@linxin666/dsh-remote-web-ui 0.1.1 → 0.1.2

package/lib/types/gate.js

@@ -0,0 +1,121 @@
+/**
+ * The `api/gate` listener: application-level access control layered on top
+ * of the transport fence (the fence is Host/Origin based and explicitly not
+ * an authentication layer — packages/client/connection documents this
+ * event as the sanctioned seam for pairing/revocation).
+ *
+ * Policy: loopback requests (the desktop) pass without a device identity;
+ * every non-loopback /api request must carry a live, non-revoked device
+ * cookie. This makes the QR the only way into a LAN-exposed dsh web and
+ * gives "停止" real teeth: revoked devices 403 on their next request,
+ * including the mux/SSE stream (which then dies on reconnect).
+ */
+/**
+ * Whether a normalized URL hostname names the local loopback authority.
+ * Semantics mirror the connection package's internal predicate (localhost,
+ * IPv6 loopback, any IPv4 address in 127/8); it is reimplemented here because
+ * the connection package no longer exports it — the fence now lives inside
+ * the connection plugin, and external host plugins only need the
+ * classification, not the whole trust decision.
+ * @param hostname - WHATWG URL hostname (IPv6 literals retain brackets).
+ * @returns true for localhost, IPv6 loopback, or any IPv4 address in 127/8.
+ */
+export function isLoopbackHostname(hostname) {
+    if (hostname === 'localhost' || hostname === '[::1]')
+        return true;
+    const parts = hostname.split('.');
+    return parts.length === 4
+        && parts[0] === '127'
+        && parts.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255);
+}
+/** Whether a socket remote address names the loopback range (127/8, ::1, IPv4-mapped). */
+export function isLoopbackAddress(address) {
+    if (address === undefined)
+        return false;
+    const normalized = address.toLowerCase();
+    if (normalized === '::1')
+        return true;
+    if (normalized.startsWith('::ffff:'))
+        return isIPv4Loopback(normalized.slice('::ffff:'.length));
+    return isIPv4Loopback(normalized);
+}
+/** IPv4 127/8 predicate (four decimal octets, first == 127). */
+function isIPv4Loopback(v4) {
+    const parts = v4.split('.');
+    return parts.length === 4
+        && parts[0] === '127'
+        && parts.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255);
+}
+/**
+ * Read one cookie value from a Cookie header.
+ * @param header - the raw Cookie header value (or undefined).
+ * @param name - the cookie name.
+ * @returns the value, or undefined when absent.
+ */
+export function readCookie(header, name) {
+    if (header === undefined)
+        return undefined;
+    for (const part of header.split(';')) {
+        const eq = part.indexOf('=');
+        if (eq < 0)
+            continue;
+        const key = part.slice(0, eq).trim();
+        if (key === name)
+            return part.slice(eq + 1).trim();
+    }
+    return undefined;
+}
+/**
+ * The effective Host hostname of a request.
+ * @param request - node HTTP request.
+ * @returns the normalized hostname, or undefined when unparsable.
+ */
+export function hostnameOf(request) {
+    const host = request.headers.host;
+    if (typeof host !== 'string')
+        return undefined;
+    try {
+        return new URL(`http://${host}`).hostname;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Whether a request comes from the desktop loopback client (loopback socket AND loopback Host). */
+export function isLoopbackClient(request) {
+    const hostname = hostnameOf(request);
+    if (hostname === undefined || !isLoopbackHostname(hostname))
+        return false;
+    const socket = request.socket;
+    return isLoopbackAddress(socket?.remoteAddress);
+}
+/**
+ * Build the api/gate listener for one pairing service.
+ * @param service - the pairing service.
+ * @param requirePairingForLan - when false, non-loopback requests pass
+ * without a device cookie (the feature then only manages tokens/status;
+ * revocation of paired devices still holds). A function is re-read per
+ * request, so a settings edit takes effect without a restart. Defaults to true.
+ * @param enabled - when false, every non-loopback request is vetoed while
+ * loopback stays available. A function is re-read per request so the fence
+ * stays mounted for the plugin lifetime and disabling the plugin cannot open
+ * a LAN-exposed /api. Defaults to true.
+ * @returns the cordis waterfall listener: call `next()` to delegate,
+ * return false (without calling it) to veto with 403.
+ */
+export function makeGateListener(service, requirePairingForLan = true, enabled = true) {
+    return (request, _method, next) => {
+        if (isLoopbackClient(request))
+            return next();
+        const active = typeof enabled === 'function' ? enabled() : enabled;
+        if (!active)
+            return false;
+        const require = typeof requirePairingForLan === 'function' ? requirePairingForLan() : requirePairingForLan;
+        if (!require)
+            return next();
+        const deviceId = readCookie(request.headers.cookie, service.config.cookieName);
+        if (deviceId === undefined)
+            return false;
+        return service.touchDevice(deviceId) ? next() : false;
+    };
+}

