@hooklink/cli 0.1.69 → 0.1.70

package/dist/agent/local-server.js

@@ -0,0 +1,426 @@
+"use strict";
+/**
+ * The agent's localhost HTTP surface. Binds 127.0.0.1:7878 by default
+ * (override via HOOKLINK_AGENT_PORT). On port collision the server
+ * exits with an actionable error rather than silently falling back to
+ * a random port, because the WP plugin probes by fixed port and a
+ * random fallback would leave it unable to find us.
+ *
+ * Routes:
+ *   GET  /v1/health                 (no auth; used for discovery)
+ *   GET  /v1/status                 (local token)
+ *   POST /v1/tunnels                (local token)
+ *   DELETE /v1/tunnels              (local token)
+ *   DELETE /v1/tunnels/:id          (local token)
+ *   GET  /v1/tunnels/:id/recent     (local token)
+ *
+ * `Authorization: Bearer <local-token>` gates every non-health route.
+ * Identity for tunnel ownership comes from either
+ *   - `X-Hooklink-Api-Key` header (authenticated tunnels), or
+ *   - `X-Hooklink-Owner-Id` header (trial tunnels, plugin-generated ULID).
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalServer = void 0;
+const http_1 = __importDefault(require("http"));
+const url_1 = require("url");
+const lease_1 = require("./lease");
+const local_token_1 = require("./local-token");
+const preflight_1 = require("./preflight");
+const endpoint_resolver_1 = require("./endpoint-resolver");
+const state_1 = require("./state");
+const DEFAULT_PORT = 7878;
+class LocalServer {
+    constructor(opts) {
+        /** Track public_url per tunnel so authenticated-mode responses can
+         *  include it even before the subprocess emits tunnel_ready. */
+        this.publicUrlById = new Map();
+        const envPort = process.env.HOOKLINK_AGENT_PORT
+            ? Number(process.env.HOOKLINK_AGENT_PORT)
+            : NaN;
+        this.port = opts.port ?? (Number.isFinite(envPort) ? envPort : DEFAULT_PORT);
+        // Default to loopback-only. Docker-hosted WP (and similar
+        // cross-boundary setups) should set `HOOKLINK_AGENT_HOST=0.0.0.0`
+        // explicitly; the local bearer token keeps it safe.
+        this.host = opts.host ?? process.env.HOOKLINK_AGENT_HOST ?? '127.0.0.1';
+        this.supervisor = opts.supervisor;
+        this.lease = new lease_1.LeaseManager();
+        this.localToken = opts.localToken;
+        this.apiUrl = opts.apiUrl;
+        this.version = opts.version;
+        this.resolver = opts.resolver ?? endpoint_resolver_1.resolveEndpoint;
+        this.server = http_1.default.createServer((req, res) => {
+            this.handle(req, res).catch((err) => {
+                this.sendJson(res, 500, {
+                    error: 'internal_error',
+                    message: err?.message || 'Internal error',
+                });
+            });
+        });
+        // Periodically enforce expired leases.
+        const sweep = setInterval(() => this.sweepExpired(), 5000);
+        sweep.unref?.();
+    }
+    async listen() {
+        return new Promise((resolve, reject) => {
+            this.server.once('error', (err) => {
+                if (err.code === 'EADDRINUSE') {
+                    reject(new Error(`Port ${this.port} is already in use. Another agent may be running. ` +
+                        `Stop it with \`hooklink agent uninstall\` or set HOOKLINK_AGENT_PORT.`));
+                }
+                else {
+                    reject(err);
+                }
+            });
+            this.server.listen(this.port, this.host, () => {
+                const addr = this.server.address();
+                this.port = addr.port;
+                resolve(this.port);
+            });
+        });
+    }
+    async close() {
+        return new Promise((resolve) => this.server.close(() => resolve()));
+    }
+    async handle(req, res) {
+        const url = new url_1.URL(req.url ?? '/', `http://${req.headers.host || '127.0.0.1'}`);
+        // Health is the discovery probe; never auth-gated, never cached.
