@linxin666/dsh-remote-web-ui 0.1.1 → 0.1.3

package/lib/types/pairing.js

@@ -0,0 +1,285 @@
+/**
+ * Pairing state machine: one active one-time token, a device-session table,
+ * and presence tracking. Pure TypeScript with injected clock/randomness so
+ * the whole security semantics are unit-testable without cordis. The
+ * cordis-facing surfaces (routes, the api/gate listener) live next door.
+ *
+ * Security invariants:
+ * - One active token at a time; `issue()` replaces it, so a refreshed QR
+ *   immediately invalidates the previous link.
+ * - A token is consumed by the first successful `accept()` — reuse is
+ *   refused with `'used'`.
+ * - Tokens expire; `accept()` on an expired token is refused like an
+ *   unknown one (no oracle for validity).
+ * - `stop()` revokes every device session and clears the token, so paired
+ *   devices are cut off on their next gated request.
+ */
+import { randomBytes } from 'node:crypto';
+/** Thrown by issue() for an address outside the sampled LAN literals. */
+export class UnknownLanAddressError extends Error {
+    /**
+     * @param address - the offending literal.
+     */
+    constructor(address) {
+        super(`remote-web-ui: unknown LAN address ${JSON.stringify(address)}`);
+        this.name = 'UnknownLanAddressError';
+    }
+}
+/** Real clock/entropy: 32 random hex chars per token. */
+export const defaultClock = {
+    now: () => Date.now(),
+    randomToken: () => randomBytes(16).toString('hex'),
+};
+/**
+ * The pairing state machine. All mutations notify state listeners after the
+ * commit point that makes them true, and notification dedupes against the
+ * last emitted snapshot — time-driven transitions (a device aging offline)
+ * surface on the next sweep without any mutation.
+ */
+export class PairingService {
+    config;
+    clock;
+    tokens = new Map();
+    devices = new Map();
+    listeners = new Set();
+    lastEmitted;
+    stopped = false;
+    tokenSerial = 0;
+    /** LAN base URLs keyed by the advertised IP literal (interface order). */
+    lanBases = new Map();
+    /** Public (tunneled) base URL, e.g. a Cloudflare Tunnel quick URL. */
+    publicBase;
+    /** Auto-tunnel status, while the auto-tunnel feature is active. */
+    tunnelStatus;
+    /**
+     * @param config - tunables. The settings surface replaces the object (a
+     * fresh literal) when a committed section changes; every operation reads
+     * the current one.
+     * @param clock - clock/entropy source (injectable for tests).
+     */
+    constructor(config, clock = defaultClock) {
+        this.config = config;
+        this.clock = clock;
+    }
+    /** The default LAN base URL (the first interface; undefined when not LAN-reachable). */
+    get lanBaseUrl() {
+        return this.lanBases.values().next().value;
+    }
+    /** The LAN base URL for one specific literal (undefined when not constructible). */
+    lanBaseUrlFor(address) {
+        return this.lanBases.get(address);
+    }
+    /** The LAN IP literals QR links can be built from (interface order). */
+    get lanAddresses() {
+        return [...this.lanBases.keys()];
+    }
+    /** Set the LAN base URLs once the server bind is known (interface order). */
+    setLanBases(entries) {
+        this.lanBases = new Map(entries.map(entry => [entry.address, entry.base]));
+        this.notify();
+    }
+    /** The configured public (tunneled) base URL, when present. */
+    get publicBaseUrl() {
+        return this.publicBase;
+    }
+    /** Set or clear the public base URL (a tunnel in front of this server). */
+    setPublicBaseUrl(url) {
+        this.publicBase = url;
+        this.notify();
+    }
+    /** Set or clear the auto-tunnel status frame (undefined when the feature is off). */
+    setTunnelStatus(status) {
+        this.tunnelStatus = status;
+        this.notify();
+    }
+    /**
+     * Issue a fresh token, replacing (invalidating) any previous one. A
+     * stopped service re-arms through this call (the panel's refresh button).
+     * @param workspaceId - optional workspace the QR link should land in.
+     * @param address - optional LAN IP literal the QR must be built from; the
+     * default is the public base (when configured) or the first interface.
+     * Unknown addresses are refused.
+     * @returns the token secret and its expiry.
+     * @throws {Error} when no reachable base exists (no all-interfaces bind and
+     * no public base) — callers surface this as the lan-required state instead
+     * of minting an unusable QR.