package/lib/types/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;WACpB,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;WAClB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAA;AACzE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,MAA0B,EAAE,IAAY;IACjE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,EAAE,GAAG,CAAC;YAAE,SAAQ;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QACpC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACpD,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAAwB;IACjD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IACjC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC9C,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAuB,EACvB,uBAAkD,IAAI,EACtD,UAAqC,IAAI;IAEzC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAChC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;QACpC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACxC,IAAI,kBAAkB,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,EAAE,CAAA;QAC/C,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;QAClE,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAA;QACzB,MAAM,OAAO,GAAG,OAAO,oBAAoB,KAAK,UAAU,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAA;QAC1G,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,EAAE,CAAA;QAC3B,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAC9E,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACxC,OAAO,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;IACvD,CAAC,CAAA;AACH,CAAC"}

package/lib/types/index.js

@@ -0,0 +1,227 @@
+/**
+ * Mobile remote control for the dsh web GUI — host half. Mounts the pairing
+ * service (one-time tokens, device sessions, revocation), the /api/pair
+ * route family (issue/accept/stop/heartbeat/status/events), the api/gate
+ * listener that enforces pairing on every other /api request from
+ * non-loopback hosts, and the presence sweep. The browser half (the
+ * `./client` entry) renders the sidebar entry, the pairing panel, and the
+ * phone-side pair/accept + deep-link flow.
+ */
+import { setInterval as nodeSetInterval } from 'node:timers';
+import { installSettingsSection, settingsNamespace } from '@deepseek-ai/dsh-settings';
+import z from 'schemastery';
+import { PairingService } from "./pairing.js";
+import { makeGateListener } from "./gate.js";
+import { makeRoutes } from "./routes.js";
+import { makeMobileRoutes } from "./mobile-routes.js";
+import { makeMobileApiRoutes } from "./mobile-api.js";
+import { lanIPv4Addresses } from "./lan.js";
+import { TunnelManager } from "./tunnel.js";
+/** Stable cordis plugin name. */
+export const name = 'remote-web-ui';
+/** Services required before the pairing surfaces can mount. */
+export const inject = ['webServer', 'apiProxy'];
+/**
+ * Settings namespace of the remote-control capability — the section the web
+ * settings surface edits. Spelled here rather than imported: the browser
+ * half spells the same value and must not depend on a Host package.
+ */
+export const REMOTE_WEB_UI_SETTINGS_NAMESPACE = settingsNamespace('remote-web-ui');
+export const Config = z.object({
+    tokenTtlMs: z.number().step(1).min(60_000).default(10 * 60_000),
+    offlineAfterMs: z.number().step(1).min(5_000).default(25_000),
+    maxDevices: z.number().step(1).min(1).max(64).default(4),
+    cookieName: z.string().min(1).default('dsh_pair'),
+    requirePairingForLan: z.boolean().default(true),
+    publicBaseUrl: z.string(),
+    autoTunnel: z.boolean().default(false),
+    enabled: z.boolean().default(true),
+});
+/** Presence sweep cadence (a stale device flips to disconnected within two sweeps). */
+const SWEEP_INTERVAL_MS = 10_000;
+/** Schema defaults, re-read for hand-built test contexts (the loader applies them normally). */
+const DEFAULTS = {
+    tokenTtlMs: 10 * 60_000,
+    offlineAfterMs: 25_000,
+    maxDevices: 4,
+    cookieName: 'dsh_pair',
+    requirePairingForLan: true,
+    publicBaseUrl: undefined,
+    autoTunnel: false,
+    enabled: true,
+};
+/**
+ * Mount the pairing service, routes, gate listener, and presence sweep.
+ * @param ctx - host plugin context carrying webServer.
+ * @param config - resolved plugin config (schema defaults applied by the loader).