+        if (url.pathname === '/v1/health' && req.method === 'GET') {
+            this.sendJson(res, 200, {
+                ok: true,
+                version: this.version,
+                active_tunnel_count: this.supervisor.listTunnels().length,
+            });
+            return;
+        }
+        if (!this.authorize(req, res))
+            return;
+        if (url.pathname === '/v1/status' && req.method === 'GET') {
+            return this.handleStatus(req, res);
+        }
+        if (url.pathname === '/v1/tunnels' && req.method === 'POST') {
+            return this.handleCreateTunnel(req, res);
+        }
+        if (url.pathname === '/v1/tunnels' && req.method === 'DELETE') {
+            return this.handleDeleteAll(req, res);
+        }
+        const tunnelMatch = url.pathname.match(/^\/v1\/tunnels\/([^/]+)$/);
+        if (tunnelMatch && req.method === 'DELETE') {
+            return this.handleDeleteOne(req, res, tunnelMatch[1]);
+        }
+        const recentMatch = url.pathname.match(/^\/v1\/tunnels\/([^/]+)\/recent$/);
+        if (recentMatch && req.method === 'GET') {
+            return this.handleRecent(req, res, recentMatch[1], url);
+        }
+        this.sendJson(res, 404, { error: 'not_found' });
+    }
+    authorize(req, res) {
+        const header = req.headers.authorization || '';
+        const [scheme, token] = header.split(' ');
+        if (scheme !== 'Bearer' || !token) {
+            this.sendJson(res, 401, { error: 'unauthorized' });
+            return false;
+        }
+        if (!(0, local_token_1.tokenMatches)(token, this.localToken)) {
+            this.sendJson(res, 401, { error: 'unauthorized' });
+            return false;
+        }
+        return true;
+    }
+    ownerKey(req) {
+        const apiKey = readHeader(req, 'x-hooklink-api-key');
+        const ownerId = readHeader(req, 'x-hooklink-owner-id');
+        return {
+            api_key: apiKey,
+            api_key_hash: apiKey ? (0, state_1.hashApiKey)(apiKey) : null,
+            owner_id: ownerId,
+        };
+    }
+    isOwner(info, owner) {
+        if (info.api_key_hash)
+            return info.api_key_hash === owner.api_key_hash;
+        if (info.owner_id)
+            return info.owner_id === owner.owner_id;
+        return false;
+    }
+    handleStatus(req, res) {
+        const owner = this.ownerKey(req);
+        const all = this.supervisor.listTunnels((info) => this.isOwner(info, owner));
+        // Refresh leases on every status poll — this is how callers
+        // implicitly release tunnels by stopping polling.
+        for (const t of all)
+            this.lease.refresh(t.tunnel_id);
+        this.sendJson(res, 200, {
+            running: true,
+            version: this.version,
+            active_tunnels: all.map((t) => this.publicTunnel(t)),
+        });
+    }
+    async handleCreateTunnel(req, res) {
+        const body = await readJsonBody(req);
+        const localTarget = typeof body.local_target === 'string' ? body.local_target.trim() : '';
+        if (!localTarget) {
+            this.sendJson(res, 400, {
+                error: 'invalid_request',
+                message: '`local_target` is required.',
+            });
+            return;
+        }
+        const owner = this.ownerKey(req);
+        const authenticated = owner.api_key !== null;
+        if (!authenticated && !owner.owner_id) {
+            this.sendJson(res, 400, {
+                error: 'invalid_request',
+                message: 'Trial mode requires an X-Hooklink-Owner-Id header (a stable id the plugin generates).',
+            });
+            return;
+        }
+        // Idempotency: same (owner, local_target) returns the existing tunnel.
