@linkshell/gateway 0.5.3 → 0.6.0

package/dist/gateway/src/embedded.js

@@ -1,438 +0,0 @@
-import { createServer } from "node:http";
-import { randomUUID } from "node:crypto";
-import { WebSocketServer } from "ws";
-import { createEnvelope, serializeEnvelope, PROTOCOL_VERSION, } from "@linkshell/protocol";
-import { z, ZodError } from "zod";
-import { SessionManager } from "./sessions.js";
-import { PairingManager } from "./pairings.js";
-import { TokenManager } from "./tokens.js";
-import { handleSocketMessage, replayAgentToSocket } from "./relay.js";
-import { PresenceHub, startPresenceWatcher } from "./presence.js";
-import { parseTunnelPath, parseTunnelCookie, shouldUseTunnelCookieFallback, handleTunnelRequest, handleTunnelWsUpgrade, } from "./tunnel.js";
-import { serveWeb, serveWebAsset, webEnabled, webDistPath } from "./static-web.js";
-const PING_INTERVAL = 20_000;
-const MAX_BODY_SIZE = 4096;
-const MAX_WS_MESSAGE_SIZE = 50 * 1024 * 1024; // 50MB (supports base64 image uploads)
-const LOG_LEVELS = { debug: 0, info: 1, warn: 2, error: 3 };
-const createPairingBody = z.object({ sessionId: z.string().optional() });
-const claimPairingBody = z.object({
-    pairingCode: z.string().length(6),
-    deviceToken: z.string().min(1).optional(),
-});
-class BodyTooLargeError extends Error {
-}
-function json(res, status, body) {
-    res.writeHead(status, {
-        "content-type": "application/json",
-        "access-control-allow-origin": "*",
-        "access-control-allow-methods": "GET, POST, OPTIONS",
-        "access-control-allow-headers": "Content-Type, Authorization",
-    });
-    res.end(JSON.stringify(body));
-}
-async function readJson(req) {
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of req) {
-        const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        size += buf.length;
-        if (size > MAX_BODY_SIZE)
-            throw new BodyTooLargeError();
-        chunks.push(buf);
-    }
-    if (chunks.length === 0)
-        return {};
-    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
-}
-function getClientIp(req) {
-    const forwarded = req.headers["x-forwarded-for"];
-    if (typeof forwarded === "string")
-        return forwarded.split(",")[0].trim();
-    return req.socket.remoteAddress ?? "unknown";
-}
-function extractBearerToken(req) {
-    const auth = req.headers.authorization;
-    if (!auth)
-        return null;
-    const match = auth.match(/^Bearer\s+(.+)$/i);
-    return match?.[1] ?? null;
-}
-/**
- * Start an embedded gateway. Returns a handle to get URLs and close it.
- * Used by CLI when no external --gateway is provided.
- */
-export async function startEmbeddedGateway(options = {}) {
-    const targetPort = options.port ?? 0; // 0 = random available port
-    const logLevel = options.logLevel ?? "warn";
-    const silent = options.silent ?? false;
-    function log(level, msg) {
-        if (silent)
-            return;
-        if (LOG_LEVELS[level] >= LOG_LEVELS[logLevel]) {
-            process.stderr.write(`[gateway:${level}] ${msg}\n`);
-        }
-    }
-    const sessionManager = new SessionManager();
-    const pairingManager = new PairingManager();
-    const tokenManager = new TokenManager();
-    const presenceHub = new PresenceHub();
-    sessionManager.onPresenceChange = (session) => presenceHub.notify(session);
-    const server = createServer(async (req, res) => {
-        if (req.method === "OPTIONS") {
-            res.writeHead(204, {
-                "access-control-allow-origin": "*",
-                "access-control-allow-methods": "GET, POST, OPTIONS",
-                "access-control-allow-headers": "Content-Type, Authorization",
-                "access-control-max-age": "86400",
-            });
-            res.end();
-            return;
-        }
-        try {
-            const url = new URL(req.url ?? "/", `http://${req.headers.host}`);
-            const method = req.method ?? "GET";
-            if (method === "GET" && url.pathname === "/healthz") {
-                json(res, 200, { ok: true });
-                return;
-            }
-            if (method === "POST" && url.pathname === "/pairings") {
-                const body = createPairingBody.parse(await readJson(req));
-                const record = pairingManager.create(body.sessionId);
-                json(res, 201, {
-                    sessionId: record.sessionId,
-                    pairingCode: record.pairingCode,
-                    expiresAt: new Date(record.expiresAt).toISOString(),
-                });
-                return;