+ */
+export function apply(ctx, config) {
+    const resolved = {
+        tokenTtlMs: config?.tokenTtlMs ?? DEFAULTS.tokenTtlMs,
+        offlineAfterMs: config?.offlineAfterMs ?? DEFAULTS.offlineAfterMs,
+        maxDevices: config?.maxDevices ?? DEFAULTS.maxDevices,
+        cookieName: config?.cookieName ?? DEFAULTS.cookieName,
+        requirePairingForLan: config?.requirePairingForLan ?? DEFAULTS.requirePairingForLan,
+        publicBaseUrl: config?.publicBaseUrl,
+        autoTunnel: config?.autoTunnel ?? DEFAULTS.autoTunnel,
+        enabled: config?.enabled ?? DEFAULTS.enabled,
+    };
+    // The live source the pairing service and the gate read: the settings
+    // section once the web settings surface is served, the composition entry
+    // otherwise (installSettingsSection swaps it when the namespace registers).
+    let current = () => config ?? {};
+    const resolve = () => {
+        const value = current();
+        return {
+            tokenTtlMs: value.tokenTtlMs ?? DEFAULTS.tokenTtlMs,
+            offlineAfterMs: value.offlineAfterMs ?? DEFAULTS.offlineAfterMs,
+            maxDevices: value.maxDevices ?? DEFAULTS.maxDevices,
+            cookieName: value.cookieName ?? DEFAULTS.cookieName,
+            requirePairingForLan: value.requirePairingForLan ?? DEFAULTS.requirePairingForLan,
+            publicBaseUrl: value.publicBaseUrl,
+            autoTunnel: value.autoTunnel ?? DEFAULTS.autoTunnel,
+            enabled: value.enabled ?? DEFAULTS.enabled,
+        };
+    };
+    const service = new PairingService({
+        tokenTtlMs: resolved.tokenTtlMs,
+        offlineAfterMs: resolved.offlineAfterMs,
+        maxDevices: resolved.maxDevices,
+        cookieName: resolved.cookieName,
+    });
+    // ── auto tunnel ─────────────────────────────────────────────────────────
+    // The minted public URL becomes the QR base (and the pairing fence's
+    // trusted host). Phone /api traffic rides the plugin's own /m/api channel,
+    // which is NOT subject to the connection trust fence — so no fence
+    // mutation is needed here (a distributable plugin must not change the
+    // harness's connection plugin).
+    const tunnel = new TunnelManager();
+    let autoTunnel = resolved.autoTunnel;
+    tunnel.onPhase((info) => {
+        if (!autoTunnel)
+            return;
+        if (info.phase === 'running' && info.url !== undefined) {
+            service.setPublicBaseUrl(info.url);
+            service.setTunnelStatus({ state: 'running', url: info.url });
+        }
+        else if (info.phase === 'starting') {
+            // A restart mints a NEW hostname: the previous URL dies with the old
+            // process, so clear it now rather than advertising a dead link.
+            service.setPublicBaseUrl(undefined);
+            service.setTunnelStatus({ state: 'starting' });
+        }
+        else if (info.phase === 'failed') {
+            service.setPublicBaseUrl(undefined);
+            service.setTunnelStatus(info.error === undefined ? { state: 'failed' } : { state: 'failed', error: info.error });
+        }
+    });
+    ctx.effect(() => () => {
+        tunnel.dispose();
+    }, 'remote-web-ui: auto tunnel');
+    // The bind facts are known by now (webServer is an inject edge): the LAN
+    // bases are frozen per process, matching the CLI's once-per-invocation
+    // sampling stance. The QR can only advertise addresses the fence accepts;
+    // every interface gets its own base URL so a multi-homed machine can pick
+    // the network the phone can actually reach.
+    const lanBases = ctx.webServer.host === '0.0.0.0'
+        ? lanIPv4Addresses().map(address => ({ address, base: `http://${address}:${String(ctx.webServer.port)}` }))
+        : [];
+    service.setLanBases(lanBases);
+    const lanAddresses = lanBases.map(entry => entry.address);
+    // Push a committed settings section into the service and gate. The service
+    // config object is read per operation (token mint, touch, sweep), and the
+    // gate re-reads its fence flag per request, so a live edit takes effect
+    // without a restart. When `enabled` turns off, the pairing routes and
