@linxin666/dsh-remote-web-ui 0.3.23 → 0.4.0

package/lib/types/routes.js

@@ -11,12 +11,21 @@
  * on the 0.1.2-alpha.2 cohort nothing emits api/gate — direct /api is
  * governed by the harness fence + browser auth — while the /remote channel
  * always enforces the pairing cookie itself.
+ *
+ * The app landing is reached with a one-time grant, never with the device id
+ * itself: /pair-accept mints a short-lived, single-consume grant
+ * (pair-grant.ts) and redirects to /pair-app?grant=<g>, and only the landing's
+ * own response carries the device credential into the shell. The device cookie
+ * stays the primary credential; the grant only keeps a live session credential
+ * out of the URL, the address bar, and every log on the redirect path.
  */
 import { z } from 'zod';
 import { UnknownLanAddressError } from "./pairing.js";
 import { isLoopbackAddress } from "./loopback.js";
 import { isLoopbackClient, readCookie } from "./gate.js";
 import { readJsonBody, writeJson } from "./http.js";
+import { createPairGrantStore } from "./pair-grant.js";
+import { REMOTE_HOST_GRANT_GLOBAL } from "./remote-channel-rules.js";
 /**
  * Browser-trust fence for the /api/pair routes, mirroring the connection
  * package's internal fence semantics (Host/Origin based, DNS-rebinding and
@@ -75,7 +84,17 @@ export function isTrustedHost(request, trustedHosts) {
     return isLoopbackClient(request) || trustedHosts.some(entry => {
         // A port-less entry matches the hostname on any port; an exact host:port
         // entry matches that authority verbatim (WHATWG normalization both sides).
-        const entryUrl = new URL(`http://${entry}`);
+        // A malformed entry (a config or DSH_REMOTE_TRUSTED_HOSTS typo) contributes
+        // no trust instead of throwing out of the fence: every pairing request from
+        // a non-loopback origin would otherwise answer 400 with only a generic
+        // webserver warning, and the valid entries would never be consulted.
+        let entryUrl;
+        try {
+            entryUrl = new URL(`http://${entry}`);
+        }
+        catch {
+            return false;
+        }
         return entryUrl.port === '' ? entryUrl.hostname === hostname : entryUrl.host === hostUrl.host;
     });
 }
@@ -183,19 +202,31 @@ function privateLanHostOf(request, navigation = false) {
 const MAX_BODY_BYTES = 4096;
 /**
  * The rate-limit bucket key for one accept attempt (pure; unit-tested).
- * The first client-visible XFF hop separates buckets behind the auto-tunnel
- * (every internet client arrives from 127.0.0.1 there) — but only for
- * loopback peers, since a direct LAN client can rotate the header freely.
+ * A forwarded hop separates buckets behind the auto-tunnel (every internet
+ * client arrives from 127.0.0.1 there) — but only for loopback peers, since a
+ * direct LAN client can rotate the header freely. The caller passes the hop it
+ * trusts (the edge-appended LAST one; see rateLimitAccept), and the hop is
+ * truncated so one oversized header cannot mint a huge key.
  * @param socketIp - the socket peer address.
- * @param forwarded - the first XFF hop, already trimmed, if any.
+ * @param forwarded - the trusted XFF hop, already trimmed, if any.
  * @param bucket - page (GET /pair-accept) vs api (POST /api/pair/accept).
  */
 export function acceptLimitKey(socketIp, forwarded, bucket) {
     if (isLoopbackAddress(socketIp) && forwarded !== undefined && forwarded !== '') {
-        return `${bucket}|${socketIp}|${forwarded}`;
+        return `${bucket}|${socketIp}|${forwarded.slice(0, MAX_FORWARDED_KEY_CHARS)}`;
     }
     return `${bucket}|${socketIp}`;
 }
+/** Longest forwarded hop kept in a bucket key (the header is caller-sized). */
+const MAX_FORWARDED_KEY_CHARS = 64;
+/**
+ * Hard cap on live accept buckets. The key is caller-influenced (a forwarded
+ * hop), so a rotating flood must not grow the table without bound: past the
+ * cap the oldest bucket is evicted, the same FIFO stance as
+ * {@link addBounded}. A legitimate client that loses its bucket merely starts
+ * a fresh window.