-            }
-            if (method === "POST" && url.pathname === "/pairings/claim") {
-                const body = claimPairingBody.parse(await readJson(req));
-                const result = pairingManager.claim(body.pairingCode);
-                if ("error" in result) {
-                    json(res, result.status, { error: result.error });
-                    return;
-                }
-                const token = tokenManager.register(body.deviceToken);
-                tokenManager.bind(token, result.sessionId);
-                json(res, 200, { sessionId: result.sessionId, deviceToken: token });
-                return;
-            }
-            if (method === "GET" && url.pathname === "/sessions") {
-                const token = extractBearerToken(req);
-                if (!token || !tokenManager.validate(token)) {
-                    json(res, 401, {
-                        error: "unauthorized",
-                        message: "Valid device token required",
-                    });
-                    return;
-                }
-                const allowedIds = tokenManager.getSessionIds(token);
-                const sessions = sessionManager
-                    .listActive()
-                    .filter((s) => allowedIds.has(s.id))
-                    .map((s) => sessionManager.getSummary(s.id))
-                    .filter(Boolean);
-                json(res, 200, { sessions });
-                return;
-            }
-            const sessionMatch = url.pathname.match(/^\/sessions\/([^/]+)$/);
-            if (method === "GET" && sessionMatch) {
-                const token = extractBearerToken(req);
-                const targetId = sessionMatch[1];
-                if (!token || !tokenManager.owns(token, targetId)) {
-                    json(res, 401, {
-                        error: "unauthorized",
-                        message: "Valid device token required",
-                    });
-                    return;
-                }
-                const summary = sessionManager.getSummary(targetId);
-                if (!summary) {
-                    json(res, 404, { error: "session_not_found" });
-                    return;
-                }
-                json(res, 200, summary);
-                return;
-            }
-            const pairingMatch = url.pathname.match(/^\/pairings\/(\d{6})\/status$/);
-            if (method === "GET" && pairingMatch) {
-                const result = pairingManager.getStatus(pairingMatch[1]);
-                if ("error" in result) {
-                    json(res, result.httpStatus, { error: result.error });
-                    return;
-                }
-                json(res, 200, result);
-                return;
-            }
-            // Tunnel HTTP proxy (explicit path)
-            const tunnelParsed = parseTunnelPath(url.pathname);
-            if (tunnelParsed) {
-                await handleTunnelRequest(req, res, sessionManager, tokenManager, tunnelParsed, url);
-                return;
-            }
-            // Serve the gateway's OWN built web assets (no SPA fallback) before the
-            // tunnel cookie fallback, so a real asset like /assets/index-xxx.js is
-            // served locally instead of being proxied via a stale tunnel cookie.
-            if (await serveWebAsset(req, res))
-                return;
-            // Tunnel fallback: cookie-based routing for sub-resources (e.g. /_next/static/...)
-            const tunnelCookie = parseTunnelCookie(req);
-            if (tunnelCookie && shouldUseTunnelCookieFallback(req, url.pathname, (pathname) => pathname === "/healthz" ||
-                pathname === "/sessions" ||
-                pathname.startsWith("/sessions/") ||
-                pathname === "/pairings" ||
-                pathname.startsWith("/pairings/") ||
-                pathname.startsWith("/agent/") ||
-                pathname.startsWith("/tunnel/"))) {
-                const fallbackParsed = {
-                    sessionId: tunnelCookie.sessionId,
-                    port: tunnelCookie.port,
-                    path: url.pathname,
-                };
-                await handleTunnelRequest(req, res, sessionManager, tokenManager, fallbackParsed, url, tunnelCookie.token);
-                return;
-            }
-            // Web SPA: last GET fallback, after every API route, so it never shadows
-            // them. Serves index.html for "/" and client-side routes; a no-op (false)
-            // when no web dist is bundled (e.g. an API-only embedded gateway).