+    // sweep timer are dropped and all device/token state is revoked, but the
+    // gate listener stays mounted so a LAN-exposed /api stays behind pairing
+    // (now vetoing every non-loopback request) instead of opening the fence.
+    let disposeRoutes;
+    let disposeSweep;
+    // The phone's data channel: pairing routes + the /m page + the /m/api
+    // proxy (which needs the host ApiProxy service; the plugin injects it).
+    const apiProxy = ctx.get('apiProxy');
+    if (apiProxy === undefined) {
+        console.warn('remote-web-ui: apiProxy service unavailable — the mobile data channel is disabled');
+    }
+    const routes = [
+        ...makeRoutes({ service, lanAddresses }),
+        ...makeMobileRoutes(),
+        ...(apiProxy !== undefined ? makeMobileApiRoutes({ service, apiProxy }) : []),
+    ];
+    const gate = makeGateListener(service, () => resolve().requirePairingForLan, () => resolve().enabled);
+    ctx.effect(() => ctx.on('api/gate', gate), 'remote-web-ui: api gate');
+    const sync = () => {
+        const value = resolve();
+        service.config = {
+            tokenTtlMs: value.tokenTtlMs,
+            offlineAfterMs: value.offlineAfterMs,
+            maxDevices: value.maxDevices,
+            cookieName: value.cookieName,
+        };
+        // The auto tunnel owns the public base while enabled: the minted URL
+        // lands in the service through the tunnel's phase listener. The manual
+        // publicBaseUrl applies only when the auto tunnel is off.
+        autoTunnel = value.autoTunnel === true;
+        if (autoTunnel) {
+            if (value.publicBaseUrl !== undefined) {
+                console.warn('remote-web-ui: autoTunnel is on — ignoring the manually configured publicBaseUrl');
+            }
+            tunnel.start(`http://127.0.0.1:${String(ctx.webServer.port)}`);
+        }
+        else {
+            tunnel.stop();
+            // A malformed public base is ignored with a warning — LAN-only behavior
+            // stays intact rather than silently minting unusable QR links.
+            if (value.publicBaseUrl !== undefined && !isHttpUrl(value.publicBaseUrl)) {
+                console.warn(`remote-web-ui: ignoring malformed publicBaseUrl ${JSON.stringify(value.publicBaseUrl)} (expected https://host[:port])`);
+                service.setPublicBaseUrl(undefined);
+            }
+            else {
+                service.setPublicBaseUrl(value.publicBaseUrl);
+            }
+        }
+        const enabled = value.enabled;
+        if (!enabled)
+            service.stop();
+        if (disposeRoutes === undefined && enabled) {
+            disposeRoutes = ctx.effect(() => {
+                const disposers = routes.map(route => ctx.webServer.register(route));
+                return () => { for (const dispose of disposers)
+                    dispose(); };
+            }, 'remote-web-ui: pairing routes');
+        }
+        else if (disposeRoutes !== undefined && !enabled) {
+            disposeRoutes();
+            disposeRoutes = undefined;
+        }
+        if (disposeSweep === undefined && enabled) {
+            disposeSweep = ctx.effect(() => {
+                const timer = nodeSetInterval(() => { service.sweep(); }, SWEEP_INTERVAL_MS);
+                timer.unref();
+                return () => { clearInterval(timer); };
+            }, 'remote-web-ui: presence sweep');
+        }
+        else if (disposeSweep !== undefined && !enabled) {
+            disposeSweep();
+            disposeSweep = undefined;
+        }
+    };
+    installSettingsSection(ctx, REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, config ?? {}, {
+        setSource: (source) => {
+            current = source;
+            sync();
+        },
+        onChange: sync,
+    });
+    sync();
+}
+/** Whether a configured public base is a parseable http(s) URL with a host. */
+function isHttpUrl(value) {
+    try {
+        const url = new URL(value);
+        return (url.protocol === 'http:' || url.protocol === 'https:') && url.hostname !== '';
+    }
+    catch {
+        return false;
+    }
+}

