIVITY_SCOPE_BYTES),
+        createdAt: expectNonNegativeSafeInteger(registration.createdAt, "live activity createdAt"),
+        updatedAt: expectNonNegativeSafeInteger(registration.updatedAt, "live activity updatedAt"),
+    };
+}
+/**
+ * Normalize legacy registration arrays into the same bounded shape enforced at
+ * mutation time: one newest entry per workspace/session and the newest 32
+ * sessions overall, ordered oldest-first for deterministic future eviction.
+ */
+export function normalizeIrohRemoteLiveActivityRegistrations(registrations) {
+    const newestBySession = new Map();
+    for (const [index, registration] of registrations.entries()) {
+        const candidate = { registration, index };
+        const key = JSON.stringify([registration.workspaceName, registration.sessionId]);
+        const existing = newestBySession.get(key);
+        if (!existing || compareLiveActivityRecency(existing, candidate) <= 0) {
+            newestBySession.set(key, candidate);
+        }
+    }
+    const normalized = [...newestBySession.values()].sort(compareLiveActivityAge);
+    return normalized
+        .slice(Math.max(0, normalized.length - MAX_IROH_REMOTE_LIVE_ACTIVITIES_PER_CLIENT))
+        .map(({ registration }) => registration);
+}
+function compareLiveActivityRecency(left, right) {
+    return (compareNumbers(left.registration.updatedAt, right.registration.updatedAt) ||
+        compareNumbers(left.registration.createdAt, right.registration.createdAt) ||
+        compareNumbers(left.index, right.index));
+}
+function compareLiveActivityAge(left, right) {
+    return (compareNumbers(left.registration.createdAt, right.registration.createdAt) ||
+        compareNumbers(left.registration.updatedAt, right.registration.updatedAt) ||
+        compareStrings(left.registration.workspaceName, right.registration.workspaceName) ||
+        compareStrings(left.registration.sessionId, right.registration.sessionId) ||
+        compareStrings(left.registration.activityId, right.registration.activityId) ||
+        compareNumbers(left.index, right.index));
+}
+export function parseIrohRemoteRevokedClient(value) {
+    const client = expectRecord(value, "Iroh remote revoked client");
+    const rePairApprovedAt = expectOptionalNumber(client.rePairApprovedAt, "revoked client rePairApprovedAt");
+    return {
+        nodeId: expectString(client.nodeId, "revoked client nodeId"),
+        label: expectString(client.label, "revoked client label"),
+        allowedWorkspaces: parseArray(client.allowedWorkspaces, "revoked client allowedWorkspaces", (entry) => expectString(entry, "revoked client allowed workspace")),
+        allowedTools: normalizeIrohRemoteAllowTools(expectOptionalAllowTools(client.allowedTools, "revoked client allowedTools") ??
+            DEFAULT_IROH_REMOTE_ALLOW_TOOLS),
+        rpcGrant: parseIrohRemoteRpcGrant(client.rpcGrant, "revoked client rpcGrant"),
+        pairedAt: expectNumber(client.pairedAt, "revoked client pairedAt"),
+        lastSeenAt: expectNumber(client.lastSeenAt, "revoked client lastSeenAt"),
+        revokedAt: expectNumber(client.revokedAt, "revoked client revokedAt"),
+        ...parseOptionalStringRecordProperty(client.lastSessionIdByWorkspace, "revoked client lastSessionIdByWorkspace", "revoked client last session workspace", "revoked client last session id"),
+        ...(rePairApprovedAt === undefined ? {} : { rePairApprovedAt }),
+    };
+}
+export function parseIrohRemotePairingSecretTombstone(value) {
+    const tombstone = expectRecord(value, "Iroh remote pairing secret tombstone");
+    const outcome = expectPairingSecretTombstoneOutcome(tombstone.outcome);
+    const createdAt = expectOptionalNumber(tombstone.createdAt, "pairing secret tombstone createdAt");
+    const expiresAt = expectOptionalNumber(tombstone.expiresAt, "pairing secret tombstone expiresAt");
+    const labelHint = expectOptionalString(tombstone.labelHint, "pairing secret tombstone labelHint");
+    const common = {
+        secretHash: expectString(tombstone.secretHash, "pairing secret tombstone secretHash"),
+        workspace: expectString(tombstone.workspace, "pairing secret tombstone workspace"),
+        outcome,
+        retainUntil: expectNumber(tombstone.retainUntil, "pairing secret tombstone retainUntil"),
+        ...(createdAt === undefined ? {} : { createdAt }),
+        ...(expiresAt === undefined ? {} : { expiresAt }),
+        ...(labelHint === undefined ? {} : { labelHint }),
+    };
+    if (outcome === "pairing_secret_consumed") {
+        return {
+            ...common,
+            consumedAt: expectNumber(tombstone.consumedAt, "pairing secret tombstone consumedAt"),
+            clientNodeId: expectString(tombstone.clientNodeId, "pairing secret tombstone clientNodeId"),
+        };
+    }
+    return {
+        ...common,
+        expiredAt: expectNumber(tombstone.expiredAt, "pairing secret tombstone expiredAt"),
+    };
+}
+export function parseIrohRemotePendingPairingTicket(value) {
+    const ticket = expectRecord(value, "Iroh remote pending pairing ticket");
+    const labelHint = expectOptionalString(ticket.labelHint, "pending pairing ticket labelHint");
+    return {
+        secretHash: expectString(ticket.secretHash, "pending pairing ticket secretHash"),
+        workspace: expectString(ticket.workspace, "pending pairing ticket workspace"),
+        allowedTools: normalizeIrohRemoteAllowTools(expectAllowTools(ticket.allowedTools, "pending pairing ticket allowedTools")),
+        rpcGrant: parseIrohRemoteRpcGrant(ticket.rpcGrant, "pending pairing ticket rpcGrant"),
+        expiresAt: expectNumber(ticket.expiresAt, "pending pairing ticket expiresAt"),
+        createdAt: expectNumber(ticket.createdAt, "pending pairing ticket createdAt"),
+        ...(labelHint === undefined ? {} : { labelHint }),
+    };
+}
+function parseArray(value, label, parseEntry) {
+    if (!Array.isArray(value)) {
+        throw new Error(`${label} must be an array`);
+    }
+    return value.map((entry) => parseEntry(entry));
+}
+function parseOptionalArray(value, label, parseEntry) {
+    if (value === undefined) {
+        return [];
+    }
+    return parseArray(value, label, parseEntry);
+}
+function parseOptionalByteArray(value, label) {
+    if (value === undefined) {
+        return undefined;
+    }
+    return parseArray(value, label, (entry) => {
+        if (typeof entry !== "number" || !Number.isInteger(entry) || entry < 0 || entry > 255) {
+            throw new Error(`${label} must contain byte values`);
+        }
+        return entry;
+    });
+}
+function parseOptionalStringRecordProperty(value, label, keyLabel, valueLabel) {
+    if (value === undefined) {
+        return {};
+    }
+    const record = expectRecord(value, label);
+    const parsed = {};
+    for (const [key, entry] of Object.entries(record)) {
+        if (key.length === 0) {
+            throw new Error(`${keyLabel} must be a non-empty string`);
+        }
+        parsed[key] = expectString(entry, valueLabel);
+    }
+    return { lastSessionIdByWorkspace: parsed };
+}
+function parseOptionalPushTargetsProperty(value, label) {
+    if (value === undefined) {
+        return {};
+    }
+    return { pushTargets: parseArray(value, label, parseIrohRemotePushTarget) };
+}
+function parseOptionalLiveActivityRegistrationsProperty(value, label) {
+    if (value === undefined) {
+        return {};
+    }
+    const registrations = parseArray(value, label, parseIrohRemoteLiveActivityRegistration);
+    const normalized = normalizeIrohRemoteLiveActivityRegistrations(registrations);
+    return normalized.length === 0 ? {} : { liveActivities: normalized };
+}
+function expectPairingSecretTombstoneOutcome(value) {
+    if (value === "pairing_secret_consumed" || value === "pairing_secret_expired") {
+        return value;
+    }
+    throw new Error("pairing secret tombstone outcome must be pairing_secret_consumed or pairing_secret_expired");
+}
+function expectPushTargetProvider(value, label) {
+    if (value === "fcm") {
+        return value;
+    }
+    throw new Error(`${label} must be fcm`);
+}
+function expectPushTargetPlatform(value, label) {
+    if (value === "ios") {
+        return value;
+    }
+    throw new Error(`${label} must be ios`);
+}
+function expectPushTokenEnvironment(value, label) {
+    if (value === "development" || value === "production") {
+        return value;
+    }
+    throw new Error(`${label} must be development or production`);
+}
+function expectOptionalPushTokenEnvironment(value, label) {
+    if (value === undefined) {
+        return undefined;
+    }
+    return expectPushTokenEnvironment(value, label);
+}
+function expectRecord(value, label) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new Error(`${label} must be an object`);
+    }
+    return value;
+}
+function expectString(value, label) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new Error(`${label} must be a non-empty string`);
+    }
+    return value;
+}
+function expectBoundedUtf8String(value, label, maxBytes, maxCodePoints) {