-            if (await serveWeb(req, res))
-                return;
-            json(res, 404, { error: "not_found" });
-        }
-        catch (err) {
-            if (err instanceof ZodError) {
-                json(res, 400, {
-                    error: "invalid_message",
-                    message: err.errors[0]?.message ?? "Validation failed",
-                });
-            }
-            else if (err instanceof BodyTooLargeError) {
-                json(res, 413, {
-                    error: "body_too_large",
-                    message: "Request body exceeds limit",
-                });
-            }
-            else if (err instanceof SyntaxError) {
-                json(res, 400, { error: "invalid_json", message: "Malformed JSON" });
-            }
-            else {
-                log("error", `unhandled: ${err}`);
-                json(res, 500, {
-                    error: "internal_error",
-                    message: "Internal server error",
-                });
-            }
-        }
-    });
-    const wss = new WebSocketServer({
-        noServer: true,
-        maxPayload: MAX_WS_MESSAGE_SIZE,
-    });
-    // Loaded on demand: v1 users on older Node never touch node:sqlite.
-    const relay = options.relayDataPath ? await startRelay(options.relayDataPath, log) : undefined;
-    server.on("upgrade", (request, socket, head) => {
-        const url = new URL(request.url ?? "/", `http://${request.headers.host}`);
-        if (relay && url.pathname === relay.path) {
-            relay.gateway.handleUpgrade(request, socket, head);
-            return;
-        }
-        // Tunnel WebSocket upgrade (for HMR etc.)
-        const tunnelParsed = parseTunnelPath(url.pathname);
-        if (tunnelParsed) {
-            const tunnelCookie = parseTunnelCookie(request);
-            const cookieToken = tunnelCookie?.sessionId === tunnelParsed.sessionId && tunnelCookie.port === tunnelParsed.port
-                ? tunnelCookie.token
-                : undefined;
-            wss.handleUpgrade(request, socket, head, (ws) => {
-                handleTunnelWsUpgrade(ws, tunnelParsed, url, sessionManager, tokenManager, cookieToken);
-            });
-            return;
-        }
-        // Tunnel WS fallback via cookie (for HMR paths like /_next/webpack-hmr)
-        const tunnelCookie = parseTunnelCookie(request);
-        if (tunnelCookie && shouldUseTunnelCookieFallback(request, url.pathname, (pathname) => pathname === "/ws")) {
-            const fallbackParsed = {
-                sessionId: tunnelCookie.sessionId,
-                port: tunnelCookie.port,
-                path: url.pathname,
-            };
-            wss.handleUpgrade(request, socket, head, (ws) => {
-                handleTunnelWsUpgrade(ws, fallbackParsed, url, sessionManager, tokenManager, tunnelCookie.token);
-            });
-            return;
-        }
-        if (url.pathname !== "/ws") {
-            socket.destroy();
-            return;
-        }
-        wss.handleUpgrade(request, socket, head, (ws) => {
-            wss.emit("connection", ws, request, url);
-        });
-    });
-    wss.on("connection", (socket, _request, url) => {
-        const sessionId = url.searchParams.get("sessionId");
-        const role = url.searchParams.get("role");
-        if (role === "watcher") {
-            const token = url.searchParams.get("token");
-            if (!token || !tokenManager.validate(token)) {
-                socket.close(4001, "unauthorized");
-                return;
-            }
-            startPresenceWatcher({
-                socket,
-                sessions: sessionManager,
-                hub: presenceHub,
-                sessionIds: () => tokenManager.getSessionIds(token),
-                pingIntervalMs: PING_INTERVAL,
-            });
-            return;
-        }
-        if (!sessionId || !role || (role !== "host" && role !== "client")) {
-            socket.close(1008, "missing sessionId or role");
-            return;
-        }
-        const deviceId = url.searchParams.get("deviceId") ?? randomUUID();
-        if (role === "client") {
-            const token = url.searchParams.get("token");
-            if (!token || !tokenManager.owns(token, sessionId)) {
-                socket.close(4001, "unauthorized");
-                return;
-            }
-        }
-        const device = { socket, role, deviceId, connectedAt: Date.now() };
-        if (role === "host") {
-            const existingSession = sessionManager.get(sessionId);
-            const isReconnect = existingSession &&
-                existingSession.clients.size > 0 &&
-                existingSession.state === "host_disconnected";
-            sessionManager.setHost(sessionId, device);
-            if (isReconnect) {
-                const notification = serializeEnvelope(createEnvelope({
-                    type: "session.host_reconnected",
-                    sessionId,
-                    payload: {},
-                }));
-                for (const [, client] of existingSession.clients) {
-                    if (client.socket.readyState === client.socket.OPEN)
-                        client.socket.send(notification);
-                }
-            }
-        }
-        else {
-            sessionManager.addClient(sessionId, device);
-        }
-        socket.send(serializeEnvelope(createEnvelope({
-            type: "session.connect",
-            sessionId,
-            payload: {
-                role,
-                clientName: deviceId,
-                protocolVersion: PROTOCOL_VERSION,
-            },
-        })));
-        if (role === "client") {
-            replayAgentToSocket(socket, sessionId, sessionManager);
-        }
-        // Ping/pong for liveness — terminate sockets that stop answering pings.