+     */
+    issue(workspaceId, address) {
+        if (this.lanBases.size === 0 && this.publicBase === undefined) {
+            throw new Error('remote-web-ui: pairing requires a reachable bind (--host 0.0.0.0 or publicBaseUrl)');
+        }
+        if (address !== undefined && !this.lanBases.has(address)) {
+            throw new UnknownLanAddressError(address);
+        }
+        const now = this.clock.now();
+        const token = this.clock.randomToken();
+        this.tokens.clear();
+        this.stopped = false;
+        this.tokenSerial += 1;
+        this.tokens.set(token, {
+            id: `t${this.tokenSerial}`,
+            issuedAt: now,
+            expiresAt: now + this.config.tokenTtlMs,
+            consumed: false,
+            ...(workspaceId !== undefined ? { workspaceId } : {}),
+            ...(address !== undefined ? { address } : {}),
+        });
+        this.notify();
+        return { token, expiresAt: now + this.config.tokenTtlMs };
+    }
+    /**
+     * Consume a token and bind a device session. One-time: the second
+     * successful call for the same token is impossible because the first
+     * consumes it.
+     * @param token - the token secret from the QR link.
+     * @returns the new device id, or a refusal code.
+     */
+    accept(token) {
+        const record = this.tokens.get(token);
+        if (record === undefined || record.consumed || this.stopped || this.clock.now() > record.expiresAt) {
+            return { ok: false, code: record?.consumed === true ? 'used' : 'invalid' };
+        }
+        record.consumed = true;
+        const deviceId = this.clock.randomToken();
+        const now = this.clock.now();
+        if (this.devices.size >= this.config.maxDevices) {
+            // Evict the oldest session (FIFO) before binding a new device.
+            let oldest;
+            for (const [id, session] of this.devices) {
+                if (oldest === undefined || session.createdAt < oldest.createdAt)
+                    oldest = { id, createdAt: session.createdAt };
+            }
+            if (oldest !== undefined)
+                this.devices.delete(oldest.id);
+        }
+        this.devices.set(deviceId, { createdAt: now, lastSeenAt: now });
+        this.notify();
+        return { ok: true, deviceId };
+    }
+    /**
+     * Stop remote control: revoke every device session and clear the token.
+     * The phone's next gated /api request 403s; the panel falls back to
+     * stopped until a fresh QR is issued.
+     */
+    stop() {
+        this.tokens.clear();
+        this.devices.clear();
+        this.stopped = true;
+        this.notify();
+    }
+    /**
+     * The api/gate path: record activity for a device id and report whether
+     * the request may proceed. Unknown or revoked ids (including any device
+     * after stop()) are refused.
+     * @param deviceId - the cookie value of the requesting device.
+     * @returns true when the device session is live and was refreshed.
+     */
+    touchDevice(deviceId) {
+        const session = this.devices.get(deviceId);
+        if (session === undefined || this.stopped)
+            return false;
+        session.lastSeenAt = this.clock.now();
+        this.notify();
+        return true;
+    }
+    /** Explicit presence heartbeat (the phone's client sends these). */
+    heartbeat(deviceId) {
+        return this.touchDevice(deviceId);
+    }
+    /**
+     * Periodic sweep: re-evaluate the derived snapshot (a device aging past
+     * the offline window flips the phase to disconnected). Emits only when
+     * the snapshot actually changed.
+     */
+    sweep() {
+        this.notify();
+    }
+    /** The current snapshot (fresh object per call — stable between emits). */
+    snapshot() {
+        const now = this.clock.now();
+        const onlineCount = [...this.devices.values()].filter(session => this.isOnlineAt(session, now)).length;
+        const token = this.activeToken();
+        return {
+            phase: this.derivePhase(onlineCount, token !== undefined),
+            lanAvailable: this.lanBases.size > 0,
+            lanAddresses: [...this.lanBases.keys()],
+            ...(this.publicBase !== undefined ? { publicUrl: this.publicBase } : {}),
+            ...(this.tunnelStatus !== undefined ? { tunnel: this.tunnelStatus } : {}),
+            ...(token !== undefined ? { tokenId: token.record.id, tokenExpiresAt: token.record.expiresAt } : {}),
+            deviceCount: this.devices.size,
+            onlineCount,
+        };
+    }
+    /** Whether a cookie value names a currently live device session. */
+    hasDevice(deviceId) {
+        const session = this.devices.get(deviceId);
+        return session !== undefined && !this.stopped;
+    }
+    /** Subscribe to snapshot changes (each emit passes a fresh snapshot). */
+    onState(listener) {
+        this.listeners.add(listener);
+        return () => { this.listeners.delete(listener); };
+    }
+    activeToken() {
+        for (const [token, record] of this.tokens) {
+            if (this.stopped)
+                return undefined;
+            if (this.clock.now() > record.expiresAt)
+                continue;
+            return { token, record };
+        }
+        return undefined;
+    }
+    derivePhase(onlineCount, hasToken) {
+        if (this.lanBases.size === 0 && this.publicBase === undefined)
+            return 'lan-required';
+        if (this.stopped)
+            return 'stopped';
+        if (onlineCount > 0)
+            return 'connected';
+        if (this.devices.size > 0)
+            return 'disconnected';
+        if (hasToken)
+            return 'waiting';
+        return 'stopped';
+    }
+    isOnlineAt(session, now) {
+        return now - session.lastSeenAt <= this.config.offlineAfterMs;
+    }
+    notify() {
+        const snapshot = this.snapshot();
+        if (this.lastEmitted !== undefined && snapshotsEqual(this.lastEmitted, snapshot))
+            return;
+        this.lastEmitted = snapshot;
+        for (const listener of this.listeners) {
+            try {
+                listener(snapshot);
+            }
+            catch (error) {
+                // A throwing subscriber must not break the emit loop or the caller.