+        const existing = this.findExistingTunnel(localTarget, owner);
+        if (existing) {
+            this.lease.refresh(existing.tunnel_id);
+            this.sendJson(res, 200, this.publicTunnel(existing));
+            return;
+        }
+        const flight = await (0, preflight_1.preflight)(localTarget, { timeoutMs: 2000 });
+        if (!flight.ok) {
+            const statusCode = flight.code === 'invalid_url' ? 400 : 422;
+            this.sendJson(res, statusCode, {
+                error: flight.code,
+                message: flight.detail || 'Local target is unreachable.',
+                attempted_target: localTarget,
+            });
+            return;
+        }
+        try {
+            if (authenticated) {
+                const resolved = await this.resolver({
+                    apiKey: owner.api_key,
+                    apiUrl: this.apiUrl,
+                    localTarget,
+                });
+                const publicUrl = this.publicUrlFor(resolved);
+                this.publicUrlById.set(resolved.id, publicUrl);
+                const info = await this.supervisor.startTunnel({
+                    mode: 'authenticated',
+                    tunnel_id: resolved.id,
+                    keyword: resolved.keyword,
+                    api_key: owner.api_key,
+                    api_key_hash: owner.api_key_hash,
+                    local_target: localTarget,
+                    public_url: publicUrl,
+                });
+                this.lease.refresh(info.tunnel_id);
+                this.sendJson(res, 200, this.publicTunnel(info));
+            }
+            else {
+                const info = await this.supervisor.startTunnel({
+                    mode: 'trial',
+                    owner_id: owner.owner_id,
+                    local_target: localTarget,
+                });
+                this.lease.refresh(info.tunnel_id);
+                this.sendJson(res, 200, this.publicTunnel(info));
+            }
+        }
+        catch (err) {
+            this.sendSpawnError(res, err);
+        }
+    }
+    sendSpawnError(res, err) {
+        if (err instanceof endpoint_resolver_1.ResolveError) {
+            const statusMap = {
+                hooklink_auth_failed: 401,
+                quota_exceeded: 403,
+                keyword_collision: 409,
+                target_port_rejected: 422,
+                hooklink_unreachable: 502,
+                invalid_request: 400,
+            };
+            this.sendJson(res, statusMap[err.code] ?? 500, {
+                error: err.code,
+                message: err.message,
+                ...err.extra,
+            });
+            return;
+        }
+        const e = err;
+        if (e?.code === 'too_many_local_tunnels') {
+            this.sendJson(res, 503, {
+                error: 'too_many_local_tunnels',
+                message: 'Agent is at its 20-tunnel cap.',
+            });
+            return;
+        }
+        if (e?.code === 'spawn_timeout') {
+            this.sendJson(res, 504, {
+                error: 'spawn_timeout',
+                message: e.message || 'Subprocess did not emit tunnel_ready in time.',
+            });
+            return;
+        }
+        if (e?.code === 'trial_daily_limit') {
+            this.sendJson(res, 429, {
+                error: 'trial_daily_limit',
+                message: e.message,
+            });
+            return;
+        }
+        this.sendJson(res, 500, {
+            error: 'internal_error',
+            message: e?.message || 'Failed to start tunnel',
+        });
+    }
+    async handleDeleteOne(req, res, tunnelId) {
+        const owner = this.ownerKey(req);
+        const info = this.supervisor.getTunnel(tunnelId);
+        if (!info) {
+            this.sendJson(res, 404, { error: 'tunnel_not_found' });
+            return;
+        }
+        if (!this.isOwner(info, owner)) {
+            this.sendJson(res, 403, { error: 'not_owner' });
+            return;
+        }
+        await this.supervisor.stopTunnel(tunnelId);
+        this.lease.release(tunnelId);
+        this.publicUrlById.delete(tunnelId);
+        this.sendJson(res, 200, {
+            tunnel_id: tunnelId,
+            stopped_at: new Date().toISOString(),
+        });
+    }
+    async handleDeleteAll(req, res) {
+        const owner = this.ownerKey(req);
+        const ids = this.supervisor
+            .listTunnels((info) => this.isOwner(info, owner))
+            .map((t) => t.tunnel_id);
+        for (const id of ids) {
+            await this.supervisor.stopTunnel(id);