package/lib/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,aAAa,CAAA;AAG5D,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AACrF,OAAO,CAAC,MAAM,aAAa,CAAA;AAE3B,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAmB,MAAM,aAAa,CAAA;AAmB5D,iCAAiC;AACjC,MAAM,CAAC,MAAM,IAAI,GAAG,eAAe,CAAA;AAEnC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAA;AAwClF,MAAM,CAAC,MAAM,MAAM,GAAc,CAAC,CAAC,MAAM,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC;IAC/D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IACjD,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACnC,CAAC,CAAA;AAEF,uFAAuF;AACvF,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAShC,gGAAgG;AAChG,MAAM,QAAQ,GAAmB;IAC/B,UAAU,EAAE,EAAE,GAAG,MAAM;IACvB,cAAc,EAAE,MAAM;IACtB,UAAU,EAAE,CAAC;IACb,UAAU,EAAE,UAAU;IACtB,oBAAoB,EAAE,IAAI;IAC1B,aAAa,EAAE,SAAS;IACxB,UAAU,EAAE,KAAK;IACjB,OAAO,EAAE,IAAI;CACd,CAAA;AAED;;;;GAIG;AACH,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAAe;IACjD,MAAM,QAAQ,GAAmB;QAC/B,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,QAAQ,CAAC,UAAU;QACrD,cAAc,EAAE,MAAM,EAAE,cAAc,IAAI,QAAQ,CAAC,cAAc;QACjE,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,QAAQ,CAAC,UAAU;QACrD,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,QAAQ,CAAC,UAAU;QACrD,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,IAAI,QAAQ,CAAC,oBAAoB;QACnF,aAAa,EAAE,MAAM,EAAE,aAAa;QACpC,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,QAAQ,CAAC,UAAU;QACrD,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,QAAQ,CAAC,OAAO;KAC7C,CAAA;IACD,sEAAsE;IACtE,yEAAyE;IACzE,4EAA4E;IAC5E,IAAI,OAAO,GAAiB,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,CAAA;IAC9C,MAAM,OAAO,GAAG,GAAmB,EAAE;QACnC,MAAM,KAAK,GAAG,OAAO,EAAE,CAAA;QACvB,OAAO;YACL,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU;YACnD,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc;YAC/D,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU;YACnD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU;YACnD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,IAAI,QAAQ,CAAC,oBAAoB;YACjF,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU;YACnD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO;SAC3C,CAAA;IACH,CAAC,CAAA;IACD,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC;QACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC,CAAA;IAEF,2EAA2E;IAC3E,qEAAqE;IACrE,2EAA2E;IAC3E,mEAAmE;IACnE,sEAAsE;IACtE,gCAAgC;IAChC,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAA;IAClC,IAAI,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAA;IACpC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAgB,EAAE,EAAE;QAClC,IAAI,CAAC,UAAU;YAAE,OAAM;QACvB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAClC,OAAO,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QAC9D,CAAC;aAAM,IAAI,IAAI,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACrC,qEAAqE;YACrE,gEAAgE;YAChE,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAA;YACnC,OAAO,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAA;QAChD,CAAC;aAAM,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAA;YACnC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;QAClH,CAAC;IACH,CAAC,CAAC,CAAA;IACF,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE;QACpB,MAAM,CAAC,OAAO,EAAE,CAAA;IAClB,CAAC,EAAE,4BAA4B,CAAC,CAAA;IAChC,0EAA0E;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,0EAA0E;IAC1E,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS;QAChD,CAAC,CAAC,gBAAgB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5G,CAAC,CAAC,EAAE,CAAA;IACN,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;IAC7B,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAEzD,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,IAAI,aAAuC,CAAA;IAC3C,IAAI,YAAsC,CAAA;IAC1C,sEAAsE;IACtE,wEAAwE;IACxE,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAA;IACnG,CAAC;IACD,MAAM,MAAM,GAAG;QACb,GAAG,UAAU,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACxC,GAAG,gBAAgB,EAAE;QACrB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAA;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAA;IACrG,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,yBAAyB,CAAC,CAAA;IACrE,MAAM,IAAI,GAAG,GAAS,EAAE;QACtB,MAAM,KAAK,GAAG,OAAO,EAAE,CAAA;QACvB,OAAO,CAAC,MAAM,GAAG;YACf,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAA;QACD,qEAAqE;QACrE,uEAAuE;QACvE,0DAA0D;QAC1D,UAAU,GAAG,KAAK,CAAC,UAAU,KAAK,IAAI,CAAA;QACtC,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAA;YAClG,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,oBAAoB,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACjE,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,EAAE,CAAA;YACb,wEAAwE;YACxE,+DAA+D;YAC/D,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;gBACzE,OAAO,CAAC,IAAI,CAAC,mDAAmD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,iCAAiC,CAAC,CAAA;gBACrI,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAA;YACrC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;YAC/C,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;QAC7B,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,IAAI,EAAE,CAAA;QAC5B,IAAI,aAAa,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC;YAC3C,aAAa,GAAG,GAAG,CAAC,MAAM,CACxB,GAAG,EAAE;gBACH,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;gBACrE,OAAO,GAAG,EAAE,GAAG,KAAK,MAAM,OAAO,IAAI,SAAS;oBAAE,OAAO,EAAE,CAAA,CAAC,CAAC,CAAA;YAC7D,CAAC,EACD,+BAA+B,CAChC,CAAA;QACH,CAAC;aAAM,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;YACnD,aAAa,EAAE,CAAA;YACf,aAAa,GAAG,SAAS,CAAA;QAC3B,CAAC;QACD,IAAI,YAAY,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC;YAC1C,YAAY,GAAG,GAAG,CAAC,MAAM,CACvB,GAAG,EAAE;gBACH,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAA,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAA;gBAC3E,KAAK,CAAC,KAAK,EAAE,CAAA;gBACb,OAAO,GAAG,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC,CAAA;YACvC,CAAC,EACD,+BAA+B,CAChC,CAAA;QACH,CAAC;aAAM,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;YAClD,YAAY,EAAE,CAAA;YACd,YAAY,GAAG,SAAS,CAAA;QAC1B,CAAC;IACH,CAAC,CAAA;IACD,sBAAsB,CAAC,GAAG,EAAE,gCAAgC,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE;QAClF,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;YACpB,OAAO,GAAG,MAAM,CAAA;YAChB,IAAI,EAAE,CAAA;QACR,CAAC;QACD,QAAQ,EAAE,IAAI;KACf,CAAC,CAAA;IACF,IAAI,EAAE,CAAA;AACR,CAAC;AAED,+EAA+E;AAC/E,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAA;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/lib/types/invariant.js