+ */
+export const MAX_ACCEPT_BUCKETS = 1024;
 /**
  * Cap on the dynamically trusted hosts (see {@link addBounded}): room for
  * every legitimate router/proxy aliasing shape, small enough that a flood of
@@ -277,17 +308,25 @@ const COOKIE_MAX_AGE_SEC = 365 * 24 * 60 * 60;
 export const APP_DEVICE_STORAGE_KEY = 'dsh-remote-device';
 export function appShellCaptureScript(deviceId) {
     const safeId = JSON.stringify(deviceId);
+    const grantGlobal = JSON.stringify(REMOTE_HOST_GRANT_GLOBAL);
     const register = `try{if('serviceWorker' in navigator){navigator.serviceWorker.register(${JSON.stringify(PAIR_PATHS.appServiceWorker)},{scope:'/'}).catch(function(e){})}}catch(e){}`;
-    return `<script>(function(){try{sessionStorage.setItem(${JSON.stringify(APP_DEVICE_STORAGE_KEY)},${safeId});localStorage.setItem(${JSON.stringify(APP_DEVICE_STORAGE_KEY)},${safeId});}catch(e){}try{history.replaceState(null,'','/')}catch(e){}${register}})()</script>`;
+    return `<script>(function(){try{sessionStorage.setItem(${JSON.stringify(APP_DEVICE_STORAGE_KEY)},${safeId});}catch(e){}try{history.replaceState(null,'','/')}catch(e){}try{window[${grantGlobal}]=true}catch(e){}${register}})()</script>`;
 }
-/** Patch the official index document with the device-capture script. */
+/**
+ * Patch the official index document with the device-capture script. The script
+ * goes immediately after the opening <head> tag, ahead of the harness-injected
+ * parse-time channel boot patch: that patch installs the transport host-mode
+ * hook only when this server-served marker is already set (see
+ * remote-channel-boot.ts), so host mode is granted by the device-gated landing
+ * instead of being asserted from the origin.
+ */
 export function patchAppShell(html, deviceId) {
     const script = appShellCaptureScript(deviceId);
-    const marker = '</head>';
-    const at = html.indexOf(marker);
-    if (at === -1)
+    const head = /<head[^>]*>/i.exec(html);
+    if (head === null)
         return script + html;
-    return html.slice(0, at) + script + html.slice(at);
+    const end = head.index + head[0].length;
+    return html.slice(0, end) + script + html.slice(end);
 }
 /**
  * The reopen service worker served at PAIR_PATHS.appServiceWorker. A paired
@@ -488,6 +527,7 @@ export function makeRoutes(deps) {
     const pairingRequired = () => typeof requirePairingForLan === 'function'
         ? requirePairingForLan()
         : requirePairingForLan;
+    const grants = deps.grants ?? createPairGrantStore();
     const events = new PairingEventsStream(service);
     const dynamicTrustedHosts = new Set();
     /** Loopback-only fence: the desktop panel's control endpoints. */
@@ -517,11 +557,18 @@ export function makeRoutes(deps) {
         if (privateLanHost !== undefined) {
             const cookieDeviceId = readCookie(req.headers.cookie, service.config.cookieName);
             let queryDeviceId = null;
+            let queryGrant;
             try {
-                queryDeviceId = new URL(req.url ?? '/', 'http://pair.invalid').searchParams.get('device');
+                const params = new URL(req.url ?? '/', 'http://pair.invalid').searchParams;
+                queryDeviceId = params.get('device');
+                queryGrant = params.get('grant') ?? undefined;
             }
             catch { }
-            const deviceId = cookieDeviceId ?? queryDeviceId ?? undefined;
+            // The app landing carries a one-time grant instead of the device id;
+            // peek (never spend) so the fence can trust a container/NAT authority
+            // whose Host is not among the advertised ones.