-        const liveSocket = socket;
-        liveSocket.isAlive = true;
-        socket.on("pong", () => {
-            liveSocket.isAlive = true;
-        });
-        const pingTimer = setInterval(() => {
-            if (socket.readyState !== socket.OPEN)
-                return;
-            if (liveSocket.isAlive === false) {
-                socket.terminate();
-                return;
-            }
-            liveSocket.isAlive = false;
-            socket.ping();
-        }, PING_INTERVAL);
-        socket.on("message", (data) => {
-            try {
-                handleSocketMessage(socket, data.toString(), role, sessionId, deviceId, sessionManager);
-            }
-            catch (err) {
-                log("error", `unhandled websocket message error for session ${sessionId}: ${err instanceof Error ? err.message : String(err)}`);
-                if (socket.readyState === socket.OPEN) {
-                    socket.send(serializeEnvelope(createEnvelope({
-                        type: "session.error",
-                        sessionId,
-                        payload: {
-                            code: "invalid_message",
-                            message: "Failed to handle message",
-                        },
-                    })));
-                }
-            }
-        });
-        socket.on("close", () => {
-            clearInterval(pingTimer);
-            if (role === "host") {
-                const result = sessionManager.removeHost(sessionId);
-                if (result) {
-                    const notification = serializeEnvelope(createEnvelope({
-                        type: "session.host_disconnected",
-                        sessionId,
-                        payload: { reason: "host connection closed" },
-                    }));
-                    for (const [, client] of result.clients) {
-                        if (client.socket.readyState === client.socket.OPEN)
-                            client.socket.send(notification);
-                    }
-                }
-            }
-            else {
-                sessionManager.removeClient(sessionId, deviceId);
-            }
-        });
-        socket.on("error", () => { });
-    });
-    return new Promise((resolve, reject) => {
-        server.on("error", reject);
-        server.listen(targetPort, () => {
-            const addr = server.address();
-            const actualPort = typeof addr === "object" && addr ? addr.port : targetPort;
-            log("info", `embedded gateway on port ${actualPort}`);
-            // Surface whether the bundled web SPA was found — the in-app WebView loads
-            // this gateway's "/", so a missing dist means a blank screen. Makes the
-            // LAN/self-hosted "WebView is blank" failure mode diagnosable from logs.
-            if (webEnabled()) {
-                log("info", `web UI served from ${webDistPath()}`);
-            }
-            else {
-                log("warn", `web UI not bundled (WEB_DIST=${webDistPath()} has no index.html) — in-app agent console will be blank`);
-            }
-            resolve({
-                port: actualPort,
-                httpUrl: `http://127.0.0.1:${actualPort}`,
-                wsUrl: `ws://127.0.0.1:${actualPort}/ws`,
-                close: () => new Promise((res) => {
-                    wss.clients.forEach((ws) => ws.close(1001, "shutting down"));
-                    sessionManager.destroy();
-                    pairingManager.destroy();
-                    tokenManager.destroy();
-                    void relay?.gateway.stop();
-                    server.close(() => res());
-                }),
-            });
-        });
-    });
-}
-async function startRelay(databasePath, log) {
-    const [major = 0, minor = 0] = process.versions.node.split(".").map(Number);
-    if (major < 22 || (major === 22 && minor < 13)) {
-        log("warn", `v2 relay needs Node.js 22.13+ (this is ${process.version}); serving v1 only`);
-        return undefined;
-    }
-    const { mkdirSync } = await import("node:fs");
-    const { dirname } = await import("node:path");
-    const [{ Gateway }, { RELAY_PATH }] = await Promise.all([import("@linkshell/gateway-v2"), import("@linkshell/wire")]);
-    mkdirSync(dirname(databasePath), { recursive: true });
-    const gateway = new Gateway({ port: 0, databasePath, log: (message) => log("info", `[relay] ${message}`) });
-    gateway.attach();
-    log("info", `v2 relay on ${RELAY_PATH}`);
-    return { gateway, path: RELAY_PATH };
-}
-//# sourceMappingURL=embedded.js.map