@@ -0,0 +1,23 @@
+/**
+ * Package-owned invariant companion for `@linxin666/dsh-remote-web-ui`.
+ * @module @linxin666/dsh-remote-web-ui/invariant
+ */
+const PACKAGE_NAME = '@linxin666/dsh-remote-web-ui';
+/** Cordis companion plugin name. */
+export const name = 'remote-web-ui-invariant';
+/** Service required before the companion can reserve package ownership. */
+export const inject = ['invariants'];
+/**
+ * No runtime invariant: this package owns no durable package-local event
+ * stream; its route-table and device-session relationships are asserted by
+ * the package's own specs (route register/dispose symmetry via the
+ * webServer disposer contract, token/revocation semantics on the service).
+ */
+const install = () => { };
+/**
+ * Register this package's invariant companion.
+ * @param ctx - Cordis context carrying the invariant service.
+ * @returns the installed registration's disposer after setup succeeds.
+ */
+export const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
+/* jscpd:ignore-end */

package/lib/types/invariant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invariant.js","sourceRoot":"","sources":["../../src/invariant.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,MAAM,YAAY,GAAG,gCAAgC,CAAA;AAErD,oCAAoC;AACpC,MAAM,CAAC,MAAM,IAAI,GAAG,yBAAyB,CAAA;AAC7C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,YAAY,CAAC,CAAA;AAEpC;;;;;GAKG;AACH,MAAM,OAAO,GAAuB,GAAG,EAAE,GAAE,CAAC,CAAA;AAE5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,GAAY,EAAuB,EAAE,CACzD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAA;AACjE,sBAAsB"}