+            this.lease.release(id);
+            this.publicUrlById.delete(id);
+        }
+        this.sendJson(res, 200, { stopped: ids });
+    }
+    handleRecent(req, res, tunnelId, url) {
+        const owner = this.ownerKey(req);
+        const info = this.supervisor.getTunnel(tunnelId);
+        if (!info) {
+            this.sendJson(res, 404, { error: 'tunnel_not_found' });
+            return;
+        }
+        if (!this.isOwner(info, owner)) {
+            this.sendJson(res, 403, { error: 'not_owner' });
+            return;
+        }
+        const limit = Math.min(100, Math.max(1, parseInt(url.searchParams.get('limit') ?? '20', 10)));
+        const requests = this.supervisor.getRecentRequests(tunnelId, limit);
+        this.sendJson(res, 200, { tunnel_id: tunnelId, requests });
+    }
+    findExistingTunnel(localTarget, owner) {
+        const matches = this.supervisor.listTunnels((info) => this.isOwner(info, owner) && info.local_target === localTarget);
+        return matches[0] ?? null;
+    }
+    sweepExpired() {
+        for (const id of this.lease.getExpired()) {
+            const info = this.supervisor.getTunnel(id);
+            if (info) {
+                this.supervisor.stopTunnel(id).catch(() => { });
+            }
+            this.lease.release(id);
+            this.publicUrlById.delete(id);
+        }
+    }
+    publicUrlFor(resolved) {
+        const host = new url_1.URL(this.apiUrl).hostname;
+        const webhookDomain = host.replace(/^(staging-)?api\./, (_, prefix) => prefix ? 'staging.' : '');
+        // We don't ship the username in the resolver response; fall back
+        // to the keyword as public host fragment. The subprocess's
+        // `tunnel_ready` event overrides this with the authoritative URL.
+        return `https://${resolved.keyword}.${webhookDomain}`;
+    }
+    publicTunnel(t) {
+        const out = {
+            tunnel_id: t.tunnel_id,
+            public_url: t.public_url,
+            local_target: t.local_target,
+            pid: t.pid,
+            started_at: t.started_at,
+            state: t.state,
+            trial: t.trial,
+        };
+        if (t.trial) {
+            if (t.expires_at)
+                out.expires_at = t.expires_at;
+            if (t.limits)
+                out.limits = t.limits;
+            if (t.usage) {
+                out.usage = { requests: t.usage.requests, bytes: t.usage.bytes };
+                out.remaining_seconds = t.usage.remaining_seconds;
+                if (t.limits) {
+                    out.remaining_requests = Math.max(0, t.limits.max_requests - t.usage.requests);
+                    out.remaining_bandwidth_bytes = Math.max(0, t.limits.max_bandwidth_bytes - t.usage.bytes);
+                }
+            }
+        }
+        if (t.last_error) {
+            out.last_error = t.last_error;
+        }
+        return out;
+    }
+    sendJson(res, status, body) {
+        const payload = Buffer.from(JSON.stringify(body));
+        res.writeHead(status, {
+            'content-type': 'application/json',
+            'content-length': payload.length,
+            'cache-control': 'no-store',
+        });
+        res.end(payload);
+    }
+    /** Test-only hooks. */
+    getLeaseManager() {
+        return this.lease;
+    }
+    getPort() {
+        return this.port;
+    }
+}
+exports.LocalServer = LocalServer;
+function readHeader(req, name) {
+    const v = req.headers[name];
+    if (typeof v === 'string' && v.trim().length > 0)
+        return v.trim();
+    if (Array.isArray(v) && v.length > 0)
+        return v[0];
+    return null;
+}
+async function readJsonBody(req) {
+    return new Promise((resolve, reject) => {
+        let raw = '';
+        let total = 0;
+        req.on('data', (chunk) => {
+            total += chunk.length;
+            if (total > 64 * 1024) {
+                reject(new Error('payload_too_large'));
+                req.destroy();
+                return;
+            }
+            raw += chunk.toString('utf8');
+        });
+        req.on('end', () => {
+            if (!raw)
+                return resolve({});
+            try {
+                const parsed = JSON.parse(raw);
+                resolve(typeof parsed === 'object' && parsed !== null ? parsed : {});
+            }
+            catch {
+                reject(new Error('invalid_json'));
+            }
+        });
+        req.on('error', reject);
+    });
+}
+//# sourceMappingURL=local-server.js.map