package/dist/gateway/src/embedded.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"embedded.js","sourceRoot":"","sources":["../../../src/embedded.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,CAAC;AAErC,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,6BAA6B,EAC7B,mBAAmB,EACnB,qBAAqB,GAEtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAoBnF,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,uCAAuC;AAErF,MAAM,UAAU,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAE5D,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACzE,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAEH,MAAM,iBAAkB,SAAQ,KAAK;CAAG;AAExC,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,kBAAkB;QAClC,6BAA6B,EAAE,GAAG;QAClC,8BAA8B,EAAE,oBAAoB;QACpD,8BAA8B,EAAE,6BAA6B;KAC9D,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAoB;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC;QACnB,IAAI,IAAI,GAAG,aAAa;YAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,WAAW,CAAC,GAAoB;IACvC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjD,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;IAC1E,OAAO,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;AAC/C,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAoB;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC7C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkC,EAAE;IAEpC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,4BAA4B;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;IAEvC,SAAS,GAAG,CAAC,KAA0C,EAAE,GAAW;QAClE,IAAI,MAAM;YAAE,OAAO;QACnB,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,KAAK,GAAG,IAAI,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IACtC,cAAc,CAAC,gBAAgB,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACjB,6BAA6B,EAAE,GAAG;gBAClC,8BAA8B,EAAE,oBAAoB;gBACpD,8BAA8B,EAAE,6BAA6B;gBAC7D,wBAAwB,EAAE,OAAO;aAClC,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;YAEnC,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACpD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YAED,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACtD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1D,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACrD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACb,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;iBACpD,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;gBAC5D,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzD,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACtD,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;oBACtB,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;oBAClD,OAAO;gBACT,CAAC;gBACD,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACtD,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC3C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YAED,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACrD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBACtC,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;wBACb,KAAK,EAAE,cAAc;wBACrB,OAAO,EAAE,6BAA6B;qBACvC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,MAAM,UAAU,GAAG,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBACrD,MAAM,QAAQ,GAAG,cAAc;qBAC5B,UAAU,EAAE;qBACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;qBACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;qBAC3C,MAAM,CAAC,OAAO,CAAC,CAAC;gBACnB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YAED,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YACjE,IAAI,MAAM,KAAK,KAAK,IAAI,YAAY,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAE,CAAC;gBAClC,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;oBAClD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;wBACb,KAAK,EAAE,cAAc;wBACrB,OAAO,EAAE,6BAA6B;qBACvC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACpD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;oBAC/C,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;YAED,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACzE,IAAI,MAAM,KAAK,KAAK,IAAI,YAAY,EAAE,CAAC;gBACrC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAE,CAAC,CAAC;gBAC1D,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;oBACtB,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;oBACtD,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YAED,oCAAoC;YACpC,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;gBACrF,OAAO;YACT,CAAC;YAED,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,IAAI,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC;gBAAE,OAAO;YAE1C,mFAAmF;YACnF,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,YAAY,IAAI,6BAA6B,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAChF,QAAQ,KAAK,UAAU;gBACvB,QAAQ,KAAK,WAAW;gBACxB,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC;gBACjC,QAAQ,KAAK,WAAW;gBACxB,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC;gBACjC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;gBAC9B,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAChC,EAAE,CAAC;gBACF,MAAM,cAAc,GAAG;oBACrB,SAAS,EAAE,YAAY,CAAC,SAAS;oBACjC,IAAI,EAAE,YAAY,CAAC,IAAI;oBACvB,IAAI,EAAE,GAAG,CAAC,QAAQ;iBACnB,CAAC;gBACF,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC3G,OAAO;YACT,CAAC;YAED,yEAAyE;YACzE,0EAA0E;YAC1E,mEAAmE;YACnE,IAAI,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;gBAAE,OAAO;YAErC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACb,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,mBAAmB;iBACvD,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBAC5C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACb,KAAK,EAAE,gBAAgB;oBACvB,OAAO,EAAE,4BAA4B;iBACtC,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;gBACtC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACvE,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,OAAO,EAAE,cAAc,GAAG,EAAE,CAAC,CAAC;gBAClC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACb,KAAK,EAAE,gBAAgB;oBACvB,OAAO,EAAE,uBAAuB;iBACjC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC;QAC9B,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,mBAAmB;KAChC,CAAC,CAAC;IAEH,oEAAoE;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE/F,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAE1E,IAAI,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YACzC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,0CAA0C;QAC1C,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,WAAW,GAAG,YAAY,EAAE,SAAS,KAAK,YAAY,CAAC,SAAS,IAAI,YAAY,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI;gBAC/G,CAAC,CAAC,YAAY,CAAC,KAAK;gBACpB,CAAC,CAAC,SAAS,CAAC;YACd,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC9C,qBAAqB,CAAC,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;YAC1F,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,YAAY,IAAI,6BAA6B,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,KAAK,CAAC,EAAE,CAAC;YAC3G,MAAM,cAAc,GAAG;gBACrB,SAAS,EAAE,YAAY,CAAC,SAAS;gBACjC,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,IAAI,EAAE,GAAG,CAAC,QAAQ;aACnB,CAAC;YACF,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC9C,qBAAqB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YACnG,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC3B,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;YAC9C,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CACJ,YAAY,EACZ,CAAC,MAAiB,EAAE,QAAyB,EAAE,GAAQ,EAAE,EAAE;QACzD,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAyC,CAAC;QAElF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACnC,OAAO;YACT,CAAC;YACD,oBAAoB,CAAC;gBACnB,MAAM;gBACN,QAAQ,EAAE,cAAc;gBACxB,GAAG,EAAE,WAAW;gBAChB,UAAU,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC;gBACnD,cAAc,EAAE,aAAa;aAC9B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YAClE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,UAAU,EAAE,CAAC;QAElE,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;gBACnD,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACnC,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAEnE,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,eAAe,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,WAAW,GACf,eAAe;gBACf,eAAe,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC;gBAChC,eAAe,CAAC,KAAK,KAAK,mBAAmB,CAAC;YAChD,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC1C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,YAAY,GAAG,iBAAiB,CACpC,cAAc,CAAC;oBACb,IAAI,EAAE,0BAA0B;oBAChC,SAAS;oBACT,OAAO,EAAE,EAAE;iBACZ,CAAC,CACH,CAAC;gBACF,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;oBACjD,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI;wBACjD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,CAAC,IAAI,CACT,iBAAiB,CACf,cAAc,CAAC;YACb,IAAI,EAAE,iBAAiB;YACvB,SAAS;YACT,OAAO,EAAE;gBACP,IAAI;gBACJ,UAAU,EAAE,QAAQ;gBACpB,eAAe,EAAE,gBAAgB;aAClC;SACF,CAAC,CACH,CACF,CAAC;QAEF,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QACzD,CAAC;QAED,wEAAwE;QACxE,MAAM,UAAU,GAAG,MAA2C,CAAC;QAC/D,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;QAC1B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACrB,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YACjC,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI;gBAAE,OAAO;YAC9C,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBACjC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,UAAU,CAAC,OAAO,GAAG,KAAK,CAAC;YAC3B,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,CAAC,EAAE,aAAa,CAAC,CAAC;QAElB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAuB,EAAE,EAAE;YAC/C,IAAI,CAAC;gBACH,mBAAmB,CACjB,MAAM,EACN,IAAI,CAAC,QAAQ,EAAE,EACf,IAAI,EACJ,SAAS,EACT,QAAQ,EACR,cAAc,CACf,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,OAAO,EAAE,iDAAiD,SAAS,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChI,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;oBACtC,MAAM,CAAC,IAAI,CACT,iBAAiB,CACf,cAAc,CAAC;wBACb,IAAI,EAAE,eAAe;wBACrB,SAAS;wBACT,OAAO,EAAE;4BACP,IAAI,EAAE,iBAAiB;4BACvB,OAAO,EAAE,0BAA0B