package/lib/types/lan.js

@@ -0,0 +1,19 @@
+/**
+ * LAN address derivation for the pairing URLs. Mirrors the dsh CLI's
+ * boot-time sampling (apps/cli/src/app-cli-entry.ts `resolveLanTrust`): the
+ * pairing links may only name addresses the /api trust fence was configured
+ * with, so the same non-internal IPv4 derivation applies here — an external
+ * plugin cannot read the CLI's sampled snapshot, but the fence accepts
+ * exactly these literals, which is the property that matters.
+ */
+import { networkInterfaces } from 'node:os';
+/**
+ * Non-internal IPv4 interface addresses of this machine — the IP-literal
+ * authorities an all-interfaces bind is reachable by on the LAN.
+ * @returns the addresses in interface order (possibly empty).
+ */
+export function lanIPv4Addresses() {
+    return Object.values(networkInterfaces()).flat()
+        .filter((iface) => { return iface !== undefined && iface.family === 'IPv4' && !iface.internal; })
+        .map(iface => iface.address);
+}

package/lib/types/lan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lan.js","sourceRoot":"","sources":["../../src/lan.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAE3C;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,EAAE;SAC7C,MAAM,CAAC,CAAC,KAAK,EAAsC,EAAE,GAAG,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAA,CAAC,CAAC,CAAC;SACnI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AAChC,CAAC"}