+            const granted = grants.peek(queryGrant);
+            const deviceId = cookieDeviceId ?? queryDeviceId ?? granted ?? undefined;
             if (deviceId !== undefined && service.hasDevice(deviceId)) {
                 addBounded(dynamicTrustedHosts, privateLanHost, MAX_DYNAMIC_TRUSTED_HOSTS);
                 return true;
@@ -545,27 +592,50 @@ export function makeRoutes(deps) {
      *   count separately: a QR re-scan (page navigation) must not consume a
      *   brute-force budget that belongs to token guessing (and vice versa).
      */
+    /**
+     * Drop expired buckets from the FRONT of the insertion-ordered table, then
+     * FIFO-evict past the hard cap. The front always holds the oldest window
+     * because a re-armed bucket is re-inserted at the tail, so this is amortized
+     * O(1) per request: every iteration deletes an entry that was inserted once.
+     * It replaces a full-table scan that ran on every pairing request once the
+     * table passed 256 entries (and deleted nothing while all windows were
+     * fresh).
+     */
+    const pruneAcceptAttempts = (nowMs) => {
+        while (acceptAttempts.size > 0) {
+            const oldest = acceptAttempts.keys().next().value;
+            if (oldest === undefined)
+                break;
+            const attempt = acceptAttempts.get(oldest);
+            if (attempt !== undefined && nowMs - attempt.windowStart <= ACCEPT_WINDOW_MS)
+                break;
+            acceptAttempts.delete(oldest);
+        }
+        while (acceptAttempts.size > MAX_ACCEPT_BUCKETS) {
+            const oldest = acceptAttempts.keys().next().value;
+            if (oldest === undefined)
+                break;
+            acceptAttempts.delete(oldest);
+        }
+    };
     const rateLimitAccept = (req, bucket) => {
         const socketIp = req.socket?.remoteAddress ?? 'unknown';
         // XFF is honored only for loopback peers (the tunnel edge); see
         // acceptLimitKey. It is untrusted for authentication and never grants
-        // access.
-        const forwarded = typeof req.headers['x-forwarded-for'] === 'string'
-            ? (req.headers['x-forwarded-for'].split(',')[0] ?? '').trim()
-            : undefined;
+        // access. Only the LAST hop is used: an edge APPENDS the address it saw, so
+        // any earlier hop is whatever the client sent — keying on the first one let
+        // an attacker rotate the header for a fresh brute-force budget per request.
+        const hops = typeof req.headers['x-forwarded-for'] === 'string'
+            ? req.headers['x-forwarded-for'].split(',')
+            : [];
+        const forwarded = (hops[hops.length - 1] ?? '').trim();
         const ip = acceptLimitKey(socketIp, forwarded, bucket);
         const nowMs = Date.now();
-        // The map lives as long as the plugin: prune expired windows once the
-        // table grows past a modest size so distinct source IPs (LAN clients,
-        // brute-force scans) cannot accumulate forever.
-        if (acceptAttempts.size > 256) {
-            for (const [key, attempt] of acceptAttempts) {
-                if (nowMs - attempt.windowStart > ACCEPT_WINDOW_MS)
-                    acceptAttempts.delete(key);
-            }
-        }
+        pruneAcceptAttempts(nowMs);
         const entry = acceptAttempts.get(ip);
         if (entry === undefined || nowMs - entry.windowStart > ACCEPT_WINDOW_MS) {
+            // Re-insert at the tail so insertion order stays window order.
+            acceptAttempts.delete(ip);
             acceptAttempts.set(ip, { count: 1, windowStart: nowMs });
             return false;
         }
@@ -646,19 +716,18 @@ export function makeRoutes(deps) {
                 writeJson(res, 403, { ok: false, code: 'forbidden' });
                 return;
             }
-            writeJson(res, result.code === 'used' ? 409 : 404, { ok: false, code: result.code });
+            writeJson(res, 404, { ok: false, code: result.code });
             return;
         }
         if (privateLanHost !== undefined) {
             addBounded(dynamicTrustedHosts, privateLanHost, MAX_DYNAMIC_TRUSTED_HOSTS);
         }
-        // No Secure attribute: LAN pairing runs over plain HTTP (the cookie must
-        // work there), and the same cookie rides HTTPS on the tunnel. Lax keeps
-        // top-level navigations working while blocking cross-site subrequests.