+                console.error('remote-web-ui: pairing state listener failed', error);
+            }
+        }
+    }
+}
+/** Structural equality over the snapshot's wire fields. */
+function snapshotsEqual(a, b) {
+    return a.phase === b.phase
+        && a.lanAvailable === b.lanAvailable
+        && sameStrings(a.lanAddresses, b.lanAddresses)
+        && a.publicUrl === b.publicUrl
+        && tunnelEqual(a.tunnel, b.tunnel)
+        && a.tokenId === b.tokenId
+        && a.tokenExpiresAt === b.tokenExpiresAt
+        && a.deviceCount === b.deviceCount
+        && a.onlineCount === b.onlineCount;
+}
+/** Tunnel frame equality (undefined equals undefined; fields compared shallowly). */
+function tunnelEqual(a, b) {
+    return a === b || (a !== undefined && b !== undefined
+        && a.state === b.state && a.url === b.url && a.error === b.error);
+}
+/** Element-wise string list equality (interface order is meaningful). */
+function sameStrings(a, b) {
+    return a.length === b.length && a.every((value, index) => value === b[index]);
+}

package/lib/types/pairing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.js","sourceRoot":"","sources":["../../src/pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAqFzC,yEAAyE;AACzE,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C;;OAEG;IACH,YAAY,OAAe;QACzB,KAAK,CAAC,sCAAsC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACtE,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAQD,yDAAyD;AACzD,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;IACrB,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;CACnD,CAAA;AAED;;;;;GAKG;AACH,MAAM,OAAO,cAAc;IAoBhB;IACU;IApBF,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IACvC,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC1C,SAAS,GAAG,IAAI,GAAG,EAAuC,CAAA;IACnE,WAAW,CAA6B;IACxC,OAAO,GAAG,KAAK,CAAA;IACvB,0EAA0E;IAClE,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC5C,sEAAsE;IAC9D,UAAU,CAAoB;IACtC,mEAAmE;IAC3D,YAAY,CAA0B;IAE9C;;;;;OAKG;IACH,YACS,MAAqB,EACX,QAAsB,YAAY;QAD5C,WAAM,GAAN,MAAM,CAAe;QACX,UAAK,GAAL,KAAK,CAA6B;IAClD,CAAC;IAEJ,wFAAwF;IACxF,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAA2B,CAAA;IAClE,CAAC;IAED,oFAAoF;IACpF,aAAa,CAAC,OAAe;QAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC;IAED,wEAAwE;IACxE,IAAI,YAAY;QACd,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC;IAED,6EAA6E;IAC7E,WAAW,CAAC,OAAqD;QAC/D,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAA;IACf,CAAC;IAED,+DAA+D;IAC/D,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED,2EAA2E;IAC3E,gBAAgB,CAAC,GAAuB;QACtC,IAAI,CAAC,UAAU,GAAG,GAAG,CAAA;QACrB,IAAI,CAAC,MAAM,EAAE,CAAA;IACf,CAAC;IAED,qFAAqF;IACrF,eAAe,CAAC,MAAgC;QAC9C,IAAI,CAAC,YAAY,GAAG,MAAM,CAAA;QAC1B,IAAI,CAAC,MAAM,EAAE,CAAA;IACf,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,WAAoB,EAAE,OAAgB;QAC1C,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAA;QACvG,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAC3C,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAA;QACtC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QACnB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;QACpB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE;YACrB,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU;YACvC,QAAQ,EAAE,KAAK;YACf,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,EAAE,CAAA;QACb,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAA;IAC3D,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAa;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACrC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACnG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;QAC5E,CAAC;QACD,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAA;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAA;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QAC5B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAChD,+DAA+D;YAC/D,IAAI,MAAqD,CAAA;YACzD,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACzC,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS;oBAAE,MAAM,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAA;YACjH,CAAC;YACD,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAA;QAC/D,IAAI,CAAC,MAAM,EAAE,CAAA;QACb,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAC/B,CAAC;IAED;;;;OAIG;IACH,IAAI;QACF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QACnB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;QACpB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,IAAI,CAAC,MAAM,EAAE,CAAA;IACf,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,QAAgB;