package/dist/agent/local-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-server.js","sourceRoot":"","sources":["../../src/agent/local-server.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;;;;AAEH,gDAA6D;AAE7D,6BAA0B;AAE1B,mCAAuC;AACvC,+CAA6C;AAC7C,2CAAwC;AACxC,2DAI6B;AAC7B,mCAAqC;AAarC,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B,MAAa,WAAW;IActB,YAAY,IAAwB;QAJpC;wEACgE;QACxD,kBAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;QAGhD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB;YAC7C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACzC,CAAC,CAAC,GAAG,CAAC;QACR,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAC7E,0DAA0D;QAC1D,kEAAkE;QAClE,oDAAoD;QACpD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,WAAW,CAAC;QACxE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAY,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,mCAAe,CAAC;QACjD,IAAI,CAAC,MAAM,GAAG,cAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACtB,KAAK,EAAE,gBAAgB;oBACvB,OAAO,EAAE,GAAG,EAAE,OAAO,IAAI,gBAAgB;iBAC1C,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,uCAAuC;QACvC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,IAAK,CAAC,CAAC;QAC5D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,MAAM;QACV,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;gBACvD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC9B,MAAM,CACJ,IAAI,KAAK,CACP,QAAQ,IAAI,CAAC,IAAI,oDAAoD;wBACnE,uEAAuE,CAC1E,CACF,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;gBAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAiB,CAAC;gBAClD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,GAAmB;QAC5D,MAAM,GAAG,GAAG,IAAI,SAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;QAEjF,iEAAiE;QACjE,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC1D,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACtB,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,mBAAmB,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,MAAM;aAC1D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO;QAEtC,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9D,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACnE,IAAI,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC3E,IAAI,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAClD,CAAC;IAEO,SAAS,CAAC,GAAoB,EAAE,GAAmB;QACzD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,IAAA,0BAAY,EAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,QAAQ,CAAC,GAAoB;QAKnC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QACvD,OAAO;YACL,OAAO,EAAE,MAAM;YACf,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,IAAA,kBAAU,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;YAChD,QAAQ,EAAE,OAAO;SAClB,CAAC;IACJ,CAAC;IAEO,OAAO,CAAC,IAAgB,EAAE,KAA0C;QAC1E,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CAAC;QACvE,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,YAAY,CAAC,GAAoB,EAAE,GAAmB;QAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC7E,4DAA4D;QAC5D,kDAAkD;QAClD,KAAK,MAAM,CAAC,IAAI,GAAG;YAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACtB,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,cAAc,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;SACrD,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,GAAoB,EACpB,GAAmB;QAEnB,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACtB,KAAK,EAAE,iBAAiB;gBACxB,OAAO,EAAE,6BAA6B;aACvC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;QAE7C,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACtB,KAAK,EAAE,iBAAiB;gBACxB,OAAO,EACL,uFAAuF;aAC1F,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,uEAAuE;QACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC7D,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAS,EAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAK,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC7D,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE;gBAC7B,KAAK,EAAE,MAAM,CAAC,IAAI;gBAClB,OAAO,EAAE,MAAM,CAAC,MAAM,IAAI,8BAA8B;gBACxD,gBAAgB,EAAE,WAAW;aAC9B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;oBACnC,MAAM,EAAE,KAAK,CAAC,OAAQ;oBACtB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,WAAW;iBACZ,CAAC,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;gBAC9C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;gBAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;oBAC7C,IAAI,EAAE,eAAe;oBACrB,SAAS,EAAE,QAAQ,CAAC,EAAE;oBACtB,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,OAAO,EAAE,KAAK,CAAC,OAAQ;oBACvB,YAAY,EAAE,KAAK,CAAC,YAAa;oBACjC,YAAY,EAAE,WAAW;oBACzB,UAAU,EAAE,SAAS;iBACtB,CAAC,CAAC;gBACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;oBAC7C,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,KAAK,CAAC,QAAS;oBACzB,YAAY,EAAE,WAAW;iBAC1B,CAAC,CAAC;gBACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,GAAmB,EAAE,GAAY;QACtD,IAAI,GAAG,YAAY,gCAAY,EAAE,CAAC;YAChC,MAAM,SAAS,GAAyC;gBACtD,oBAAoB,EAAE,GAAG;gBACzB,cAAc,EAAE,GAAG;gBACnB,iBAAiB,EAAE,GAAG;gBACtB,oBAAoB,EAAE,GAAG;gBACzB,oBAAoB,EAAE,GAAG;gBACzB,eAAe,EAAE,GAAG;aACrB,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE;gBAC7C,KAAK,EAAE,GAAG,CAAC,IAAI;gBACf,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,GAAG,GAAG,CAAC,KAAK;aACb,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,GAAgC,CAAC;QAC3C,IAAI,CAAC,EAAE,IAAI,KAAK,wBAAwB,EAAE,CAAC;YACzC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACtB,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,gCAAgC;aAC1C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,EAAE,IAAI,KAAK,eAAe,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACtB,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,+CAA+C;aACtE,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,EAAE,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACtB,KAAK,EAAE,mBAAmB;gBAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;aACnB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACtB,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,CAAC,EAAE,OAAO,IAAI,wBAAwB;SAChD,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,GAAoB,EACpB,GAAmB,EACnB,QAAgB;QAEhB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACtB,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,GAAoB,EACpB,GAAmB;QAEnB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU;aACxB,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;aAChD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACvB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEO,YAAY,CAClB,GAAoB,EACpB,GAAmB,EACnB,QAAgB,EAChB,GAAQ;QAER,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,GAAG,EACH,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CACjE,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7D,CAAC;IAEO,kBAAkB,CACxB,WAAmB,EACnB,KAA0C;QAE1C,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CACzC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,KAAK,WAAW,CACzE,CAAC;QACF,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5B,CAAC;IAEO,YAAY;QAClB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC3C,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACvB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,QAA0B;QAC7C,MAAM,IAAI,GAAG,IAAI,SAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CACpE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CACzB,CAAC;QACF,iEAAiE;QACjE,2DAA2D;QAC3D,kEAAkE;QAClE,OAAO,WAAW,QAAQ,CAAC,OAAO,IAAI,aAAa,EAAE,CAAC;IACxD,CAAC;IAEO,YAAY,CAAC,CAAa;QAChC,MAAM,GAAG,GAA4B;YACnC,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC;QACF,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACZ,IAAI,CAAC,CAAC,UAAU;gBAAE,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;YAChD,IAAI,CAAC,CAAC,MAAM;gBAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;YACpC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACZ,GAAG,CAAC,KAAK,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACjE,GAAG,CAAC,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;gBAClD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;oBACb,GAAG,CAAC,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAC/B,CAAC,EACD,CAAC,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CACzC,CAAC;oBACF,GAAG,CAAC,yBAAyB,GAAG,IAAI,CAAC,GAAG,CACtC,CAAC,EACD,CAAC,CAAC,MAAM,CAAC,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAC7C,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YACjB,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;QAChC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;QACjE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;YACpB,cAAc,EAAE,kBAAkB;YAClC,gBAAgB,EAAE,OAAO,CAAC,MAAM;YAChC,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;IAED,uBAAuB;IACvB,eAAe;QACb,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;CACF;AAvaD,kCAuaC;AAED,SAAS,UAAU,CAAC,GAAoB,EAAE,IAAY;IACpD,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC9C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;gBACvC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC,GAAG;gBAAE,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,OAAO,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;YACpC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/agent/local-token.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Local auth token. Generated on first agent startup, stored at
+ * `~/.hooklink/local-token` with 0600 perms. Every authenticated
+ * request to the agent's localhost HTTP surface carries the token
+ * in `Authorization: Bearer <token>`.