+    const parsed = expectString(value, label);
+    if (Buffer.byteLength(parsed, "utf8") > maxBytes) {
+        throw new Error(`${label} must be at most ${maxBytes} UTF-8 bytes`);
+    }
+    if (maxCodePoints !== undefined && Array.from(parsed).length > maxCodePoints) {
+        throw new Error(`${label} must contain at most ${maxCodePoints} characters`);
+    }
+    return parsed;
+}
+function expectSha256Hex(value, label) {
+    const parsed = expectString(value, label);
+    if (!/^[0-9a-f]{64}$/.test(parsed)) {
+        throw new Error(`${label} must be a lowercase SHA-256 hex digest`);
+    }
+    return parsed;
+}
+function expectOptionalString(value, label) {
+    if (value === undefined) {
+        return undefined;
+    }
+    return expectString(value, label);
+}
+function expectAllowTools(value, label) {
+    if (typeof value !== "string") {
+        throw new Error(`${label} must be a string`);
+    }
+    return value;
+}
+function expectOptionalAllowTools(value, label) {
+    return value === undefined ? undefined : expectAllowTools(value, label);
+}
+function expectOptionalNumber(value, label) {
+    if (value === undefined) {
+        return undefined;
+    }
+    return expectNumber(value, label);
+}
+function expectBoolean(value, label) {
+    if (typeof value !== "boolean") {
+        throw new Error(`${label} must be a boolean`);
+    }
+    return value;
+}
+function expectNumber(value, label) {
+    if (typeof value !== "number" || !Number.isFinite(value)) {
+        throw new Error(`${label} must be a finite number`);
+    }
+    return value;
+}
+function expectNonNegativeSafeInteger(value, label) {
+    const parsed = expectNumber(value, label);
+    if (!Number.isSafeInteger(parsed) || parsed < 0) {
+        throw new Error(`${label} must be a non-negative safe integer`);
+    }
+    return parsed;
+}
+function compareNumbers(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function compareStrings(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function isNodeErrorWithCode(error, code) {
+    return error instanceof Error && "code" in error && error.code === code;
+}
+//# sourceMappingURL=state.js.map

package/dist/core/remote/iroh/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../../../src/core/remote/iroh/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAA2B,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC9G,OAAO,EACN,+BAA+B,EAC/B,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,GAC7B,MAAM,eAAe,CAAC;AA6DvB,MAAM,CAAC,MAAM,0CAA0C,GAAG,EAAE,CAAC;AAC7D,MAAM,CAAC,MAAM,yCAAyC,GAAG,GAAG,CAAC;AAC7D,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,CAAC;AAC1D,MAAM,CAAC,MAAM,4CAA4C,GAAG,GAAG,CAAC;AAuEhE,MAAM,UAAU,8BAA8B,GAAwB;IACrE,OAAO;QACN,aAAa,EAAE,SAAS;QACxB,uBAAuB,EAAE,EAAE;QAC3B,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,EAAE;QACX,cAAc,EAAE,EAAE;QAClB,qBAAqB,EAAE,EAAE;KACzB,CAAC;AAAA,CACF;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY,EAAgC;IACzF,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACzB,IAAI,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC1C,OAAO,8BAA8B,EAAE,CAAC;QACzC,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IACD,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAAA,CACxC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAAY,EAAE,KAA0B,EAAiB;IACvG,MAAM,sBAAsB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAAA,CACxG;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc,EAAuB;IAC7E,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IAC5D,OAAO;QACN,aAAa,EAAE,sBAAsB,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC;QAC3E,uBAAuB,EAAE,kBAAkB,CAC1C,KAAK,CAAC,uBAAuB,EAC7B,yBAAyB,EACzB,qCAAqC,CACrC;QACD,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,wBAAwB,CAAC;QAChF,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,gCAAgC,CAAC;QAC7F,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,qBAAqB,CAAC;QACpE,cAAc,EAAE,kBAAkB,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,EAAE,4BAA4B,CAAC;QACxG,qBAAqB,EAAE,kBAAkB,CACxC,KAAK,CAAC,qBAAqB,EAC3B,uBAAuB,EACvB,mCAAmC,CACnC;KACD,CAAC;AAAA,CACF;AAED,SAAS,4BAA4B,CAAC,KAA0B,EAAuB;IACtF,OAAO;QACN,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;QACzE,uBAAuB,EAAE,CAAC,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACrG,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACnE,SAAS,EAAE,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7G,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvC,GAAG,MAAM;YACT,iBAAiB,EAAE,CAAC,GAAG,MAAM,CAAC,iBAAiB,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChG,GAAG,CAAC,MAAM,CAAC,wBAAwB;gBAClC,CAAC,CAAC,EAAE,wBAAwB,EAAE,EAAE,GAAG,MAAM,CAAC,wBAAwB,EAAE,EAAE;gBACtE,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,WAAW;gBACrB,CAAC,CAAC;oBACA,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;wBAChD,GAAG,MAAM;wBACT,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,GAAG,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC5E,CAAC,CAAC;iBACH;gBACF,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,cAAc;gBACxB,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,EAAE;gBACxF,CAAC,CAAC,EAAE,CAAC;SACN,CAAC,CAAC;QACH,cAAc,EAAE,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC7D,GAAG,MAAM;YACT,iBAAiB,EAAE,CAAC,GAAG,MAAM,CAAC,iBAAiB,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChG,GAAG,CAAC,MAAM,CAAC,wBAAwB;gBAClC,CAAC,CAAC,EAAE,wBAAwB,EAAE,EAAE,GAAG,MAAM,CAAC,wBAAwB,EAAE,EAAE;gBACtE,CAAC,CAAC,EAAE,CAAC;SACN,CAAC,CAAC;QACH,qBAAqB,EAAE,CAAC,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3E,GAAG,MAAM;YACT,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;SAChG,CAAC,CAAC;KACH,CAAC;AAAA,CACF;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc,EAAuB;IAC7E,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,wBAAwB,CAAC,SAAS,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC;IAChG,OAAO;QACN,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC;QACpD,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC;QACpD,YAAY,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,6BAA6B,CAAC,YAAY,CAAC;KAClG,CAAC;AAAA,CACF;AAED,MAAM,UAAU,gCAAgC,CAAC,KAAc,EAA+B;IAC7F,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAC3E,MAAM,sBAAsB,GAAG,mCAAmC,CACjE,QAAQ,CAAC,sBAAsB,EAC/B,iCAAiC,CACjC,CAAC;IACF,OAAO;QACN,EAAE,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,aAAa,EAAE,YAAY,CAAC,QAAQ,CAAC,aAAa,EAAE,wBAAwB,CAAC;QAC7E,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;QAClD,GAAG,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC;QAC3E,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;QACxD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,SAAS,EAAE,YAAY,CAAC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;QACjE,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5E,YAAY,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAC1C;KACD,CAAC;AAAA,CACF;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAU;IACjD,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,mCAAmC,CAAC,KAAc,EAAE,KAAa,EAAsB;IAC/F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc,EAAoB;IACvE,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IACzD,OAAO;QACN,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC;QACpD,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC;QACjD,iBAAiB,EAAE,UAAU,CAAC,MAAM,CAAC,iBAAiB,EAAE,0BAA0B,EAAE,CAAC,KAAK,EAAE,EAAE,CAC7F,YAAY,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAC/C;QACD,YAAY,EAAE,6BAA6B,CAC1C,wBAAwB,CAAC,MAAM,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,+BAA+B,CACvG;QACD,QAAQ,EAAE,uBAAuB,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC;QACrE,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC;QAC1D,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,mBAAmB,CAAC;QAChE,GAAG,iCAAiC,CACnC,MAAM,CAAC,wBAAwB,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,wBAAwB,CACxB;QACD,GAAG,gCAAgC,CAAC,MAAM,CAAC,WAAW,EAAE,oBAAoB,CAAC;QAC7E,GAAG,8CAA8C,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC;KACjG,CAAC;AAAA,CACF;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc,EAAwB;IAC/E,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAClD,OAAO;QACN,EAAE,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE,gBAAgB,CAAC;QAC7C,QAAQ,EAAE,wBAAwB,CAAC,MAAM,CAAC,QAAQ,EAAE,sBAAsB,CAAC;QAC3E,QAAQ,EAAE,wBAAwB,CAAC,MAAM,CAAC,QAAQ,EAAE,sBAAsB,CAAC;QAC3E,mBAAmB,EAAE,YAAY,CAAC,MAAM,CAAC,mBAAmB,EAAE,iCAAiC,CAAC;QAChG,QAAQ,EAAE,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,sBAAsB,CAAC;QACvE,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,SAAS,EAAE,uBAAuB,CAAC;QAC1E,YAAY,EAAE,yCAAyC,CAAC,MAAM,CAAC,YAAY,EAAE,0BAA0B,CAAC;QACxG,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,qBAAqB,CAAC;QAC7D,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,uBAAuB,CAAC;QAClE,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,uBAAuB,CAAC;KAClE,CAAC;AAAA,CACF;AAED,SAAS,yCAAyC,CACjD,KAAc,EACd,KAAa,EAC8B;IAC3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,OAAO;QACN,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,KAAK,aAAa,CAAC;QAClE,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,KAAK,YAAY,CAAC;QAC/D,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,KAAK,YAAY,CAAC;QACvE,gBAAgB,EAAE,kCAAkC,CAAC,MAAM,CAAC,gBAAgB,EAAE,GAAG,KAAK,mBAAmB,CAAC;QAC1G,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,KAAK,YAAY,CAAC;KAC/D,CAAC;AAAA,CACF;AAED,MAAM,UAAU,uCAAuC,CAAC,KAAc,EAAsC;IAC3G,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;IACvE,OAAO;QACN,aAAa,EAAE,uBAAuB,CACrC,YAAY,CAAC,aAAa,EAC1B,6BAA6B,EAC7B,yCAAyC,CACzC;QACD,SAAS,EAAE,uBAAuB,CACjC,YAAY,CAAC,SAAS,EACtB,yBAAyB,EACzB,yCAAyC,CACzC;QACD,UAAU,EAAE,uBAAuB,CAClC,YAAY,CAAC,UAAU,EACvB,0BAA0B,EAC1B,sCAAsC,EACtC,4CAA4C,CAC5C;QACD,SAAS,EAAE,eAAe,CAAC,YAAY,CAAC,SAAS,EAAE,yBAAyB,CAAC;QAC7E,gBAAgB,EAAE,0BAA0B,CAAC,YAAY,CAAC,gBAAgB,EAAE,gCAAgC,CAAC;QAC7G,QAAQ,EAAE,wBAAwB,CAAC,YAAY,CAAC,QAAQ,EAAE,wBAAwB,CAAC;QACnF,YAAY,EAAE,uBAAuB,CACpC,YAAY,CAAC,YAAY,EACzB,4BAA4B,EAC5B,yCAAyC,CACzC;QACD,SAAS,EAAE,4BAA4B,CAAC,YAAY,CAAC,SAAS,EAAE,yBAAyB,CAAC;QAC1F,SAAS,EAAE,4BAA4B,CAAC,YAAY,CAAC,SAAS,EAAE,yBAAyB,CAAC;KAC1F,CAAC;AAAA,CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,4CAA4C,CAC3D,aAA4D,EACrB;IAMvC,MAAM,eAAe,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC/D,KAAK,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,aAAa,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,IAAI,0BAA0B,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACvE,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC9E,OAAO,UAAU;SACf,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,MAAM,GAAG,0CAA0C,CAAC,CAAC;SAClF,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;AAAA,CAC1C;AAED,SAAS,0BAA0B,CAClC,IAAyE,EACzE,KAA0E,EACjE;IACT,OAAO,CACN,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC;QACzE,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC;QACzE,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CACvC,CAAC;AAAA,CACF;AAED,SAAS,sBAAsB,CAC9B,IAAyE,EACzE,KAA0E,EACjE;IACT,OAAO,CACN,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC;QACzE,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC;QACzE,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC;QACjF,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC;QACzE,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC;QAC3E,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CACvC,CAAC;AAAA,CACF;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAc,EAA2B;IACrF,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;IACjE,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,EAAE,iCAAiC,CAAC,CAAC;IAC1G,OAAO;QACN,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC;QAC5D,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,sBAAsB,CAAC;QACzD,iBAAiB,EAAE,UAAU,CAAC,MAAM,CAAC,iBAAiB,EAAE,kCAAkC,EAAE,CAAC,KAAK,EAAE,EAAE,CACrG,YAAY,CAAC,KAAK,EAAE,kCAAkC,CAAC,CACvD;QACD,YAAY,EAAE,6BAA6B,CAC1C,wBAAwB,CAAC,MAAM,CAAC,YAAY,EAAE,6BAA6B,CAAC;YAC3E,+BAA+B,CAChC;QACD,QAAQ,EAAE,uBAAuB,CAAC,MAAM,CAAC,QAAQ,EAAE,yBAAyB,CAAC;QAC7E,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,yBAAyB,CAAC;QAClE,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,2BAA2B,CAAC;QACxE,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,0BAA0B,CAAC;QACrE,GAAG,iCAAiC,CACnC,MAAM,CAAC,wBAAwB,EAC/B,yCAAyC,EACzC,uCAAuC,EACvC,gCAAgC,CAChC;QACD,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC;KAC/D,CAAC;AAAA,CACF;AAED,MAAM,UAAU,qCAAqC,CAAC,KAAc,EAAoC;IACvG,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,sCAAsC,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,mCAAmC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,oBAAoB,CAAC,SAAS,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;IAClG,MAAM,SAAS,GAAG,oBAAoB,CAAC,SAAS,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;IAClG,MAAM,SAAS,GAAG,oBAAoB,CAAC,SAAS,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG;QACd,UAAU,EAAE,YAAY,CAAC,SAAS,CAAC,UAAU,EAAE,qCAAqC,CAAC;QACrF,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,SAAS,EAAE,oCAAoC,CAAC;QAClF,OAAO;QACP,WAAW,EAAE,YAAY,CAAC,SAAS,CAAC,WAAW,EAAE,sCAAsC,CAAC;QACxF,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;QACjD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;QACjD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;KACjD,CAAC;IACF,IAAI,OAAO,KAAK,yBAAyB,EAAE,CAAC;QAC3C,OAAO;YACN,GAAG,MAAM;YACT,UAAU,EAAE,YAAY,CAAC,SAAS,CAAC,UAAU,EAAE,qCAAqC,CAAC;YACrF,YAAY,EAAE,YAAY,CAAC,SAAS,CAAC,YAAY,EAAE,uCAAuC,CAAC;SAC3F,CAAC;IACH,CAAC;IACD,OAAO;QACN,GAAG,MAAM;QACT,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,SAAS,EAAE,oCAAoC,CAAC;KAClF,CAAC;AAAA,CACF;AAED,MAAM,UAAU,mCAAmC,CAAC,KAAc,EAAkC;IACnG,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,SAAS,EAAE,kCAAkC,CAAC,CAAC;IAC7F,OAAO;QACN,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,mCAAmC,CAAC;QAChF,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,kCAAkC,CAAC;QAC7E,YAAY,EAAE,6BAA6B,CAC1C,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,qCAAqC,CAAC,CAC5E;QACD,QAAQ,EAAE,uBAAuB,CAAC,MAAM,CAAC,QAAQ,EAAE,iCAAiC,CAAC;QACrF,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,kCAAkC,CAAC;QAC7E,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,kCAAkC,CAAC;QAC7E,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;KACjD,CAAC;AAAA,CACF;AAED,SAAS,UAAU,CAAI,KAAc,EAAE,KAAa,EAAE,UAAiC,EAAO;IAC7F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;AAAA,CAC/C;AAED,SAAS,kBAAkB,CAAI,KAAc,EAAE,KAAa,EAAE,UAAiC,EAAO;IACrG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACX,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;AAAA,CAC5C;AAED,SAAS,sBAAsB,CAAC,KAAc,EAAE,KAAa,EAAwB;IACpF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,KAAK,CAAC;IAAA,CACb,CAAC,CAAC;AAAA,CACH;AAED,SAAS,iCAAiC,CACzC,KAAc,EACd,KAAa,EACb,QAAgB,EAChB,UAAkB,EACsC;IACxD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,6BAA6B,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,CAAC;AAAA,CAC5C;AAED,SAAS,gCAAgC,CAAC,KAAc,EAAE,KAAa,EAA4C;IAClH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACX,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,yBAAyB,CAAC,EAAE,CAAC;AAAA,CAC5E;AAED,SAAS,8CAA8C,CACtD,KAAc,EACd,KAAa,EAC+C;IAC5D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACX,CAAC;IACD,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,uCAAuC,CAAC,CAAC;IACxF,MAAM,UAAU,GAAG,4CAA4C,CAAC,aAAa,CAAC,CAAC;IAC/E,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;AAAA,CACrE;AAED,SAAS,mCAAmC,CAAC,KAAc,EAA2C;IACrG,IAAI,KAAK,KAAK,yBAAyB,IAAI,KAAK,KAAK,wBAAwB,EAAE,CAAC;QAC/E,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAC;AAAA,CAC9G;AAED,SAAS,wBAAwB,CAAC,KAAc,EAAE,KAAa,EAAgC;IAC9F,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;AAAA,CACxC;AAED,SAAS,wBAAwB,CAAC,KAAc,EAAE,KAAa,EAAgC;IAC9F,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;AAAA,CACxC;AAED,SAAS,0BAA0B,CAAC,KAAc,EAAE,KAAa,EAAkC;IAClG,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QACvD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;AAAA,CAC9D;AAED,SAAS,kCAAkC,CAAC,KAAc,EAAE,KAAa,EAA8C;IACtH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,0BAA0B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAAA,CAChD;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa,EAA2B;IAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAgC,CAAC;AAAA,CACxC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa,EAAU;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,uBAAuB,CAAC,KAAc,EAAE,KAAa,EAAE,QAAgB,EAAE,aAAsB,EAAU;IACjH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,QAAQ,cAAc,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,aAAa,aAAa,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa,EAAU;IAC/D,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,KAAa,EAAsB;IAChF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAAA,CAClC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa,EAAU;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,wBAAwB,CAAC,KAAc,EAAE,KAAa,EAAsB;IACpF,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAAA,CACxE;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,KAAa,EAAsB;IAChF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAAA,CAClC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa,EAAW;IAC9D,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa,EAAU;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,4BAA4B,CAAC,KAAc,EAAE,KAAa,EAAU;IAC5E,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa,EAAU;IAC5D,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAAA,CAChD;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa,EAAU;IAC5D,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAAA,CAChD;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,IAAY,EAAkC;IAC1F,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AAAA,CACxE","sourcesContent":["import { Buffer } from \"node:buffer\";\nimport { readFile } from \"node:fs/promises\";\nimport { writeDurableAtomicFile } from \"../../../utils/durable-atomic-write.ts\";\nimport { cloneIrohRemoteRpcGrant, type IrohRemoteRpcGrant, parseIrohRemoteRpcGrant } from \"./access-grant.ts\";\nimport {\n\tDEFAULT_IROH_REMOTE_ALLOW_TOOLS,\n\tisIrohRemoteWorkingDirectory,\n\tisIrohRemoteWorktreeId,\n\tnormalizeIrohRemoteAllowTools,\n} from \"./protocol.ts\";\n\nexport interface IrohRemoteWorkspace {\n\tname: string;\n\tpath: string;\n\tallowedTools?: string;\n}\n\n/** A daemon-managed