+        // The Secure attribute follows the transport (deviceCookie): off on
+        // plain-HTTP LAN, where a Secure cookie is dropped by the browser, and on
+        // for a tunneled request the edge stamped as https. Lax keeps top-level
+        // navigations working while blocking cross-site subrequests.
         writeJson(res, 200, { ok: true, deviceId: result.deviceId }, {
-            'set-cookie': [
-                `${service.config.cookieName}=${result.deviceId}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${String(COOKIE_MAX_AGE_SEC)}`,
-            ],
+            'set-cookie': [deviceCookie(req, service.config.cookieName, result.deviceId)],
         });
     };
     const handleStop = async (req, res) => {
@@ -724,6 +793,11 @@ export function makeRoutes(deps) {
         }
         const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
         const paired = deviceId !== undefined && service.hasDevice(deviceId);
+        // The desktop (loopback) keeps the full pairing-relevant view; the LAN IP
+        // literals stay behind a live pairing or loopback so an unauthenticated
+        // caller on a tunnel cannot map the internal network. A phone already knows
+        // its usable literal from the URL it opened.
+        const local = isLoopbackClient(req);
         const snapshot = service.snapshot();
         // Unpaired LAN/tunnel clients get only the pairing-relevant fields; the
         // token expiry, public tunnel URL, and counts are an oracle for targeting
@@ -731,9 +805,9 @@ export function makeRoutes(deps) {
         // session credentials) is never returned here — only the loopback events
         // stream carries it to the desktop panel.
         const { devices: _devices, ...rest } = snapshot;
-        const visible = paired
+        const visible = paired || local
             ? rest
-            : { phase: snapshot.phase, lanAvailable: snapshot.lanAvailable, lanAddresses: snapshot.lanAddresses };
+            : { phase: snapshot.phase, lanAvailable: snapshot.lanAvailable };
         writeJson(res, 200, { ok: true, paired, requirePairingForLan: pairingRequired(), ...visible });
     };
     const handleEvents = (req, res) => {
@@ -800,9 +874,10 @@ export function makeRoutes(deps) {
             // instead of the harness 401 dead end.
             const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
             if (deviceId !== undefined && service.hasDevice(deviceId)) {
-                // An already-paired device re-opening a dead link goes straight to
-                // the cookieless app landing with its live device credential.
-                res.writeHead(303, { location: `${appOrigin(req)}/pair-app?device=${encodeURIComponent(deviceId)}`, 'cache-control': 'no-store', 'referrer-policy': 'no-referrer' });
+                // An already-paired device re-opening a dead link goes straight to the
+                // cookieless app landing, again on a fresh one-time grant.
+                const { grant } = grants.issue(deviceId);
+                res.writeHead(303, { location: `${appOrigin(req)}/pair-app?grant=${encodeURIComponent(grant)}`, 'cache-control': 'no-store', 'referrer-policy': 'no-referrer' });
                 res.end();
                 return;
             }
@@ -814,24 +889,27 @@ export function makeRoutes(deps) {
             addBounded(dynamicTrustedHosts, privateLanHost, MAX_DYNAMIC_TRUSTED_HOSTS);
         }
         // Land the paired device on the cookieless app page: the official shell
-        // served by this plugin, with the device id in the URL. No harness index
-        // gate, no browser-auth cookie hop - the channel gate accepts the device
-        // credential whether or not the browser stores cookies.
+        // served by this plugin. The URL carries a one-time grant, never the
+        // device id - a session credential must not travel in a URL (history, the
+        // address bar, every log on the redirect path) - and the landing's own
+        // response hands the device id to the shell. No harness index gate, no
+        // browser-auth cookie hop: the channel gate accepts the device credential
+        // whether or not the browser stores cookies.