+ *
+ * The token is the agent's only guard against other users on the
+ * same machine poking at `127.0.0.1:7878`. It is NOT a secret that
+ * leaves the machine.
+ */
+export declare function ensureLocalToken(): string;
+export declare function readLocalToken(): string | null;
+/**
+ * Constant-time comparison. Prevents timing side channels even
+ * though the attack surface here is tiny.
+ */
+export declare function tokenMatches(candidate: string, expected: string): boolean;
+//# sourceMappingURL=local-token.d.ts.map

package/dist/agent/local-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-token.d.ts","sourceRoot":"","sources":["../../src/agent/local-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,wBAAgB,gBAAgB,IAAI,MAAM,CAkBzC;AAED,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAO9C;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKzE"}

package/dist/agent/local-token.js

@@ -0,0 +1,65 @@
+"use strict";
+/**
+ * Local auth token. Generated on first agent startup, stored at
+ * `~/.hooklink/local-token` with 0600 perms. Every authenticated
+ * request to the agent's localhost HTTP surface carries the token
+ * in `Authorization: Bearer <token>`.
+ *
+ * The token is the agent's only guard against other users on the
+ * same machine poking at `127.0.0.1:7878`. It is NOT a secret that
+ * leaves the machine.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureLocalToken = ensureLocalToken;
+exports.readLocalToken = readLocalToken;
+exports.tokenMatches = tokenMatches;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const paths_1 = require("./paths");
+function ensureLocalToken() {
+    const tokenPath = (0, paths_1.getLocalTokenPath)();
+    try {
+        const existing = fs_1.default.readFileSync(tokenPath, 'utf8').trim();
+        if (existing && existing.length >= 32)
+            return existing;
+    }
+    catch {
+        // File doesn't exist yet, fall through to generation.
+    }
+    const token = crypto_1.default.randomBytes(32).toString('hex');
+    fs_1.default.mkdirSync(path_1.default.dirname(tokenPath), { recursive: true, mode: 0o700 });
+    fs_1.default.writeFileSync(tokenPath, token, { mode: 0o600 });
+    // Ensure the directory itself isn't world-readable.
+    try {
+        fs_1.default.chmodSync((0, paths_1.getAgentHome)(), 0o700);
+    }
+    catch {
+        // Windows or a filesystem that doesn't honor chmod. Best-effort.
+    }
+    return token;
+}
+function readLocalToken() {
+    try {
+        const raw = fs_1.default.readFileSync((0, paths_1.getLocalTokenPath)(), 'utf8').trim();
+        return raw.length >= 32 ? raw : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Constant-time comparison. Prevents timing side channels even
+ * though the attack surface here is tiny.
+ */
+function tokenMatches(candidate, expected) {
+    const a = Buffer.from(candidate);
+    const b = Buffer.from(expected);
+    if (a.length !== b.length)
+        return false;
+    return crypto_1.default.timingSafeEqual(a, b);
+}
+//# sourceMappingURL=local-token.js.map

package/dist/agent/local-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-token.js","sourceRoot":"","sources":["../../src/agent/local-token.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;AAOH,4CAkBC;AAED,wCAOC;AAMD,oCAKC;AA3CD,oDAA4B;AAC5B,4CAAoB;AACpB,gDAAwB;AACxB,mCAA0D;AAE1D,SAAgB,gBAAgB;IAC9B,MAAM,SAAS,GAAG,IAAA,yBAAiB,GAAE,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE;YAAE,OAAO,QAAQ,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IACD,MAAM,KAAK,GAAG,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,YAAE,CAAC,SAAS,CAAC,cAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,YAAE,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,oDAAoD;IACpD,IAAI,CAAC;QACH,YAAE,CAAC,SAAS,CAAC,IAAA,oBAAY,GAAE,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,cAAc;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAE,CAAC,YAAY,CAAC,IAAA,yBAAiB,GAAE,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAChE,OAAO,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,YAAY,CAAC,SAAiB,EAAE,QAAgB;IAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,gBAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtC,CAAC"}

package/dist/agent/paths.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Central resolver for every on-disk path the agent owns. Keeping
+ * these in one place simplifies install, uninstall, and tests
+ * (which override `HOOKLINK_HOME` to a tmpdir).