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC1C,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAA;QACvD,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACrC,IAAI,CAAC,MAAM,EAAE,CAAA;QACb,OAAO,IAAI,CAAA;IACb,CAAC;IAED,oEAAoE;IACpE,SAAS,CAAC,QAAgB;QACxB,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;IACnC,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,IAAI,CAAC,MAAM,EAAE,CAAA;IACf,CAAC;IAED,2EAA2E;IAC3E,QAAQ;QACN,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QAC5B,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAA;QACtG,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAChC,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,KAAK,SAAS,CAAC;YACzD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC;YACpC,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,WAAW;SACZ,CAAA;IACH,CAAC;IAED,oEAAoE;IACpE,SAAS,CAAC,QAAgB;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC1C,OAAO,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAA;IAC/C,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,QAA6C;QACnD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC5B,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA,CAAC,CAAC,CAAA;IAClD,CAAC;IAEO,WAAW;QACjB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1C,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAA;YAClC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS;gBAAE,SAAQ;YACjD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;QAC1B,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAEO,WAAW,CAAC,WAAmB,EAAE,QAAiB;QACxD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,cAAc,CAAA;QACpF,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAA;QAClC,IAAI,WAAW,GAAG,CAAC;YAAE,OAAO,WAAW,CAAA;QACvC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC;YAAE,OAAO,cAAc,CAAA;QAChD,IAAI,QAAQ;YAAE,OAAO,SAAS,CAAA;QAC9B,OAAO,SAAS,CAAA;IAClB,CAAC;IAEO,UAAU,CAAC,OAAsB,EAAE,GAAW;QACpD,OAAO,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAA;IAC/D,CAAC;IAEO,MAAM;QACZ,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QAChC,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC;YAAE,OAAM;QACxF,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAA;QAC3B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,QAAQ,CAAC,QAAQ,CAAC,CAAA;YACpB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,oEAAoE;gBACpE,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAA;YACtE,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,2DAA2D;AAC3D,SAAS,cAAc,CAAC,CAAkB,EAAE,CAAkB;IAC5D,OAAO,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;WACrB,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY;WACjC,WAAW,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC;WAC3C,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;WAC3B,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;WAC/B,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;WACvB,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,cAAc;WACrC,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW;WAC/B,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,CAAA;AACtC,CAAC;AAED,qFAAqF;AACrF,SAAS,WAAW,CAAC,CAA2B,EAAE,CAA2B;IAC3E,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;WAChD,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAA;AACrE,CAAC;AAED,yEAAyE;AACzE,SAAS,WAAW,CAAC,CAAoB,EAAE,CAAoB;IAC7D,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;AAC/E,CAAC"}

package/lib/types/routes.js

@@ -0,0 +1,327 @@
+/**
+ * The /api/pair route family + the desktop status stream. Exact routes
+ * under /api: the webserver matches exact paths before the connection
+ * plugin's /api prefix, so these handlers own the full response lifecycle
+ * and apply their own trust fence (loopback-only for control endpoints;
+ * loopback-or-LAN for the phone-facing accept/heartbeat/status). The
+ * cookie set on accept is the device identity the api/gate listener checks
+ * on every other /api request.
+ */
+import { UnknownLanAddressError } from "./pairing.js";
+import { isLoopbackClient, readCookie } from "./gate.js";
+/**
+ * Browser-trust fence for the /api/pair routes, mirroring the connection
+ * package's internal fence semantics (Host/Origin based, DNS-rebinding and
+ * cross-site defense). The connection package no longer exports its trust
+ * predicate — the fence for the /api prefix lives inside the connection
+ * plugin — so the pairing routes, which must stay reachable from LAN phones
+ * ahead of the connection prefix route (exact routes match first), carry
+ * their own copy scoped to the literals the QR links advertise.