+        const { grant } = grants.issue(result.deviceId);
         res.writeHead(303, {
-            location: `${appOrigin(req)}/pair-app?device=${encodeURIComponent(result.deviceId)}`,
+            location: `${appOrigin(req)}/pair-app?grant=${encodeURIComponent(grant)}`,
             'cache-control': 'no-store',
             'referrer-policy': 'no-referrer',
-            'set-cookie': [
-                `${service.config.cookieName}=${result.deviceId}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${String(COOKIE_MAX_AGE_SEC)}`,
-            ],
+            'set-cookie': [deviceCookie(req, service.config.cookieName, result.deviceId)],
         });
         res.end();
     };
     /**
-     * The cookieless app landing. A paired device (device query or live
-     * pairing cookie) receives the official index shell patched with the
-     * device-capture script; the shell itself is the official document and
-     * carries no data, so serving it needs only the device credential.
+     * The cookieless app landing. A paired device (a one-time grant minted by
+     * /pair-accept, or a live pairing cookie on a reopen) receives the official
+     * index shell patched with the device-capture script; the shell itself is
+     * the official document and carries no data, so serving it needs only the
+     * device credential.
      */
     const handleAppPage = async (req, res) => {
         if (!requireMethod(req, res, 'GET'))
@@ -848,10 +926,14 @@ export function makeRoutes(deps) {
             return;
         }
         const url = new URL(req.url ?? '/', 'http://pair.invalid');
-        const device = url.searchParams.get('device') ?? '';
+        // The one-time grant is spent before anything else: a replayed or expired
+        // grant resolves to nothing (pair-grant.ts), so a leaked landing URL can
+        // never be re-run. The cookie stays the primary credential for a reopen
+        // (the service worker's network-first navigation carries it).
+        const grantedDevice = grants.consume(url.searchParams.get('grant') ?? undefined);
         const cookieDevice = readCookie(req.headers.cookie, service.config.cookieName);
-        const id = (device !== '' && service.touchDevice(device))
-            ? device
+        const id = (grantedDevice !== undefined && service.touchDevice(grantedDevice))
+            ? grantedDevice
             : (cookieDevice !== undefined && service.touchDevice(cookieDevice))
                 ? cookieDevice
                 : undefined;
@@ -870,9 +952,7 @@ export function makeRoutes(deps) {
             'content-type': 'text/html; charset=utf-8',
             'cache-control': 'no-store',
             'referrer-policy': 'no-referrer',
-            'set-cookie': [
-                `${service.config.cookieName}=${id}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${String(COOKIE_MAX_AGE_SEC)}`,
-            ],
+            'set-cookie': [deviceCookie(req, service.config.cookieName, id)],
         });
         res.end(patchAppShell(html, id));
     };
@@ -921,9 +1001,31 @@ export function makeRoutes(deps) {
     }
     return routes;
 }
+/**
+ * Whether the request reached this process over TLS. The harness itself serves
+ * plain HTTP; a tunnel edge terminates TLS and stamps `x-forwarded-proto`
+ * (the same signal {@link appOrigin} trusts when it rebuilds a redirect).
+ */
+export function isHttpsRequest(req) {
+    const forwarded = req.headers['x-forwarded-proto'];
+    if (typeof forwarded === 'string') {
+        const first = forwarded.split(',')[0]?.trim().toLowerCase();
+        if (first === 'https')
+            return true;
+    }
+    return req.socket.encrypted === true;
+}
+/**
+ * The device cookie for one request. `Secure` is added only when the request
+ * arrived over TLS: LAN pairing runs on plain HTTP, where a Secure cookie is
+ * simply dropped by the browser and the phone would silently lose its session.
+ */
+export function deviceCookie(req, cookieName, deviceId) {
+    const secure = isHttpsRequest(req) ? '; Secure' : '';
+    return `${cookieName}=${deviceId}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${String(COOKIE_MAX_AGE_SEC)}${secure}`;
+}
 /** The request origin (https when a tunnel edge says so). */
 function appOrigin(req) {
-    const proto = req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http';
     const origin = `http://${req.headers.host ?? '127.0.0.1'}`;
-    return proto === 'https' ? origin.replace('http://', 'https://') : origin;
+    return isHttpsRequest(req) ? origin.replace('http://', 'https://') : origin;
 }

package/lib/types/tunnel.d.ts

@@ -107,6 +107,8 @@ export interface BinaryReadinessSeams {
  * the reinstall), and re-fetch the current platform binary otherwise.