+ */
+export declare function getAgentHome(): string;
+export declare function getLocalTokenPath(): string;
+export declare function getStatePath(): string;
+export declare function getAgentLogPath(): string;
+export declare function getTunnelsDir(): string;
+export declare function getTunnelLogPath(tunnelId: string): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/agent/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/agent/paths.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzD"}

package/dist/agent/paths.js

@@ -0,0 +1,37 @@
+"use strict";
+/**
+ * Central resolver for every on-disk path the agent owns. Keeping
+ * these in one place simplifies install, uninstall, and tests
+ * (which override `HOOKLINK_HOME` to a tmpdir).
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAgentHome = getAgentHome;
+exports.getLocalTokenPath = getLocalTokenPath;
+exports.getStatePath = getStatePath;
+exports.getAgentLogPath = getAgentLogPath;
+exports.getTunnelsDir = getTunnelsDir;
+exports.getTunnelLogPath = getTunnelLogPath;
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+function getAgentHome() {
+    return process.env.HOOKLINK_HOME || path_1.default.join(os_1.default.homedir(), '.hooklink');
+}
+function getLocalTokenPath() {
+    return path_1.default.join(getAgentHome(), 'local-token');
+}
+function getStatePath() {
+    return path_1.default.join(getAgentHome(), 'agent.state');
+}
+function getAgentLogPath() {
+    return path_1.default.join(getAgentHome(), 'agent.log');
+}
+function getTunnelsDir() {
+    return path_1.default.join(getAgentHome(), 'tunnels');
+}
+function getTunnelLogPath(tunnelId) {
+    return path_1.default.join(getTunnelsDir(), `${tunnelId}.log`);
+}
+//# sourceMappingURL=paths.js.map

package/dist/agent/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/agent/paths.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;AAKH,oCAEC;AAED,8CAEC;AAED,oCAEC;AAED,0CAEC;AAED,sCAEC;AAED,4CAEC;AAzBD,4CAAoB;AACpB,gDAAwB;AAExB,SAAgB,YAAY;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,cAAI,CAAC,IAAI,CAAC,YAAE,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AAC3E,CAAC;AAED,SAAgB,iBAAiB;IAC/B,OAAO,cAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED,SAAgB,YAAY;IAC1B,OAAO,cAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED,SAAgB,eAAe;IAC7B,OAAO,cAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,SAAgB,aAAa;IAC3B,OAAO,cAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED,SAAgB,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,cAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,QAAQ,MAAM,CAAC,CAAC;AACvD,CAAC"}

package/dist/agent/preflight.d.ts

@@ -0,0 +1,18 @@
+/**
+ * HEAD/GET reachability check for a prospective tunnel target.
+ *
+ * Accepts any HTTP status (including 4xx/5xx) as proof the target
+ * is alive. A WP login page returning 302 or 401 still counts as
+ * reachable. ECONNREFUSED / DNS / timeout all produce
+ * `target_unreachable`.
+ */
+export interface PreflightResult {
+    ok: boolean;
+    code?: 'target_unreachable' | 'invalid_url';
+    detail?: string;
+}
+export interface PreflightOptions {
+    timeoutMs?: number;
+}
+export declare function preflight(target: string, options?: PreflightOptions): Promise<PreflightResult>;
+//# sourceMappingURL=preflight.d.ts.map

package/dist/agent/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../src/agent/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,oBAAoB,GAAG,aAAa,CAAC;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,eAAe,CAAC,CA6B1B"}