+ * @param request - the node HTTP request.
+ * @param trustedHosts - non-loopback authorities this surface serves: exact
+ * `host:port`, or port-less `host` matching any port.
+ * @returns true when the Host is ours (loopback or trusted) and any attached
+ * browser markers are same-origin.
+ */
+function isTrustedApiRequest(request, trustedHosts) {
+    const host = request.headers.host;
+    if (typeof host !== 'string')
+        return false;
+    let hostUrl;
+    try {
+        hostUrl = new URL(`http://${host}`);
+    }
+    catch {
+        return false;
+    }
+    const hostname = hostUrl.hostname;
+    const trusted = isLoopbackClient(request) || trustedHosts.some(entry => {
+        // A port-less entry matches the hostname on any port; an exact host:port
+        // entry matches that authority verbatim (WHATWG normalization both sides).
+        const entryUrl = new URL(`http://${entry}`);
+        return entryUrl.port === '' ? entryUrl.hostname === hostname : entryUrl.host === hostUrl.host;
+    });
+    if (!trusted)
+        return false;
+    // Cross-site fence: an explicit cross-site marker is refused regardless of
+    // Origin (modern browsers label the initiator on every fetch).
+    if (request.headers['sec-fetch-site'] === 'cross-site')
+        return false;
+    // Origin fence: when a browser attaches an Origin it must be exactly this
+    // authority; absent Origin is fine — the Host fence already bound it.
+    const origin = request.headers.origin;
+    if (origin === undefined)
+        return true;
+    try {
+        return new URL(origin).host === hostUrl.host;
+    }
+    catch {
+        return false;
+    }
+}
+/** Cap on pairing request bodies (tokens and workspace ids are tiny). */
+const MAX_BODY_BYTES = 4096;
+/**
+ * The host authority of a configured public base URL, e.g. `foo.trycloudflare.com`
+ * from `https://foo.trycloudflare.com`. Undefined when the URL does not parse —
+ * a malformed config then simply contributes no fence entry (and the panel
+ * falls back to LAN-only URLs).
+ * @param url - the configured public base URL (or undefined).
+ * @returns the `host[:port]` authority the fence should trust.
+ */
+export function publicHostOf(url) {
+    if (url === undefined)
+        return undefined;
+    try {
+        return new URL(url).host;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Cookie lifetime: one year; revoked sessions die at the gate regardless. */
+const COOKIE_MAX_AGE_SEC = 365 * 24 * 60 * 60;
+/** Route paths (exact matches under /api). */
+export const PAIR_PATHS = {
+    issue: '/api/pair/issue',
+    accept: '/api/pair/accept',
+    stop: '/api/pair/stop',
+    heartbeat: '/api/pair/heartbeat',
+    status: '/api/pair/status',
+    events: '/api/pair/events',
+};
+/** One JSON response. */
+function writeJson(res, status, body) {
+    const payload = JSON.stringify(body);
+    res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'referrer-policy': 'no-referrer' });
+    res.end(payload);
+}
+/** Read a request body up to MAX_BODY_BYTES and parse it as JSON. */
+async function readJsonBody(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const buffer = chunk;
+        size += buffer.length;
+        if (size > MAX_BODY_BYTES)
+            return undefined;
+        chunks.push(buffer);
+    }
+    try {
+        const parsed = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+        return typeof parsed === 'object' && parsed !== null ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The SSE fan-out for desktop panel status. */
+export class PairingEventsStream {
+    streams = new Set();
+    /**
+     * @param service - the pairing service whose snapshots are fanned out.
+     */
+    constructor(service) {
+        service.onState((snapshot) => { this.push(snapshot); });
+    }
+    /** Open one stream; the response is owned to completion. */
+    open(req, res) {
+        res.writeHead(200, {
+            'content-type': 'text/event-stream; charset=utf-8',
+            'cache-control': 'no-cache',
+            connection: 'keep-alive',
+        });
+        const stream = { res, closed: false };
+        this.streams.add(stream);
+        const close = () => {
+            if (stream.closed)
+                return;
+            stream.closed = true;
+            this.streams.delete(stream);
+        };
+        res.on('close', close);
+        req.on('close', close);
+    }
+    /** Push one frame to every open stream (contained per stream). */
+    push(snapshot) {
+        const frame = `data: ${JSON.stringify({ type: 'state', ...snapshot })}\n\n`;
+        for (const stream of this.streams) {
+            try {
+                stream.res.write(frame);
+            }
+            catch {
+                stream.closed = true;
+                this.streams.delete(stream);
+            }
+        }
+    }
+    /** Stream count (tests/diagnostics). */
+    get size() {
+        return this.streams.size;
+    }
+}
+/**
+ * Build the /api/pair route family.