;yBACpC;qBACF,CAAC,CACH,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBACpD,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,YAAY,GAAG,iBAAiB,CACpC,cAAc,CAAC;wBACb,IAAI,EAAE,2BAA2B;wBACjC,SAAS;wBACT,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE;qBAC9C,CAAC,CACH,CAAC;oBACF,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;wBACxC,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI;4BACjD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;oBACrC,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACnD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC/B,CAAC,CACF,CAAC;IAEF,OAAO,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE;YAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,UAAU,GACd,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;YAC5D,GAAG,CAAC,MAAM,EAAE,4BAA4B,UAAU,EAAE,CAAC,CAAC;YACtD,2EAA2E;YAC3E,wEAAwE;YACxE,yEAAyE;YACzE,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,GAAG,CAAC,MAAM,EAAE,sBAAsB,WAAW,EAAE,EAAE,CAAC,CAAC;YACrD,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,MAAM,EAAE,gCAAgC,WAAW,EAAE,0DAA0D,CAAC,CAAC;YACvH,CAAC;YACD,OAAO,CAAC;gBACN,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,oBAAoB,UAAU,EAAE;gBACzC,KAAK,EAAE,kBAAkB,UAAU,KAAK;gBACxC,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE;oBACxB,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;oBAC7D,cAAc,CAAC,OAAO,EAAE,CAAC;oBACzB,cAAc,CAAC,OAAO,EAAE,CAAC;oBACzB,YAAY,CAAC,OAAO,EAAE,CAAC;oBACvB,KAAK,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;oBAC3B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5B,CAAC,CAAC;aACL,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,YAAoB,EAAE,GAA0E;IACxH,MAAM,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5E,IAAI,KAAK,GAAG,EAAE,IAAI,CAAC,KAAK,KAAK,EAAE,IAAI,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,MAAM,EAAE,0CAA0C,OAAO,CAAC,OAAO,oBAAoB,CAAC,CAAC;QAC3F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACtH,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5G,OAAO,CAAC,MAAM,EAAE,CAAC;IACjB,GAAG,CAAC,MAAM,EAAE,eAAe,UAAU,EAAE,CAAC,CAAC;IACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACvC,CAAC"}

package/dist/gateway/src/host-auth.d.ts

@@ -1,32 +0,0 @@
-/**
- * Binds a session to the secret host token issued when its pairing was created,
- * so only the original host (the CLI that created the pairing) can connect as
- * `role=host`. Without this, anyone who learns a sessionId could connect as host
- * and capture every controller keystroke or inject terminal output.
- *
- * Kept separate from PairingManager because a host connection long outlives the
- * pairing code's 10-minute TTL (and reconnects days later), so the binding needs
- * its own longer lifetime.
- */
-export declare class HostAuthManager {
-    private bindings;
-    private cleanupTimer;
-    constructor();
-    /** Mint a fresh host token to hand to the CLI at pairing creation.
-     *
-     *  Deliberately does NOT create a binding yet: the binding is established
-     *  trust-on-first-use when the host first connects WITH this token (see
-     *  `adopt`). This keeps the gateway backward-compatible with older CLIs that
-     *  don't send a host token at all — they simply never create a binding and
-     *  are allowed as legacy hosts, instead of being locked out by an eager
-     *  binding they can't satisfy. The legitimate host connects milliseconds
-     *  after pairing, so the trust-on-first-use window is negligible. */
-    issue(_sessionId: string): string;
-    /** Trust-on-first-use: register a host-provided token when no binding exists
-     *  yet (e.g. after a gateway restart lost the in-memory binding). */
-    adopt(sessionId: string, hostToken: string): void;
-    has(sessionId: string): boolean;
-    verify(sessionId: string, hostToken: string | undefined): boolean;
-    private cleanup;
-    destroy(): void;
-}

package/dist/gateway/src/host-auth.js

@@ -1,78 +0,0 @@
-import { randomUUID, timingSafeEqual } from "node:crypto";
-const CLEANUP_INTERVAL = 5 * 60_000;
-const HOST_TOKEN_TTL = 7 * 24 * 60 * 60_000; // 7 days
-function safeEqual(a, b) {
-    const ab = Buffer.from(a);
-    const bb = Buffer.from(b);
-    if (ab.length !== bb.length)
-        return false;
-    return timingSafeEqual(ab, bb);
-}
-/**
- * Binds a session to the secret host token issued when its pairing was created,
- * so only the original host (the CLI that created the pairing) can connect as
- * `role=host`. Without this, anyone who learns a sessionId could connect as host
- * and capture every controller keystroke or inject terminal output.
- *
- * Kept separate from PairingManager because a host connection long outlives the
- * pairing code's 10-minute TTL (and reconnects days later), so the binding needs
- * its own longer lifetime.