  */
 export declare function createBinaryReadiness(executable: string, seams?: BinaryReadinessSeams): () => Promise<void>;
+/** How many archive downloads one process may attempt before giving up. */
+export declare const MAX_BINARY_INSTALL_ATTEMPTS = 3;
 /**
  * Spawn flags for one quick target. `originHostHeader` stamps the Host the
  * local webserver sees: the plugin's phone-facing fence trusts the configured
@@ -117,13 +119,26 @@ export declare function createBinaryReadiness(executable: string, seams?: Binary
  */
 export declare function quickTunnelFlags(originHostHeader?: string): Record<string, string | boolean>;
 /**
- * Command-line arguments for a named tunnel with a persistent Cloudflare token.
- * Note: `--no-autoupdate` and `--protocol` are flags for the `tunnel` command
- * and must appear BEFORE the `run` subcommand. Putting them after `run` causes
- * cloudflared to exit immediately with "flag provided but not defined: -no-autoupdate"
- * (issues #1432, #1433).
+ * Command-line arguments for a named tunnel. The account token is deliberately
+ * NOT part of the argv: `--token <t>` would expose an account credential to any
+ * local user through ps/proc for the whole tunnel lifetime, while the flag's own
+ * environment variable (TUNNEL_TOKEN, see cloudflared's tunnel run flags) is not
+ * readable that way. Note: `--no-autoupdate` and `--protocol` are flags for the
+ * `tunnel` command and must appear BEFORE the `run` subcommand. Putting them
+ * after `run` causes cloudflared to exit immediately with "flag provided but not
+ * defined: -no-autoupdate" (issues #1432, #1433).
  */
-export declare function namedTunnelArgs(token: string): string[];
+export declare function namedTunnelArgs(): string[];
+/**
+ * Run one spawn call with TUNNEL_TOKEN set, restoring the previous value
+ * afterwards. The cloudflared package's Tunnel spawns with the inherited
+ * environment inside its constructor, so the variable only has to exist for
+ * that call; the child keeps its own copy of the environment.
+ * @param token - the named-tunnel token.
+ * @param spawnTunnel - the call that creates the child process.
+ * @returns whatever the spawn call returns.
+ */
+export declare function withTunnelTokenEnv<T>(token: string, spawnTunnel: () => T): T;
 /**
  * Own the lifecycle of one auto-tunnel: start/stop, URL surfacing, and
  * crash-restart backoff.

package/lib/types/tunnel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../src/tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,0EAA0E;AAC1E,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;AAEvE;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AAQvD,6EAA6E;AAC7E,UAAU,kBAAkB;IAC1B,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAA;IACrD,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAA;IAClG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAA;IAC7D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC/D,IAAI,IAAI,OAAO,CAAA;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CA4B5F;AAED,+BAA+B;AAC/B,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,WAAW,CAAA;IAClB,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC9D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC/D,IAAI,IAAI,OAAO,CAAA;CAChB;AAED,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,YAAY,CAAA;IAChD,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wCAAwC;IACxC,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAA;CAC5F;AAKD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU/D;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IAClC,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/C,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,oBAAyB,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAiB/G;AAaD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAI5F;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEvD;AAqBD;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqF;IAE3G,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,GAAG,CAAoB;IAC/B,OAAO,CAAC,KAAK,CAAoB;IACjC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAI;IAGpB,OAAO,CAAC,UAAU,CAAI;IACtB,OAAO,CAAC,QAAQ,CAAQ;IACxB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;IAChE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IAEvE;;OAEG;gBACS,OAAO,GAAE,oBAAyB;IAS9C,gCAAgC;IAChC,IAAI,IAAI,IAAI,UAAU,CAMrB;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI;IAW1C,uDAAuD;IACvD,IAAI,IAAI,IAAI;IAOZ,wDAAwD;IACxD,OAAO,IAAI,IAAI;IAIf,4EAA4E;IAC5E,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI;IAKlD,uCAAuC;IACvC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,GAAG,MAAM,IAAI;IAKzD,OAAO,CAAC,OAAO;IAqCf,OAAO,CAAC,SAAS;IAkBjB,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,IAAI;IAqBZ,iFAAiF;IACjF,OAAO,CAAC,QAAQ;IAgBhB,OAAO,CAAC,QAAQ;CAWjB"}