+ * @param deps - service + fence inputs.
+ * @returns the exact routes to register on webServer.
+ */
+export function makeRoutes(deps) {
+    const { service, lanAddresses } = deps;
+    const events = new PairingEventsStream(service);
+    /** Loopback-only fence: the desktop panel's control endpoints. */
+    const loopbackFence = (req) => isTrustedApiRequest(req, []);
+    /** Phone-facing fence: loopback, the derived LAN literals, or the configured public host. */
+    const lanFence = (req) => {
+        const publicHost = publicHostOf(service.publicBaseUrl);
+        return isTrustedApiRequest(req, publicHost === undefined ? lanAddresses : [...lanAddresses, publicHost]);
+    };
+    const requireMethod = (req, res, method) => {
+        if (req.method === method)
+            return true;
+        res.writeHead(405);
+        res.end();
+        return false;
+    };
+    /** Per-source-IP accept rate limit (brute-force defense in depth). */
+    const acceptAttempts = new Map();
+    const ACCEPT_MAX_ATTEMPTS = 10;
+    const ACCEPT_WINDOW_MS = 30_000;
+    const rateLimitAccept = (req) => {
+        const ip = req.socket?.remoteAddress ?? 'unknown';
+        const nowMs = Date.now();
+        const entry = acceptAttempts.get(ip);
+        if (entry === undefined || nowMs - entry.windowStart > ACCEPT_WINDOW_MS) {
+            acceptAttempts.set(ip, { count: 1, windowStart: nowMs });
+            return false;
+        }
+        entry.count += 1;
+        return entry.count > ACCEPT_MAX_ATTEMPTS;
+    };
+    const handleIssue = async (req, res) => {
+        if (!requireMethod(req, res, 'POST'))
+            return;
+        if (!loopbackFence(req)) {
+            writeJson(res, 403, { ok: false, code: 'forbidden' });
+            return;
+        }
+        const body = await readJsonBody(req);
+        const workspaceId = body === undefined || typeof body.workspaceId !== 'string' || body.workspaceId === ''
+            ? undefined
+            : body.workspaceId;
+        const address = body === undefined || typeof body.address !== 'string' || body.address === ''
+            ? undefined
+            : body.address;
+        try {
+            const { token, expiresAt } = service.issue(workspaceId, address);
+            // The default base is the public (tunneled) URL when configured — a
+            // phone anywhere can reach it — and the first LAN interface otherwise.
+            // An explicit address always names a LAN literal.
+            const base = address === undefined ? (service.publicBaseUrl ?? service.lanBaseUrl) : service.lanBaseUrlFor(address);
+            if (base === undefined)
+                throw new Error('remote-web-ui: base unavailable');
+            const workspaceQuery = workspaceId === undefined ? '' : `&workspace=${encodeURIComponent(workspaceId)}`;
+            writeJson(res, 200, {
+                ok: true,
+                url: `${base}/?pair=${token}${workspaceQuery}`,
+                token,
+                expiresAt,
+                // Every constructible base, so a multi-homed panel can switch the
+                // advertised network without a second round trip.
+                lanAddresses: service.lanAddresses,
+                // The configured public base, when present — the panel uses it to
+                // label the QR as a public (tunneled) link.
+                ...(service.publicBaseUrl !== undefined ? { publicBaseUrl: service.publicBaseUrl } : {}),
+            });
+        }
+        catch (error) {
+            // lan-required (no bind) and unknown-address are both configuration
+            // mistakes the panel should surface distinctly.