git worktree, keyed under its parent workspace. */\nexport interface IrohRemoteWorkspaceWorktree {\n\t/** ^[a-z0-9][a-z0-9._-]{0,63}$ — unique per workspace. */\n\tid: string;\n\tworkspaceName: string;\n\t/** Absolute checkout path; host-local, never sent on the wire. */\n\tpath: string;\n\t/** Registered-workspace-relative git repo root this worktree was created from. Omitted for the workspace root. */\n\tsourceRootRelativePath?: string;\n\tbranch: string;\n\tbaseRef?: string;\n\tcreatedAt: number;\n\t/** Sessions bound to this worktree (usually exactly one). */\n\tsessionIds: string[];\n}\n\nexport type IrohRemotePushTargetProvider = \"fcm\";\nexport type IrohRemotePushTargetPlatform = \"ios\";\nexport type IrohRemotePushTokenEnvironment = \"development\" | \"production\";\n\nexport interface IrohRemoteLiveActivityTarget {\n\tactivityId: string;\n\tpushToken: string;\n\ttokenHash?: string;\n\ttokenEnvironment?: IrohRemotePushTokenEnvironment;\n\tupdatedAt: number;\n}\n\nexport interface IrohRemotePushTarget {\n\tid: string;\n\tprovider: IrohRemotePushTargetProvider;\n\tplatform: IrohRemotePushTargetPlatform;\n\tpushTargetAuthToken: string;\n\trelayUrl?: string;\n\ttokenHash?: string;\n\tliveActivity?: IrohRemoteLiveActivityTarget;\n\tenabled: boolean;\n\tcreatedAt: number;\n\tupdatedAt: number;\n}\n\nexport interface IrohRemoteLiveActivityRegistration {\n\tworkspaceName: string;\n\tsessionId: string;\n\tactivityId: string;\n\ttokenHash: string;\n\ttokenEnvironment: IrohRemotePushTokenEnvironment;\n\tplatform: IrohRemotePushTargetPlatform;\n\tpushTargetId: string;\n\tcreatedAt: number;\n\tupdatedAt: number;\n}\n\nexport const MAX_IROH_REMOTE_LIVE_ACTIVITIES_PER_CLIENT = 32;\nexport const MAX_IROH_REMOTE_LIVE_ACTIVITY_SCOPE_BYTES = 512;\nexport const MAX_IROH_REMOTE_LIVE_ACTIVITY_ID_BYTES = 512;\nexport const MAX_IROH_REMOTE_LIVE_ACTIVITY_ID_CODE_POINTS = 128;\n\nexport interface IrohRemoteClient {\n\tnodeId: string;\n\tlabel: string;\n\tallowedWorkspaces: string[];\n\tallowedTools: string;\n\trpcGrant?: IrohRemoteRpcGrant;\n\tpairedAt: number;\n\tlastSeenAt: number;\n\tlastSessionIdByWorkspace?: Record<string, string>;\n\tpushTargets?: IrohRemotePushTarget[];\n\tliveActivities?: IrohRemoteLiveActivityRegistration[];\n}\n\nexport type IrohRemoteGrantedClient = IrohRemoteClient & { rpcGrant: IrohRemoteRpcGrant };\n\nexport interface IrohRemoteRevokedClient {\n\tnodeId: string;\n\tlabel: string;\n\tallowedWorkspaces: string[];\n\tallowedTools: string;\n\trpcGrant?: IrohRemoteRpcGrant;\n\tpairedAt: number;\n\tlastSeenAt: number;\n\trevokedAt: number;\n\tlastSessionIdByWorkspace?: Record<string, string>;\n\trePairApprovedAt?: number;\n}\n\nexport type IrohRemoteGrantedRevokedClient = IrohRemoteRevokedClient & { rpcGrant: IrohRemoteRpcGrant };\n\nexport interface IrohRemotePendingPairingTicket {\n\tsecretHash: string;\n\tworkspace: string;\n\tallowedTools: string;\n\trpcGrant?: IrohRemoteRpcGrant;\n\texpiresAt: number;\n\tcreatedAt: number;\n\tlabelHint?: string;\n}\n\nexport type IrohRemoteGrantedPendingPairingTicket = IrohRemotePendingPairingTicket & {\n\trpcGrant: IrohRemoteRpcGrant;\n};\n\nexport type IrohRemotePairingSecretTombstoneOutcome = \"pairing_secret_consumed\" | \"pairing_secret_expired\";\n\nexport interface IrohRemotePairingSecretTombstone {\n\tsecretHash: string;\n\tworkspace: string;\n\toutcome: IrohRemotePairingSecretTombstoneOutcome;\n\tretainUntil: number;\n\tcreatedAt?: number;\n\texpiresAt?: number;\n\tlabelHint?: string;\n\tconsumedAt?: number;\n\tclientNodeId?: string;\n\texpiredAt?: number;\n}\n\nexport interface IrohRemoteHostState {\n\thostSecretKey?: number[];\n\tpairingSecretTombstones?: IrohRemotePairingSecretTombstone[];\n\tworkspaces: IrohRemoteWorkspace[];\n\tworktrees?: IrohRemoteWorkspaceWorktree[];\n\tclients: IrohRemoteClient[];\n\trevokedClients?: IrohRemoteRevokedClient[];\n\tpendingPairingTickets?: IrohRemotePendingPairingTicket[];\n}\n\nexport function createEmptyIrohRemoteHostState(): IrohRemoteHostState {\n\treturn {\n\t\thostSecretKey: undefined,\n\t\tpairingSecretTombstones: [],\n\t\tworkspaces: [],\n\t\tworktrees: [],\n\t\tclients: [],\n\t\trevokedClients: [],\n\t\tpendingPairingTickets: [],\n\t};\n}\n\nexport async function readIrohRemoteHostState(path: string): Promise<IrohRemoteHostState> {\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(await readFile(path, \"utf8\"));\n\t} catch (error: unknown) {\n\t\tif (isNodeErrorWithCode(error, \"ENOENT\")) {\n\t\t\treturn createEmptyIrohRemoteHostState();\n\t\t}\n\t\tthrow error;\n\t}\n\treturn parseIrohRemoteHostState(parsed);\n}\n\nexport async function writeIrohRemoteHostState(path: string, state: IrohRemoteHostState): Promise<void> {\n\tawait writeDurableAtomicFile(path, `${JSON.stringify(serializeIrohRemoteHostState(state), null, 2)}\\n`);\n}\n\nexport function parseIrohRemoteHostState(value: unknown): IrohRemoteHostState {\n\tconst state = expectRecord(value, \"Iroh remote host state\");\n\treturn {\n\t\thostSecretKey: parseOptionalByteArray(state.hostSecretKey, \"hostSecretKey\"),\n\t\tpairingSecretTombstones: parseOptionalArray(\n\t\t\tstate.pairingSecretTombstones,\n\t\t\t\"pairingSecretTombstones\",\n\t\t\tparseIrohRemotePairingSecretTombstone,\n\t\t),\n\t\tworkspaces: parseArray(state.workspaces, \"workspaces\", parseIrohRemoteWorkspace),\n\t\tworktrees: parseOptionalArray(state.worktrees, \"worktrees\", parseIrohRemoteWorkspaceWorktree),\n\t\tclients: parseArray(state.clients, \"clients\", parseIrohRemoteClient),\n\t\trevokedClients: parseOptionalArray(state.revokedClients, \"revokedClients\", parseIrohRemoteRevokedClient),\n\t\tpendingPairingTickets: parseOptionalArray(\n\t\t\tstate.pendingPairingTickets,\n\t\t\t\"pendingPairingTickets\",\n\t\t\tparseIrohRemotePendingPairingTicket,\n\t\t),\n\t};\n}\n\nfunction serializeIrohRemoteHostState(state: IrohRemoteHostState): IrohRemoteHostState {\n\treturn {\n\t\thostSecretKey: state.hostSecretKey ? [...state.hostSecretKey] : undefined,\n\t\tpairingSecretTombstones: (state.pairingSecretTombstones ?? []).map((tombstone) => ({ ...tombstone })),\n\t\tworkspaces: state.workspaces.map((workspace) => ({ ...workspace })),\n\t\tworktrees: (state.worktrees ?? []).map((worktree) => ({ ...worktree, sessionIds: [...worktree.sessionIds] })),\n\t\tclients: state.clients.map((client) => ({\n\t\t\t...client,\n\t\t\tallowedWorkspaces: [...client.allowedWorkspaces],\n\t\t\t...(client.rpcGrant === undefined ? {} : { rpcGrant: cloneIrohRemoteRpcGrant(client.rpcGrant) }),\n\t\t\t...(client.lastSessionIdByWorkspace\n\t\t\t\t? { lastSessionIdByWorkspace: { ...client.lastSessionIdByWorkspace } }\n\t\t\t\t: {}),\n\t\t\t...(client.pushTargets\n\t\t\t\t? {\n\t\t\t\t\t\tpushTargets: client.pushTargets.map((target) => ({\n\t\t\t\t\t\t\t...target,\n\t\t\t\t\t\t\t...(target.liveActivity ? { liveActivity: { ...target.liveActivity } } : {}),\n\t\t\t\t\t\t})),\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t\t...(client.liveActivities\n\t\t\t\t? { liveActivities: client.liveActivities.map((registration) => ({ ...registration })) }\n\t\t\t\t: {}),\n\t\t})),\n\t\trevokedClients: (state.revokedClients ?? []).map((client) => ({\n\t\t\t...client,\n\t\t\tallowedWorkspaces: [...client.allowedWorkspaces],\n\t\t\t...(client.rpcGrant === undefined ? {} : { rpcGrant: cloneIrohRemoteRpcGrant(client.rpcGrant) }),\n\t\t\t...(client.lastSessionIdByWorkspace\n\t\t\t\t? { lastSessionIdByWorkspace: { ...client.lastSessionIdByWorkspace } }\n\t\t\t\t: {}),\n\t\t})),\n\t\tpendingPairingTickets: (state.pendingPairingTickets ?? []).map((ticket) => ({\n\t\t\t...ticket,\n\t\t\t...(ticket.rpcGrant === undefined ? {} : { rpcGrant: cloneIrohRemoteRpcGrant(ticket.rpcGrant) }),\n\t\t})),\n\t};\n}\n\nexport function parseIrohRemoteWorkspace(value: unknown): IrohRemoteWorkspace {\n\tconst workspace = expectRecord(value, \"Iroh remote workspace\");\n\tconst allowedTools = expectOptionalAllowTools(workspace.allowedTools, \"workspace allowedTools\");\n\treturn {\n\t\tname: expectString(workspace.name, \"workspace name\"),\n\t\tpath: expectString(workspace.path, \"workspace path\"),\n\t\tallowedTools: allowedTools === undefined ? undefined : normalizeIrohRemoteAllowTools(allowedTools),\n\t};\n}\n\nexport function parseIrohRemoteWorkspaceWorktree(value: unknown): IrohRemoteWorkspaceWorktree {\n\tconst worktree = expectRecord(value, \"Iroh remote worktree\");\n\tconst baseRef = expectOptionalString(worktree.baseRef, \"worktree baseRef\");\n\tconst sourceRootRelativePath = expectOptionalWorkspaceRelativePath(\n\t\tworktree.sourceRootRelativePath,\n\t\t\"worktree sourceRootRelativePath\",\n\t);\n\treturn {\n\t\tid: expectWorktreeId(worktree.id),\n\t\tworkspaceName: expectString(worktree.workspaceName, \"worktree workspaceName\"),\n\t\tpath: expectString(worktree.path, \"worktree path\"),\n\t\t...(sourceRootRelativePath === undefined ? {} : { sourceRootRelativePath }),\n\t\tbranch: expectString(worktree.branch, \"worktree branch\"),\n\t\t...