- */
-export class HostAuthManager {
-    bindings = new Map();
-    cleanupTimer;
-    constructor() {
-        this.cleanupTimer = setInterval(() => this.cleanup(), CLEANUP_INTERVAL);
-        this.cleanupTimer.unref?.();
-    }
-    /** Mint a fresh host token to hand to the CLI at pairing creation.
-     *
-     *  Deliberately does NOT create a binding yet: the binding is established
-     *  trust-on-first-use when the host first connects WITH this token (see
-     *  `adopt`). This keeps the gateway backward-compatible with older CLIs that
-     *  don't send a host token at all — they simply never create a binding and
-     *  are allowed as legacy hosts, instead of being locked out by an eager
-     *  binding they can't satisfy. The legitimate host connects milliseconds
-     *  after pairing, so the trust-on-first-use window is negligible. */
-    issue(_sessionId) {
-        return randomUUID();
-    }
-    /** Trust-on-first-use: register a host-provided token when no binding exists
-     *  yet (e.g. after a gateway restart lost the in-memory binding). */
-    adopt(sessionId, hostToken) {
-        this.bindings.set(sessionId, { sessionId, hostToken, lastUsedAt: Date.now() });
-    }
-    has(sessionId) {
-        const binding = this.bindings.get(sessionId);
-        if (!binding)
-            return false;
-        if (Date.now() - binding.lastUsedAt > HOST_TOKEN_TTL) {
-            this.bindings.delete(sessionId);
-            return false;
-        }
-        return true;
-    }
-    verify(sessionId, hostToken) {
-        if (!hostToken)
-            return false;
-        const binding = this.bindings.get(sessionId);
-        if (!binding)
-            return false;
-        if (!safeEqual(binding.hostToken, hostToken))
-            return false;
-        binding.lastUsedAt = Date.now();
-        return true;
-    }
-    cleanup() {
-        const now = Date.now();
-        for (const [sessionId, binding] of this.bindings) {
-            if (now - binding.lastUsedAt > HOST_TOKEN_TTL) {
-                this.bindings.delete(sessionId);
-            }
-        }
-    }
-    destroy() {
-        clearInterval(this.cleanupTimer);
-    }
-}
-//# sourceMappingURL=host-auth.js.map

package/dist/gateway/src/host-auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"host-auth.js","sourceRoot":"","sources":["../../../src/host-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAC;AACpC,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,SAAS;AAQtD,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,eAAe;IAClB,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC1C,YAAY,CAAiC;IAErD;QACE,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACxE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC;IAC9B,CAAC;IAED;;;;;;;;yEAQqE;IACrE,KAAK,CAAC,UAAkB;QACtB,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;IAED;yEACqE;IACrE,KAAK,CAAC,SAAiB,EAAE,SAAiB;QACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,cAAc,EAAE,CAAC;YACrD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,SAAiB,EAAE,SAA6B;QACrD,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3D,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjD,IAAI,GAAG,GAAG,OAAO,CAAC,UAAU,GAAG,cAAc,EAAE,CAAC;gBAC9C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACnC,CAAC;CACF"}

package/dist/gateway/src/pairings.d.ts

@@ -1,38 +0,0 @@
-import type { GatewayStateStore } from "./state-store.js";
-export interface PairingRecord {
-    sessionId: string;
-    pairingCode: string;
-    expiresAt: number;
-    claimed: boolean;
-    failedAttempts: number;
-}
-export declare class PairingManager {
-    private readonly store?;
-    private pairings;
-    private cleanupTimer;
-    constructor(store?: GatewayStateStore | undefined);
-    hydrate(): Promise<void>;
-    create(sessionId?: string): PairingRecord;
-    claim(pairingCode: string): PairingRecord | {
-        error: string;
-        status: number;
-    };
-    /** Look up a code's session without consuming an attempt or mutating state.
-     *  Lets the claim endpoint stay idempotent for a device that already owns the
-     *  mapped session (it re-issues instead of erroring with already_claimed). */
-    peek(pairingCode: string): {
-        sessionId: string;
-        claimed: boolean;
-    } | null;
-    getStatus(pairingCode: string): {
-        status: string;
-        expiresAt: number;
-        sessionId: string;
-    } | {
-        error: string;
-        httpStatus: number;
-    };
-    private cleanup;
-    private persist;
-    destroy(): void;
-}