+            const unknownAddress = error instanceof UnknownLanAddressError;
+            writeJson(res, unknownAddress ? 400 : 409, {
+                ok: false,
+                code: unknownAddress ? 'unknown-address' : 'lan-required',
+            });
+        }
+    };
+    const handleAccept = async (req, res) => {
+        if (!requireMethod(req, res, 'POST'))
+            return;
+        if (!lanFence(req)) {
+            writeJson(res, 403, { ok: false, code: 'forbidden' });
+            return;
+        }
+        if (rateLimitAccept(req)) {
+            writeJson(res, 429, { ok: false, code: 'rate-limited' });
+            return;
+        }
+        const body = await readJsonBody(req);
+        const token = typeof body?.token === 'string' ? body.token : '';
+        const result = service.accept(token);
+        if (!result.ok) {
+            writeJson(res, result.code === 'used' ? 409 : 404, { ok: false, code: result.code });
+            return;
+        }
+        res.writeHead(200, {
+            'content-type': 'application/json; charset=utf-8',
+            'set-cookie': [
+                `${service.config.cookieName}=${result.deviceId}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${String(COOKIE_MAX_AGE_SEC)}`,
+            ],
+        });
+        res.end(JSON.stringify({ ok: true, deviceId: result.deviceId }));
+    };
+    const handleStop = async (req, res) => {
+        if (!requireMethod(req, res, 'POST'))
+            return;
+        if (!loopbackFence(req)) {
+            writeJson(res, 403, { ok: false, code: 'forbidden' });
+            return;
+        }
+        await readJsonBody(req);
+        service.stop();
+        writeJson(res, 200, { ok: true });
+    };
+    const handleHeartbeat = async (req, res) => {
+        if (!requireMethod(req, res, 'POST'))
+            return;
+        if (!lanFence(req)) {
+            writeJson(res, 403, { ok: false, code: 'forbidden' });
+            return;
+        }
+        await readJsonBody(req);
+        const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
+        if (deviceId === undefined || !service.heartbeat(deviceId)) {
+            writeJson(res, 401, { ok: false, code: 'unpaired' });
+            return;
+        }
+        writeJson(res, 200, { ok: true });
+    };
+    const handleStatus = async (req, res) => {
+        if (!requireMethod(req, res, 'GET'))
+            return;
+        if (!lanFence(req)) {
+            writeJson(res, 403, { ok: false, code: 'forbidden' });
+            return;
+        }
+        const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
+        writeJson(res, 200, { ok: true, paired: deviceId !== undefined && service.hasDevice(deviceId), ...service.snapshot() });
+    };
+    const handleEvents = (req, res) => {
+        if (!requireMethod(req, res, 'GET'))
+            return;
+        if (!loopbackFence(req)) {
+            writeJson(res, 403, { ok: false, code: 'forbidden' });
+            return;
+        }
+        events.open(req, res);
+        // Snapshot on open: a late-opening panel converges without history.
+        events.push(service.snapshot());
+    };
+    return [
+        { kind: 'exact', path: PAIR_PATHS.issue, handler: handleIssue },
+        { kind: 'exact', path: PAIR_PATHS.accept, handler: handleAccept },
+        { kind: 'exact', path: PAIR_PATHS.stop, handler: handleStop },
+        { kind: 'exact', path: PAIR_PATHS.heartbeat, handler: handleHeartbeat },
+        { kind: 'exact', path: PAIR_PATHS.status, handler: handleStatus },
+        { kind: 'exact', path: PAIR_PATHS.events, handler: handleEvents },
+    ];
+}

package/lib/types/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EAAE,sBAAsB,EAA6C,MAAM,cAAc,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAE1D;;;;;;;;;;;;;GAaG;AACH,SAAS,mBAAmB,CAAC,OAAwB,EAAE,YAA+B;IACpF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IACjC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC1C,IAAI,OAAY,CAAA;IAChB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAA;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IACjC,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,CAAC,CAAA;QAC3C,OAAO,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAA;IAC/F,CAAC,CAAC,CAAA;IACF,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAC1B,2EAA2E;IAC3E,+DAA+D;IAC/D,IAAI,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,YAAY;QAAE,OAAO,KAAK,CAAA;IACpE,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAA;IACrC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,cAAc,GAAG,IAAI,CAAA;AAE3B;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,GAAuB;IAClD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACvC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,kBAAkB,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;AAE7C,8CAA8C;AAC9C,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,kBAAkB;IAC1B,IAAI,EAAE,gBAAgB;IACtB,SAAS,EAAE,qBAAqB;IAChC,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,kBAAkB;CAClB,CAAA;AAEV,yBAAyB;AACzB,SAAS,SAAS,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IACnE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACpC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAA;IAC5E,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;AAClB,CAAC;AAED,qEAAqE;AACrE,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC9C,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAe,CAAA;QAC9B,IAAI,IAAI,MAAM,CAAC,MAAM,CAAA;QACrB,IAAI,IAAI,GAAG,cAAc;YAAE,OAAO,SAAS,CAAA;QAC3C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACrB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QAC1E,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAiC,CAAC,CAAC,CAAC,SAAS,CAAA;IACtG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAQD,gDAAgD;AAChD,MAAM,OAAO,mBAAmB;IACb,OAAO,GAAG,IAAI,GAAG,EAAgB,CAAA;IAElD;;OAEG;IACH,YAAY,OAAuB;QACjC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;IACxD,CAAC;IAED,4DAA4D;IAC5D,IAAI,CAAC,GAAoB,EAAE,GAAmB;QAC5C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,kCAAkC;YAClD,eAAe,EAAE,UAAU;YAC3B,UAAU,EAAE,YAAY;SACzB,CAAC,CAAA;QACF,MAAM,MAAM,GAAiB,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;QACnD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACxB,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,IAAI,MAAM,CAAC,MAAM;gBAAE,OAAM;YACzB,MAAM,CAAC,MAAM,GAAG,IAAI,CAAA;YACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACtB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACxB,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAC,QAAyB;QAC5B,MAAM,KAAK,GAAG,SAAS,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC,MAAM,CAAA;QAC3E,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,MAAM,GAAG,IAAI,CAAA;gBACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAA;IAC1B,CAAC;CACF;AAUD;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAoB;IAC7C,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,IAAI,CAAA;IACtC,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAE/C,kEAAkE;IAClE,MAAM,aAAa,GAAG,CAAC,GAAoB,EAAW,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACrF,6FAA6F;IAC7F,MAAM,QAAQ,GAAG,CAAC,GAAoB,EAAW,EAAE;QACjD,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QACtD,OAAO,mBAAmB,CAAC,GAAG,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,EAAE,UAAU,CAAC,CAAC,CAAA;IAC1G,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,CAAC,GAAoB,EAAE,GAAmB,EAAE,MAAc,EAAW,EAAE;QAC3F,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,CAAA;QACtC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QAClB,GAAG,CAAC,GAAG,EAAE,CAAA;QACT,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAiB,EAAE;QACrF,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC;YAAE,OAAM;QAC5C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;YACrD,OAAM;QACR,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,MAAM,WAAW,GAAG,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,KAAK,EAAE;YACvG,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,WAAW,CAAA;QACpB,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,KAAK,EAAE;YAC3F,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,OAAO,CAAA;QAChB,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;YAChE,oEAAoE;YACpE,uEAAuE;YACvE,kDAAkD;YAClD,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;YACnH,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;YAC1E,MAAM,cAAc,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAA;YACvG,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE;gBAClB,EAAE,EAAE,IAAI;gBACR,GAAG,EAAE,GAAG,IAAI,UAAU,KAAK,GAAG,cAAc,EAAE;gBAC9C,KAAK;gBACL,SAAS;gBACT,kEAAkE;gBAClE,kDAAkD;gBAClD,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,kEAAkE;gBAClE,4CAA4C;gBAC5C,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzF,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oEAAoE;YACpE,gDAAgD;YAChD,MAAM,cAAc,GAAG,KAAK,YAAY,sBAAsB,CAAA;YAC9D,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;gBACzC,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc;aAC1D,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAiB,EAAE;QACtF,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC;YAAE,OAAM;QAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;YACrD,OAAM;QACR,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACpC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;YACpF,OAAM;QACR,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,iCAAiC;YACjD,YAAY,EAAE;gBACZ,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,6CAA6C,MAAM,CAAC,kBAAkB,CAAC,EAAE;aACzH;SACF,CAAC,CAAA;QACF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAClE,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAiB,EAAE;QACpF,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC;YAAE,OAAM;QAC5C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;YACrD,OAAM;QACR,CAAC;QACD,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACvB,OAAO,CAAC,IAAI,EAAE,CAAA;QACd,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IACnC,CAAC,CAAA;IAED,MAAM,eAAe,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAiB,EAAE;QACzF,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC;YAAE,OAAM;QAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;YACrD,OAAM;QACR,CAAC;QACD,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACvB,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAC1E,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;YACpD,OAAM;QACR,CAAC;QACD,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IACnC,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAiB,EAAE;QACtF,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC;YAAE,OAAM;QAC3C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;YACrD,OAAM;QACR,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAC1E,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IACzH,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,CAAC,GAAoB,EAAE,GAAmB,EAAQ,EAAE;QACvE,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC;YAAE,OAAM;QAC3C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;YACrD,OAAM;QACR,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACrB,oEAAoE;QACpE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;IACjC,CAAC,CAAA;IAED,OAAO;QACL,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE;QAC/D,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE;QACjE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE;QAC7D,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE;QACvE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE;QACjE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE;KAClE,CAAA;AACH,CAAC"}