(baseRef === undefined ? {} : { baseRef }),\n\t\tcreatedAt: expectNumber(worktree.createdAt, \"worktree createdAt\"),\n\t\tsessionIds: parseArray(worktree.sessionIds, \"worktree sessionIds\", (entry) =>\n\t\t\texpectString(entry, \"worktree session id\"),\n\t\t),\n\t};\n}\n\nfunction expectWorktreeId(value: unknown): string {\n\tif (!isIrohRemoteWorktreeId(value)) {\n\t\tthrow new Error(\"worktree id must match lowercase worktree id syntax\");\n\t}\n\treturn value;\n}\n\nfunction expectOptionalWorkspaceRelativePath(value: unknown, label: string): string | undefined {\n\tif (value === undefined) {\n\t\treturn undefined;\n\t}\n\tif (!isIrohRemoteWorkingDirectory(value)) {\n\t\tthrow new Error(`${label} must be a relative workspace path`);\n\t}\n\treturn value;\n}\n\nexport function parseIrohRemoteClient(value: unknown): IrohRemoteClient {\n\tconst client = expectRecord(value, \"Iroh remote client\");\n\treturn {\n\t\tnodeId: expectString(client.nodeId, \"client nodeId\"),\n\t\tlabel: expectString(client.label, \"client label\"),\n\t\tallowedWorkspaces: parseArray(client.allowedWorkspaces, \"client allowedWorkspaces\", (entry) =>\n\t\t\texpectString(entry, \"client allowed workspace\"),\n\t\t),\n\t\tallowedTools: normalizeIrohRemoteAllowTools(\n\t\t\texpectOptionalAllowTools(client.allowedTools, \"client allowedTools\") ?? DEFAULT_IROH_REMOTE_ALLOW_TOOLS,\n\t\t),\n\t\trpcGrant: parseIrohRemoteRpcGrant(client.rpcGrant, \"client rpcGrant\"),\n\t\tpairedAt: expectNumber(client.pairedAt, \"client pairedAt\"),\n\t\tlastSeenAt: expectNumber(client.lastSeenAt, \"client lastSeenAt\"),\n\t\t...parseOptionalStringRecordProperty(\n\t\t\tclient.lastSessionIdByWorkspace,\n\t\t\t\"client lastSessionIdByWorkspace\",\n\t\t\t\"client last session workspace\",\n\t\t\t\"client last session id\",\n\t\t),\n\t\t...parseOptionalPushTargetsProperty(client.pushTargets, \"client pushTargets\"),\n\t\t...parseOptionalLiveActivityRegistrationsProperty(client.liveActivities, \"client liveActivities\"),\n\t};\n}\n\nexport function parseIrohRemotePushTarget(value: unknown): IrohRemotePushTarget {\n\tconst target = expectRecord(value, \"push target\");\n\treturn {\n\t\tid: expectString(target.id, \"push target id\"),\n\t\tprovider: expectPushTargetProvider(target.provider, \"push target provider\"),\n\t\tplatform: expectPushTargetPlatform(target.platform, \"push target platform\"),\n\t\tpushTargetAuthToken: expectString(target.pushTargetAuthToken, \"push target pushTargetAuthToken\"),\n\t\trelayUrl: expectOptionalString(target.relayUrl, \"push target relayUrl\"),\n\t\ttokenHash: expectOptionalString(target.tokenHash, \"push target tokenHash\"),\n\t\tliveActivity: parseOptionalIrohRemoteLiveActivityTarget(target.liveActivity, \"push target liveActivity\"),\n\t\tenabled: expectBoolean(target.enabled, \"push target enabled\"),\n\t\tcreatedAt: expectNumber(target.createdAt, \"push target createdAt\"),\n\t\tupdatedAt: expectNumber(target.updatedAt, \"push target updatedAt\"),\n\t};\n}\n\nfunction parseOptionalIrohRemoteLiveActivityTarget(\n\tvalue: unknown,\n\tlabel: string,\n): IrohRemoteLiveActivityTarget | undefined {\n\tif (value === undefined) {\n\t\treturn undefined;\n\t}\n\tconst target = expectRecord(value, label);\n\treturn {\n\t\tactivityId: expectString(target.activityId, `${label} activityId`),\n\t\tpushToken: expectString(target.pushToken, `${label} pushToken`),\n\t\ttokenHash: expectOptionalString(target.tokenHash, `${label} tokenHash`),\n\t\ttokenEnvironment: expectOptionalPushTokenEnvironment(target.tokenEnvironment, `${label} tokenEnvironment`),\n\t\tupdatedAt: expectNumber(target.updatedAt, `${label} updatedAt`),\n\t};\n}\n\nexport function parseIrohRemoteLiveActivityRegistration(value: unknown): IrohRemoteLiveActivityRegistration {\n\tconst registration = expectRecord(value, \"live activity registration\");\n\treturn {\n\t\tworkspaceName: expectBoundedUtf8String(\n\t\t\tregistration.workspaceName,\n\t\t\t\"live activity workspaceName\",\n\t\t\tMAX_IROH_REMOTE_LIVE_ACTIVITY_SCOPE_BYTES,\n\t\t),\n\t\tsessionId: expectBoundedUtf8String(\n\t\t\tregistration.sessionId,\n\t\t\t\"live activity sessionId\",\n\t\t\tMAX_IROH_REMOTE_LIVE_ACTIVITY_SCOPE_BYTES,\n\t\t),\n\t\tactivityId: expectBoundedUtf8String(\n\t\t\tregistration.activityId,\n\t\t\t\"live activity activityId\",\n\t\t\tMAX_IROH_REMOTE_LIVE_ACTIVITY_ID_BYTES,\n\t\t\tMAX_IROH_REMOTE_LIVE_ACTIVITY_ID_CODE_POINTS,\n\t\t),\n\t\ttokenHash: expectSha256Hex(registration.tokenHash, \"live activity tokenHash\"),\n\t\ttokenEnvironment: expectPushTokenEnvironment(registration.tokenEnvironment, \"live activity tokenEnvironment\"),\n\t\tplatform: expectPushTargetPlatform(registration.platform, \"live activity platform\"),\n\t\tpushTargetId: expectBoundedUtf8String(\n\t\t\tregistration.pushTargetId,\n\t\t\t\"live activity pushTargetId\",\n\t\t\tMAX_IROH_REMOTE_LIVE_ACTIVITY_SCOPE_BYTES,\n\t\t),\n\t\tcreatedAt: expectNonNegativeSafeInteger(registration.createdAt, \"live activity createdAt\"),\n\t\tupdatedAt: expectNonNegativeSafeInteger(registration.updatedAt, \"live activity updatedAt\"),\n\t};\n}\n\n/**\n * Normalize legacy registration arrays into the same bounded shape enforced at\n * mutation time: one newest entry per workspace/session and the newest 32\n * sessions overall, ordered oldest-first for deterministic future eviction.\n */\nexport function normalizeIrohRemoteLiveActivityRegistrations(\n\tregistrations: readonly IrohRemoteLiveActivityRegistration[],\n): IrohRemoteLiveActivityRegistration[] {\n\tinterface IndexedRegistration {\n\t\tregistration: IrohRemoteLiveActivityRegistration;\n\t\tindex: number;\n\t}\n\n\tconst newestBySession = new Map<string, IndexedRegistration>();\n\tfor (const [index, registration] of registrations.entries()) {\n\t\tconst candidate = { registration, index };\n\t\tconst key = JSON.stringify([registration.workspaceName, registration.sessionId]);\n\t\tconst existing = newestBySession.get(key);\n\t\tif (!existing || compareLiveActivityRecency(existing, candidate) <= 0) {\n\t\t\tnewestBySession.set(key, candidate);\n\t\t}\n\t}\n\n\tconst normalized = [...newestBySession.values()].sort(compareLiveActivityAge);\n\treturn normalized\n\t\t.slice(Math.max(0, normalized.length - MAX_IROH_REMOTE_LIVE_ACTIVITIES_PER_CLIENT))\n\t\t.map(({ registration }) => registration);\n}\n\nfunction compareLiveActivityRecency(\n\tleft: { registration: IrohRemoteLiveActivityRegistration; index: number },\n\tright: { registration: IrohRemoteLiveActivityRegistration; index: number },\n): number {\n\treturn (\n\t\tcompareNumbers(left.registration.updatedAt, right.registration.updatedAt) ||\n\t\tcompareNumbers(left.registration.createdAt, right.registration.createdAt) ||\n\t\tcompareNumbers(left.index, right.index)\n\t);\n}\n\nfunction compareLiveActivityAge(\n\tleft: { registration: IrohRemoteLiveActivityRegistration; index: number },\n\tright: { registration: IrohRemoteLiveActivityRegistration; index: number },\n): number {\n\treturn (\n\t\tcompareNumbers(left.registration.createdAt, right.registration.createdAt) ||\n\t\tcompareNumbers(left.registration.updatedAt, right.registration.updatedAt) ||\n\t\tcompareStrings(left.registration.workspaceName, right.registration.workspaceName) ||\n\t\tcompareStrings(left.registration.sessionId, right.registration.sessionId) ||\n\t\tcompareStrings(left.registration.activityId, right.registration.activityId) ||\n\t\tcompareNumbers(left.index, right.index)\n\t);\n}\n\nexport function parseIrohRemoteRevokedClient(value: unknown): IrohRemoteRevokedClient {\n\tconst client = expectRecord(value, \"Iroh remote revoked client\");\n\tconst rePairApprovedAt = expectOptionalNumber(client.rePairApprovedAt, \"revoked client rePairApprovedAt\");\n\treturn {\n\t\tnodeId: expectString(client.nodeId, \"revoked client nodeId\"),\n\t\tlabel: expectString(client.label, \"revoked client label\"),\n\t\tallowedWorkspaces: parseArray(client.allowedWorkspaces, \"revoked client allowedWorkspaces\", (entry) =>\n\t\t\texpectString(entry, \"revoked client allowed workspace\"),\n\t\t),\n\t\tallowedTools: normalizeIrohRemoteAllowTools(\n\t\t\texpectOptionalAllowTools(client.allowedTools, \"revoked client allowedTools\") ??\n\t\t\t\tDEFAULT_IROH_REMOTE_ALLOW_TOOLS,\n\t\t),\n\t\trpcGrant: parseIrohRemoteRpcGrant(client.rpcGrant, \"revoked client rpcGrant\"),\n\t\tpairedAt: expectNumber(client.pairedAt, \"revoked client pairedAt\"),\n\t\tlastSeenAt: expectNumber(client.lastSeenAt, \"revoked client lastSeenAt\"),\n\t\trevokedAt: expectNumber(client.revokedAt, \"revoked client revokedAt\"),\n\t\t...parseOptionalStringRecordProperty(\n\t\t\tclient.lastSessionIdByWorkspace,\n\t\t\t\"revoked client lastSessionIdByWorkspace\",\n\t\t\t\"revoked client last session workspace\",\n\t\t\t\"revoked client last session id\",\n\t\t),\n\t\t...