package/lib/types/mobile/api.js

@@ -0,0 +1,60 @@
+/**
+ * Mobile-surface business API: the handful of host RPC methods the
+ * simplified surface needs. Types come from the harness apiproxy contract
+ * (type-only imports; the wire schemas stay in the bundle only through the
+ * rpc/mux layers).
+ */
+import { callUnary } from "./rpc.js";
+/** The workspace roster (session ids come back per workspace). */
+export async function listWorkspaces() {
+    const { items } = await callUnary('workspace.list', {});
+    return items;
+}
+/** One session.list page; omit the cursor for the first page. */
+export async function listSessions(cursor) {
+    return await callUnary('session.list', cursor === undefined ? {} : { cursor });
+}
+/**
+ * Create a blank session (entity birth precedes the first message). Name a
+ * workspace to attach it there, or a cwd; omitting both uses the host cwd.
+ */
+export async function createSession(options = {}) {
+    return await callUnary('session.create', options);
+}
+/** One history window; omit beforeSeq for the tail page. */
+export async function history(sessionId, beforeSeq, maxMessages = 30) {
+    return await callUnary('session.history', {
+        sessionId,
+        maxMessages,
+        ...(beforeSeq !== undefined ? { beforeSeq } : {}),
+    });
+}
+/** Send one text prompt (queued: the agent picks it up in order). */
+export async function prompt(sessionId, text) {
+    await callUnary('session.prompt', {
+        sessionId,
+        mode: 'queue',
+        content: [{ type: 'text', text }],
+    });
+}
+/** Send one slash command line (e.g. `/permission workspace-write`). */
+export async function sendCommand(sessionId, line) {
+    return await callUnary('session.prompt', {
+        sessionId,
+        mode: 'queue',
+        content: [{ type: 'text', text: line }],
+    });
+}
+/** Fresh advisory model directory for one session (current + groups + failures). */
+export async function models(sessionId) {
+    return await callUnary('session.models', { sessionId });
+}
+/** Select the complete model selection (provider/model/reasoning effort) for a session. */
+export async function selectModel(sessionId, selection) {
+    return await callUnary('session.selectModel', {
+        sessionId,
+        provider: selection.provider,
+        model: selection.model,
+        ...(selection.reasoningEffort !== undefined ? { reasoningEffort: selection.reasoningEffort } : {}),
+    });
+}

package/lib/types/mobile/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/mobile/api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAgBpC,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAA6B,gBAAgB,EAAE,EAAE,CAAC,CAAA;IACnF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAe;IAChD,OAAO,MAAM,SAAS,CAAc,cAAc,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;AAC7F,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,SAAiB,EACjB,SAAkB,EAClB,WAAW,GAAG,EAAE;IAEhB,OAAO,MAAM,SAAS,CAAc,iBAAiB,EAAE;QACrD,SAAS;QACT,WAAW;QACX,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC,CAAA;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,SAAiB,EAAE,IAAY;IAC1D,MAAM,SAAS,CAAqB,gBAAgB,EAAE;QACpD,SAAS;QACT,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAClC,CAAC,CAAA;AACJ,CAAC"}

package/lib/types/mobile/index.js

@@ -0,0 +1,25 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/**
+ * Mobile surface entry: the standalone phone UI served at /m. Boots its own
+ * React tree (no main-UI module loader), talks to the host over the shared
+ * /api transport with the paired-device cookie, and renders a deliberately
+ * thin three-level surface:
+ *   workspaces (landing, no new-session homepage) → sessions (paged) →
+ *   chat (history paged on demand + live mux stream + prompt input).
+ */
+import { createRoot } from 'react-dom/client';
+import { App } from "./views/App.js";
+import { mobileCss } from "./mobile-styles.js";
+import { initMobileTheme } from "./mobile-theme.js";
+// Apply the persisted (or default light) theme before first paint, so the
+// page never flashes the wrong palette.
+initMobileTheme();
+// Inject the standalone stylesheet (the page has no shell to load it for us).
+const style = document.createElement('style');
+style.dataset.plugin = 'remote-web-ui/mobile';
+style.textContent = mobileCss;
+document.head.appendChild(style);
+const root = document.getElementById('root');
+if (root === null)
+    throw new Error('mobile: #root missing');
+createRoot(root).render(_jsx(App, {}));

package/lib/types/mobile/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mobile/index.tsx"],"names":[],"mappings":";AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAiB,CAAA;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,8EAA8E;AAC9E,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;AAC7C,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,sBAAsB,CAAA;AAC7C,KAAK,CAAC,WAAW,GAAG,SAAS,CAAA;AAC7B,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;AAEhC,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;AAC5C,IAAI,IAAI,KAAK,IAAI;IAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;AAC3D,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAC,GAAG,KAAG,CAAC,CAAA"}