(rePairApprovedAt === undefined ? {} : { rePairApprovedAt }),\n\t};\n}\n\nexport function parseIrohRemotePairingSecretTombstone(value: unknown): IrohRemotePairingSecretTombstone {\n\tconst tombstone = expectRecord(value, \"Iroh remote pairing secret tombstone\");\n\tconst outcome = expectPairingSecretTombstoneOutcome(tombstone.outcome);\n\tconst createdAt = expectOptionalNumber(tombstone.createdAt, \"pairing secret tombstone createdAt\");\n\tconst expiresAt = expectOptionalNumber(tombstone.expiresAt, \"pairing secret tombstone expiresAt\");\n\tconst labelHint = expectOptionalString(tombstone.labelHint, \"pairing secret tombstone labelHint\");\n\tconst common = {\n\t\tsecretHash: expectString(tombstone.secretHash, \"pairing secret tombstone secretHash\"),\n\t\tworkspace: expectString(tombstone.workspace, \"pairing secret tombstone workspace\"),\n\t\toutcome,\n\t\tretainUntil: expectNumber(tombstone.retainUntil, \"pairing secret tombstone retainUntil\"),\n\t\t...(createdAt === undefined ? {} : { createdAt }),\n\t\t...(expiresAt === undefined ? {} : { expiresAt }),\n\t\t...(labelHint === undefined ? {} : { labelHint }),\n\t};\n\tif (outcome === \"pairing_secret_consumed\") {\n\t\treturn {\n\t\t\t...common,\n\t\t\tconsumedAt: expectNumber(tombstone.consumedAt, \"pairing secret tombstone consumedAt\"),\n\t\t\tclientNodeId: expectString(tombstone.clientNodeId, \"pairing secret tombstone clientNodeId\"),\n\t\t};\n\t}\n\treturn {\n\t\t...common,\n\t\texpiredAt: expectNumber(tombstone.expiredAt, \"pairing secret tombstone expiredAt\"),\n\t};\n}\n\nexport function parseIrohRemotePendingPairingTicket(value: unknown): IrohRemotePendingPairingTicket {\n\tconst ticket = expectRecord(value, \"Iroh remote pending pairing ticket\");\n\tconst labelHint = expectOptionalString(ticket.labelHint, \"pending pairing ticket labelHint\");\n\treturn {\n\t\tsecretHash: expectString(ticket.secretHash, \"pending pairing ticket secretHash\"),\n\t\tworkspace: expectString(ticket.workspace, \"pending pairing ticket workspace\"),\n\t\tallowedTools: normalizeIrohRemoteAllowTools(\n\t\t\texpectAllowTools(ticket.allowedTools, \"pending pairing ticket allowedTools\"),\n\t\t),\n\t\trpcGrant: parseIrohRemoteRpcGrant(ticket.rpcGrant, \"pending pairing ticket rpcGrant\"),\n\t\texpiresAt: expectNumber(ticket.expiresAt, \"pending pairing ticket expiresAt\"),\n\t\tcreatedAt: expectNumber(ticket.createdAt, \"pending pairing ticket createdAt\"),\n\t\t...(labelHint === undefined ? {} : { labelHint }),\n\t};\n}\n\nfunction parseArray<T>(value: unknown, label: string, parseEntry: (value: unknown) => T): T[] {\n\tif (!Array.isArray(value)) {\n\t\tthrow new Error(`${label} must be an array`);\n\t}\n\treturn value.map((entry) => parseEntry(entry));\n}\n\nfunction parseOptionalArray<T>(value: unknown, label: string, parseEntry: (value: unknown) => T): T[] {\n\tif (value === undefined) {\n\t\treturn [];\n\t}\n\treturn parseArray(value, label, parseEntry);\n}\n\nfunction parseOptionalByteArray(value: unknown, label: string): number[] | undefined {\n\tif (value === undefined) {\n\t\treturn undefined;\n\t}\n\treturn parseArray(value, label, (entry) => {\n\t\tif (typeof entry !== \"number\" || !Number.isInteger(entry) || entry < 0 || entry > 255) {\n\t\t\tthrow new Error(`${label} must contain byte values`);\n\t\t}\n\t\treturn entry;\n\t});\n}\n\nfunction parseOptionalStringRecordProperty(\n\tvalue: unknown,\n\tlabel: string,\n\tkeyLabel: string,\n\tvalueLabel: string,\n): { lastSessionIdByWorkspace?: Record<string, string> } {\n\tif (value === undefined) {\n\t\treturn {};\n\t}\n\tconst record = expectRecord(value, label);\n\tconst parsed: Record<string, string> = {};\n\tfor (const [key, entry] of Object.entries(record)) {\n\t\tif (key.length === 0) {\n\t\t\tthrow new Error(`${keyLabel} must be a non-empty string`);\n\t\t}\n\t\tparsed[key] = expectString(entry, valueLabel);\n\t}\n\treturn { lastSessionIdByWorkspace: parsed };\n}\n\nfunction parseOptionalPushTargetsProperty(value: unknown, label: string): { pushTargets?: IrohRemotePushTarget[] } {\n\tif (value === undefined) {\n\t\treturn {};\n\t}\n\treturn { pushTargets: parseArray(value, label, parseIrohRemotePushTarget) };\n}\n\nfunction parseOptionalLiveActivityRegistrationsProperty(\n\tvalue: unknown,\n\tlabel: string,\n): { liveActivities?: IrohRemoteLiveActivityRegistration[] } {\n\tif (value === undefined) {\n\t\treturn {};\n\t}\n\tconst registrations = parseArray(value, label, parseIrohRemoteLiveActivityRegistration);\n\tconst normalized = normalizeIrohRemoteLiveActivityRegistrations(registrations);\n\treturn normalized.length === 0 ? {} : { liveActivities: normalized };\n}\n\nfunction expectPairingSecretTombstoneOutcome(value: unknown): IrohRemotePairingSecretTombstoneOutcome {\n\tif (value === \"pairing_secret_consumed\" || value === \"pairing_secret_expired\") {\n\t\treturn value;\n\t}\n\tthrow new Error(\"pairing secret tombstone outcome must be pairing_secret_consumed or pairing_secret_expired\");\n}\n\nfunction expectPushTargetProvider(value: unknown, label: string): IrohRemotePushTargetProvider {\n\tif (value === \"fcm\") {\n\t\treturn value;\n\t}\n\tthrow new Error(`${label} must be fcm`);\n}\n\nfunction expectPushTargetPlatform(value: unknown, label: string): IrohRemotePushTargetPlatform {\n\tif (value === \"ios\") {\n\t\treturn value;\n\t}\n\tthrow new Error(`${label} must be ios`);\n}\n\nfunction expectPushTokenEnvironment(value: unknown, label: string): IrohRemotePushTokenEnvironment {\n\tif (value === \"development\" || value === \"production\") {\n\t\treturn value;\n\t}\n\tthrow new Error(`${label} must be development or production`);\n}\n\nfunction expectOptionalPushTokenEnvironment(value: unknown, label: string): IrohRemotePushTokenEnvironment | undefined {\n\tif (value === undefined) {\n\t\treturn undefined;\n\t}\n\treturn expectPushTokenEnvironment(value, label);\n}\n\nfunction expectRecord(value: unknown, label: string): Record<string, unknown> {\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n\t\tthrow new Error(`${label} must be an object`);\n\t}\n\treturn value as Record<string, unknown>;\n}\n\nfunction expectString(value: unknown, label: string): string {\n\tif (typeof value !== \"string\" || value.length === 0) {\n\t\tthrow new Error(`${label} must be a non-empty string`);\n\t}\n\treturn value;\n}\n\nfunction expectBoundedUtf8String(value: unknown, label: string, maxBytes: number, maxCodePoints?: number): string {\n\tconst parsed = expectString(value, label);\n\tif (Buffer.byteLength(parsed, \"utf8\") > maxBytes) {\n\t\tthrow new Error(`${label} must be at most ${maxBytes} UTF-8 bytes`);\n\t}\n\tif (maxCodePoints !== undefined && Array.from(parsed).length > maxCodePoints) {\n\t\tthrow new Error(`${label} must contain at most ${maxCodePoints} characters`);\n\t}\n\treturn parsed;\n}\n\nfunction expectSha256Hex(value: unknown, label: string): string {\n\tconst parsed = expectString(value, label);\n\tif (!/^[0-9a-f]{64}$/.test(parsed)) {\n\t\tthrow new Error(`${label} must be a lowercase SHA-256 hex digest`);\n\t}\n\treturn parsed;\n}\n\nfunction expectOptionalString(value: unknown, label: string): string | undefined {\n\tif (value === undefined) {\n\t\treturn undefined;\n\t}\n\treturn expectString(value, label);\n}\n\nfunction expectAllowTools(value: unknown, label: string): string {\n\tif (typeof value !== \"string\") {\n\t\tthrow new Error(`${label} must be a string`);\n\t}\n\treturn value;\n}\n\nfunction expectOptionalAllowTools(value: unknown, label: string): string | undefined {\n\treturn value === undefined ? undefined : expectAllowTools(value, label);\n}\n\nfunction expectOptionalNumber(value: unknown, label: string): number | undefined {\n\tif (value === undefined) {\n\t\treturn undefined;\n\t}\n\treturn expectNumber(value, label);\n}\n\nfunction expectBoolean(value: unknown, label: string): boolean {\n\tif (typeof value !== \"boolean\") {\n\t\tthrow new Error(`${label} must be a boolean`);\n\t}\n\treturn value;\n}\n\nfunction expectNumber(value: unknown, label: string): number {\n\tif (typeof value !== \"number\" || !Number.isFinite(value)) {\n\t\tthrow new Error(`${label} must be a finite number`);\n\t}\n\treturn value;\n}\n\nfunction expectNonNegativeSafeInteger(value: unknown, label: string): number {\n\tconst parsed = expectNumber(value, label);\n\tif (!Number.isSafeInteger(parsed) || parsed < 0) {\n\t\tthrow new Error(`${label} must be a non-negative safe integer`);\n\t}\n\treturn parsed;\n}\n\nfunction compareNumbers(left: number, right: number): number {\n\treturn left < right ? -1 : left > right ? 1 : 0;\n}\n\nfunction compareStrings(left: string, right: string): number {\n\treturn left < right ? -1 : left > right ? 1 : 0;\n}\n\nfunction isNodeErrorWithCode(error: unknown, code: string): error is NodeJS.ErrnoException {\n\treturn error instanceof Error && \"code\" in error && error.code === code;\n}\n"]}

package/dist/core/remote/iroh/ticket.d.ts

@@ -0,0 +1,46 @@
+import { IROH_REMOTE_ALPN, type IrohRemoteRelayMode } from "./protocol.ts";
+export interface IrohRemoteTicketPayload {
+    alpn: typeof IROH_REMOTE_ALPN;
+    expiresAt?: number;
+    irohTicket: string;
+    nodeId?: string;
+    relayMode?: IrohRemoteRelayMode;
+    /** Relay server URLs the client should use; required when relayMode is "production". */
+    relayUrls?: string[];
+    /**
+     * Bearer token for relays behind access.shared_token. Secret-like: carried
+     * in pairing tickets (clients keychain it) and stripped from sanitized
+     * reconnect tickets.
+     */
+    relayAuthToken?: string;
+    secret?: string;
+    workspace: string;
+}
+export interface IrohRemoteSanitizedReconnectTicketPayload extends IrohRemoteTicketPayload {
+    nodeId: string;
+    relayMode: IrohRemoteRelayMode;
+}
+/** Non-secret values a user can compare before accepting a pairing ticket. */
+export interface IrohRemotePairingVerificationDetails {
+    expiresAt?: number;
+    hostFingerprint: string;
+    hostNodeId: string;
+    relayMode: IrohRemoteRelayMode;
+    relayOrigins: string[];
+    workspace: string;
+}
+/**
+ * Match the iOS pairing confirmation fingerprint: the first 128 bits of the
+ * SHA-256 digest, rendered as four uppercase 32-bit groups.
+ */
+export declare function formatIrohRemoteHostFingerprint(endpointIdBytes: ArrayLike<number>): string;
+/** Decode a ticket into only the values that are safe to display for comparison. */
+export declare function getIrohRemotePairingVerificationDetails(ticket: string): IrohRemotePairingVerificationDetails;
+export declare function encodeIrohRemoteTicketPayload(payload: IrohRemoteTicketPayload): string;
+export declare function decodeIrohRemoteTicketPayload(ticket: string): IrohRemoteTicketPayload;
+export declare function parseIrohRemoteTicketPayload(value: unknown): IrohRemoteTicketPayload;
+export declare function assertIrohRemoteTicketNotExpired(payload: IrohRemoteTicketPayload, now?: number): void;
+export declare function createIrohRemoteSanitizedReconnectTicketPayload(payload: IrohRemoteTicketPayload): IrohRemoteSanitizedReconnectTicketPayload;
+export declare function createIrohRemoteSanitizedReconnectTicket(ticket: string): string;
+export declare function assertIrohRemoteTicketPayloadHostIdentity(payload: IrohRemoteTicketPayload, expectedHostNodeId: string): void;
+//# sourceMappingURL=ticket.d.ts.map

package/dist/core/remote/iroh/ticket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ticket.d.ts","sourceRoot":"","sources":["../../../../src/core/remote/iroh/ticket.ts"],"names":[],"mappings":"AAGA,OAAO,EACN,gBAAgB,EAGhB,KAAK,mBAAmB,EAGxB,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,uBAAuB;IACvC,IAAI,EAAE,OAAO,gBAAgB,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC,wFAAwF;IACxF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,yCAA0C,SAAQ,uBAAuB;IACzF,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,mBAAmB,CAAC;CAC/B;AAED,8EAA8E;AAC9E,MAAM,WAAW,oCAAoC;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,mBAAmB,CAAC;IAC/B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,MAAM,CAc1F;AAED,oFAAoF;AACpF,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,MAAM,GAAG,oCAAoC,CAsB5G;AA6GD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,uBAAuB,GAAG,MAAM,CAEtF;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,uBAAuB,CAarF;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CAoCpF;AAED,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,uBAAuB,EAAE,GAAG,SAAa,GAAG,IAAI,CAIzG;AAED,wBAAgB,+CAA+C,CAC9D,OAAO,EAAE,uBAAuB,GAC9B,yCAAyC,CAkB3C;AAED,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAI/E;AAED,wBAAgB,yCAAyC,CACxD,OAAO,EAAE,uBAAuB,EAChC,kBAAkB,EAAE,MAAM,GACxB,IAAI,CAaN","sourcesContent":["import { Buffer } from \"node:buffer\";\nimport { createHash } from \"node:crypto\";\nimport { isIP } from \"node:net\";\nimport {\n\tIROH_REMOTE_ALPN,\n\tIROH_REMOTE_TICKET_PREFIX,\n\tIrohRemoteOutcomeError,\n\ttype IrohRemoteRelayMode,\n\tisIrohRemoteRelayMode,\n\tisIrohRemoteRelayUrls,\n} from \"./protocol.ts\";\n\nexport interface IrohRemoteTicketPayload {\n\talpn: typeof IROH_REMOTE_ALPN;\n\texpiresAt?: number;\n\tirohTicket: string;\n\tnodeId?: string;\n\trelayMode?: IrohRemoteRelayMode;\n\t/** Relay server URLs the client should use; required when relayMode is \"production\". */\n\trelayUrls?: string[];\n\t/**\n\t * Bearer token for relays behind access.shared_token. Secret-like: carried\n\t * in pairing tickets (clients keychain it) and stripped from sanitized\n\t * reconnect tickets.\n\t */\n\trelayAuthToken?: string;\n\tsecret?: string;\n\tworkspace: string;\n}\n\nexport interface IrohRemoteSanitizedReconnectTicketPayload extends IrohRemoteTicketPayload {\n\tnodeId: string;\n\trelayMode: IrohRemoteRelayMode;\n}\n\n/** Non-secret values a user can compare before accepting a pairing ticket. */\nexport interface IrohRemotePairingVerificationDetails {\n\texpiresAt?: number;\n\thostFingerprint: string;\n\thostNodeId: string;\n\trelayMode: IrohRemoteRelayMode;\n\trelayOrigins: string[];\n\tworkspace: string;\n}\n\n/**\n * Match the iOS pairing confirmation fingerprint: the first 128 bits of the\n * SHA-256 digest, rendered as four uppercase 32-bit groups.\n */\nexport function formatIrohRemoteHostFingerprint(endpointIdBytes: ArrayLike<number>): string {\n\tif (endpointIdBytes.length !== 32) {\n\t\tthrow new Error(\"Iroh endpoint identity must be exactly 32 bytes\");\n\t}\n\tconst bytes = new Uint8Array(endpointIdBytes.length);\n\tfor (let index = 0; index < endpointIdBytes.length; index++) {\n\t\tconst value = endpointIdBytes[index];\n\t\tif (value === undefined || !Number.isInteger(value) || value < 0 || value > 0xff) {\n\t\t\tthrow new Error(\"Iroh endpoint identity contains an invalid byte\");\n\t\t}\n\t\tbytes[index] = value;\n\t}\n\tconst digest = createHash(\"sha256\").update(bytes).digest(\"hex\").slice(0, 32).toUpperCase();\n\treturn digest.match(/.{8}/g)!.join(\"-\");\n}\n\n/** Decode a ticket into only the values that are safe to display for comparison. */\nexport function getIrohRemotePairingVerificationDetails(ticket: string): IrohRemotePairingVerificationDetails {\n\tconst payload = decodeIrohRemoteTicketPayload(ticket);\n\tif (payload.nodeId === undefined) {\n\t\tthrow new Error(\"ticket nodeId is required for pairing verification\");\n\t}\n\tconst hostNodeId = payload.nodeId.trim().toLowerCase();\n\tif (!/^[0-9a-f]{64}$/.test(hostNodeId)) {\n\t\tthrow new Error(\"ticket nodeId must be a 32-byte hexadecimal Iroh endpoint identity\");\n\t}\n\tconst workspace = payload.workspace.trim();\n\tif (workspace.length === 0) {\n\t\tthrow new Error(\"ticket workspace is required for pairing verification\");\n\t}\n\tconst relayMode = payload.relayMode ?? \"disabled\";\n\treturn {\n\t\t...(payload.expiresAt === undefined ? {} : { expiresAt: payload.expiresAt }),\n\t\thostFingerprint: formatIrohRemoteHostFingerprint(Buffer.from(hostNodeId, \"hex\")),\n\t\thostNodeId,\n\t\trelayMode,\n\t\trelayOrigins: normalizePairingRelayOrigins(payload.relayUrls ?? [], relayMode),\n\t\tworkspace,\n\t};\n}\n\nfunction normalizePairingRelayOrigins(values: string[], relayMode: IrohRemoteRelayMode): string[] {\n\tconst nonEmptyValues = values.filter((value) => value.trim().length > 0);\n\tif (relayMode !== \"production\") {\n\t\tif (nonEmptyValues.length > 0) {\n\t\t\tthrow new Error(\"ticket relay URLs are only valid in production relay mode\");\n\t\t}\n\t\treturn [];\n\t}\n\tif (nonEmptyValues.length === 0) {\n\t\tthrow new Error(\"ticket production relay mode requires HTTPS relay origins\");\n\t}\n\treturn [...new Set(nonEmptyValues.map(normalizeHttpsRelayOrigin))].sort();\n}\n\nfunction normalizeHttpsRelayOrigin(value: string): string {\n\tlet url: URL;\n\ttry {\n\t\turl = new URL(value.trim());\n\t} catch {\n\t\tthrow new Error(\"ticket relay URL must be a valid HTTPS origin\");\n\t}\n\tif (\n\t\turl.protocol !== \"https:\" ||\n\t\turl.username.length > 0 ||\n\t\turl.password.length > 0 ||\n\t\turl.search.length > 0 ||\n\t\turl.hash.length > 0 ||\n\t\t(url.pathname !== \"\" && url.pathname !== \"/\")\n\t) {\n\t\tthrow new Error(\"ticket relay URL must be an HTTPS origin without credentials, path, query, or fragment\");\n\t}\n\n\tconst bracketed = url.hostname.startsWith(\"[\") && url.hostname.endsWith(\"]\");\n\tconst rawHostname = bracketed ? url.hostname.slice(1, -1) : url.hostname;\n\tconst hostname = rawHostname.toLowerCase().replace(/\\.+$/, \"\");\n\tif (hostname.length === 0 || isUnsafeLocalRelayHost(hostname)) {\n\t\tthrow new Error(\"ticket relay URL must not target a local or private host\");\n\t}\n\tconst formattedHostname = isIP(hostname) === 6 ? `[${hostname}]` : hostname;\n\treturn `https://${formattedHostname}${url.port.length === 0 || url.port === \"443\" ? \"\" : `:${url.port}`}`;\n}\n\nfunction isUnsafeLocalRelayHost(hostname: string): boolean {\n\tif (\n\t\thostname === \"localhost\" ||\n\t\thostname.endsWith(\".localhost\") ||\n\t\thostname === \"local\" ||\n\t\thostname.endsWith(\".local\") ||\n\t\thostname.includes(\"%\")\n\t) {\n\t\treturn true;\n\t}\n\tif (isIP(hostname) === 4) {\n\t\treturn isUnsafeIpv4(hostname.split(\".\").map(Number));\n\t}\n\tif (isIP(hostname) !== 6) {\n\t\treturn false;\n\t}\n\tconst bytes = parseIpv6Bytes(hostname);\n\tif (bytes === undefined) return true;\n\tconst unspecified = bytes.every((byte) => byte === 0);\n\tconst loopback = bytes.slice(0, 15).every((byte) => byte === 0) && bytes[15] === 1;\n\tconst linkLocal = bytes[0] === 0xfe && (bytes[1]! & 0xc0) === 0x80;\n\tconst uniqueLocal = (bytes[0]! & 0xfe) === 0xfc;\n\tconst multicast = bytes[0] === 0xff;\n\tif (unspecified || loopback || linkLocal || uniqueLocal || multicast) return true;\n\tconst ipv4Mapped = bytes.slice(0, 10).every((byte) => byte === 0) && bytes[10] === 0xff && bytes[11] === 0xff;\n\treturn ipv4Mapped && isUnsafeIpv4(bytes.slice(12));\n}\n\nfunction isUnsafeIpv4(bytes: number[]): boolean {\n\tif (bytes.length !== 4 || bytes.some((byte) => !Number.isInteger(byte) || byte < 0 || byte > 0xff)) return true;\n\treturn (\n\t\tbytes[0] === 0 ||\n\t\tbytes[0] === 10 ||\n\t\tbytes[0] === 127 ||\n\t\t(bytes[0] === 100 && bytes[1]! >= 64 && bytes[1]! <= 127) ||\n\t\t(bytes[0] === 169 && bytes[1] === 254) ||\n\t\t(bytes[0] === 172 && bytes[1]! >= 16 && bytes[1]! <= 31) ||\n\t\t(bytes[0] === 192 && bytes[1] === 168) ||\n\t\t(bytes[0] === 198 && (bytes[1] === 18 || bytes[1] === 19)) ||\n\t\tbytes[0]! >= 224\n\t);\n}\n\nfunction parseIpv6Bytes(address: string): number[] | undefined {\n\tconst halves = address.split(\"::\");\n\tif (halves.length > 2) return undefined;\n\tconst parseHalf = (value: string): number[] | undefined => {\n\t\tif (value.length === 0) return [];\n\t\tconst words: number[] = [];\n\t\tfor (const part of value.split(\":\")) {\n\t\t\tif (!/^[0-9a-f]{1,4}$/i.test(part)) return undefined;\n\t\t\twords.push(Number.parseInt(part, 16));\n\t\t}\n\t\treturn words;\n\t};\n\tconst head = parseHalf(halves[0]!);\n\tconst tail = parseHalf(halves[1] ?? \"\");\n\tif (head === undefined || tail === undefined) return undefined;\n\tconst omitted = 8 - head.length - tail.length;\n\tif ((halves.length === 1 && omitted !== 0) || (halves.length === 2 && omitted < 1)) return undefined;\n\tconst words = [...head, ...Array.from({ length: omitted }, () => 0), ...tail];\n\tif (words.length !== 8) return undefined;\n\treturn words.flatMap((word) => [word >> 8, word & 0xff]);\n}\n\nexport function encodeIrohRemoteTicketPayload(payload: IrohRemoteTicketPayload): string {\n\treturn `${IROH_REMOTE_TICKET_PREFIX}${Buffer.from(JSON.stringify(payload), \"utf8\").toString(\"base64url\")}`;\n}\n\nexport function decodeIrohRemoteTicketPayload(ticket: string): IrohRemoteTicketPayload {\n\tif (!ticket.startsWith(IROH_REMOTE_TICKET_PREFIX)) {\n\t\tthrow new Error(`Expected ticket prefix ${IROH_REMOTE_TICKET_PREFIX}`);\n\t}\n\n\tconst encoded = ticket.slice(IROH_REMOTE_TICKET_PREFIX.length);\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(Buffer.from(encoded, \"base64url\").toString(\"utf8\"));\n\t} catch (error: unknown) {\n\t\tthrow new Error(`Failed to decode Iroh remote ticket: ${error instanceof Error ? error.message : String(error)}`);\n\t}\n\treturn parseIrohRemoteTicketPayload(parsed);\n}\n\nexport function parseIrohRemoteTicketPayload(value: unknown): IrohRemoteTicketPayload {\n\tconst payload = expectRecord(value, \"Iroh remote ticket payload\");\n\tconst alpn = expectString(payload.alpn, \"ticket alpn\");\n\tif (alpn !== IROH_REMOTE_ALPN) {\n\t\tthrow new Error(`Unsupported ticket ALPN: ${alpn}`);\n\t}\n\n\tconst expiresAt = expectOptionalNumber(payload.expiresAt, \"ticket expiresAt\");\n\tconst irohTicket = expectString(payload.irohTicket, \"ticket irohTicket\");\n\tconst nodeId = expectOptionalString(payload.nodeId, \"ticket nodeId\");\n\tconst relayModeValue = payload.relayMode;\n\tif (relayModeValue !== undefined && !isIrohRemoteRelayMode(relayModeValue)) {\n\t\tthrow new Error(\"ticket relayMode must be disabled, development, or production\");\n\t}\n\tconst relayUrlsValue = payload.relayUrls;\n\tif (relayUrlsValue !== undefined && !isIrohRemoteRelayUrls(relayUrlsValue)) {\n\t\tthrow new Error(\"ticket relayUrls must be a non-empty array of relay URLs\");\n\t}\n\tif (relayModeValue === \"production\" && relayUrlsValue === undefined) {\n\t\tthrow new Error(\"ticket relayMode production requires relayUrls\");\n\t}\n\tconst relayAuthToken = expectOptionalString(payload.relayAuthToken, \"ticket relayAuthToken\");\n\tconst secret = expectOptionalString(payload.secret, \"ticket secret\");\n\tconst workspace = expectString(payload.workspace, \"ticket workspace\");\n\n\treturn {\n\t\talpn,\n\t\texpiresAt,\n\t\tirohTicket,\n\t\tnodeId,\n\t\trelayMode: relayModeValue,\n\t\trelayUrls: relayUrlsValue,\n\t\trelayAuthToken,\n\t\tsecret,\n\t\tworkspace,\n\t};\n}\n\nexport function assertIrohRemoteTicketNotExpired(payload: IrohRemoteTicketPayload, now = Date.now()): void {\n\tif (payload.expiresAt !== undefined && now > payload.expiresAt) {\n\t\tthrow new Error(\"Pairing ticket has expired\");\n\t}\n}\n\nexport function createIrohRemoteSanitizedReconnectTicketPayload(\n\tpayload: IrohRemoteTicketPayload,\n): IrohRemoteSanitizedReconnectTicketPayload {\n\tif (payload.nodeId === undefined) {\n\t\tthrow new IrohRemoteOutcomeError(\"saved_host_invalid\", \"ticket nodeId is required for saved-host reconnect\");\n\t}\n\tif (payload.relayMode === undefined) {\n\t\tthrow new IrohRemoteOutcomeError(\"saved_host_invalid\", \"ticket relayMode is required for saved-host reconnect\");\n\t}\n\tif (payload.relayMode === \"production\" && payload.relayUrls === undefined) {\n\t\tthrow new IrohRemoteOutcomeError(\"saved_host_invalid\", \"ticket relayUrls are required for production relayMode\");\n\t}\n\treturn {\n\t\talpn: payload.alpn,\n\t\tirohTicket: payload.irohTicket,\n\t\tnodeId: payload.nodeId,\n\t\trelayMode: payload.relayMode,\n\t\t...(payload.relayUrls === undefined ? {} : { relayUrls: payload.relayUrls }),\n\t\tworkspace: payload.workspace,\n\t};\n}\n\nexport function createIrohRemoteSanitizedReconnectTicket(ticket: string): string {\n\treturn encodeIrohRemoteTicketPayload(\n\t\tcreateIrohRemoteSanitizedReconnectTicketPayload(decodeIrohRemoteTicketPayload(ticket)),\n\t);\n}\n\nexport function assertIrohRemoteTicketPayloadHostIdentity(\n\tpayload: IrohRemoteTicketPayload,\n\texpectedHostNodeId: string,\n): void {\n\tif (payload.nodeId === undefined) {\n\t\tthrow new IrohRemoteOutcomeError(\n\t\t\t\"saved_host_invalid\",\n\t\t\t\"ticket nodeId is required for host identity verification\",\n\t\t);\n\t}\n\tif (payload.nodeId !== expectedHostNodeId) {\n\t\tthrow new IrohRemoteOutcomeError(\n\t\t\t\"host_identity_mismatch\",\n\t\t\t`expected ${expectedHostNodeId}, got ${payload.nodeId}`,\n\t\t);\n\t}\n}\n\nfunction expectRecord(value: unknown, label: string): Record<string, unknown> {\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n\t\tthrow new Error(`${label} must be an object`);\n\t}\n\treturn value as Record<string, unknown>;\n}\n\nfunction expectString(value: unknown, label: string): string {\n\tif (typeof value !== \"string\" || value.length === 0) {\n\t\tthrow new Error(`${label} must be a non-empty string`);\n\t}\n\treturn value;\n}\n\nfunction expectOptionalString(value: unknown, label: string): string | undefined {\n\tif (value === undefined) {\n\t\treturn undefined;\n\t}\n\treturn expectString(value, label);\n}\n\nfunction expectOptionalNumber(value: unknown, label: string): number | undefined {\n\tif (value === undefined) {\n\t\treturn undefined;\n\t}\n\tif (typeof value !== \"number\" || !Number.isFinite(value)) {\n\t\tthrow new Error(`${label} must be a finite number`);\n\t}\n\treturn value;\n}\n"]}