+{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../src/tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,0EAA0E;AAC1E,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;AAEvE;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AAQvD,6EAA6E;AAC7E,UAAU,kBAAkB;IAC1B,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAA;IACrD,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAA;IAClG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAA;IAC7D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC/D,IAAI,IAAI,OAAO,CAAA;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CA4B5F;AAED,+BAA+B;AAC/B,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,WAAW,CAAA;IAClB,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC9D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC/D,IAAI,IAAI,OAAO,CAAA;CAChB;AAED,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,YAAY,CAAA;IAChD,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wCAAwC;IACxC,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAA;CAC5F;AAKD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU/D;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IAClC,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/C,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,oBAAyB,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CA+B/G;AAED,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B,IAAI,CAAA;AAa5C;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAI5F;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAE1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAS5E;AA0BD;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqF;IAE3G,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,GAAG,CAAoB;IAC/B,OAAO,CAAC,KAAK,CAAoB;IACjC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAI;IAGpB,OAAO,CAAC,UAAU,CAAI;IACtB,OAAO,CAAC,QAAQ,CAAQ;IACxB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;IAChE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IAEvE;;OAEG;gBACS,OAAO,GAAE,oBAAyB;IAS9C,gCAAgC;IAChC,IAAI,IAAI,IAAI,UAAU,CAMrB;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI;IAW1C,uDAAuD;IACvD,IAAI,IAAI,IAAI;IAOZ,wDAAwD;IACxD,OAAO,IAAI,IAAI;IAIf,4EAA4E;IAC5E,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI;IAKlD,uCAAuC;IACvC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,GAAG,MAAM,IAAI;IAKzD,OAAO,CAAC,OAAO;IAqCf,OAAO,CAAC,SAAS;IAkBjB,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,IAAI;IAqBZ,iFAAiF;IACjF,OAAO,CAAC,QAAQ;IAgBhB,OAAO,CAAC,QAAQ;CAWjB"}

package/lib/types/tunnel.js

@@ -96,20 +96,38 @@ export function createBinaryReadiness(executable, seams = {}) {
     const runs = seams.runs ?? binaryRuns;
     const installBinary = seams.install ?? install;
     const validated = new Set();
+    let installs = 0;
+    let lastFailure;
     return async () => {
         if (validated.has(executable))
             return;
+        // The manager retries forever with backoff, so a permanently unrunnable
+        // binary must not re-download the whole platform archive on every attempt
+        // (a wrong-arch payload would otherwise fetch it once per restart round).
+        // A transient install failure still gets its retries; past the cap the
+        // remembered error is rethrown until the process restarts.
+        if (installs >= MAX_BINARY_INSTALL_ATTEMPTS && lastFailure !== undefined)
+            throw lastFailure;
         if (exists(executable) && await runs(executable)) {
             validated.add(executable);
             return;
         }
-        await installBinary(executable);
-        if (!(await runs(executable))) {
-            throw new Error(`the cloudflared binary at ${executable} still does not run after the reinstall`);
+        installs += 1;
+        try {
+            await installBinary(executable);
+            if (!(await runs(executable))) {
+                throw new Error(`the cloudflared binary at ${executable} still does not run after the reinstall`);
+            }
+        }
+        catch (error) {
+            lastFailure = error instanceof Error ? error : new Error(String(error));
+            throw lastFailure;
         }
         validated.add(executable);
     };
 }
+/** How many archive downloads one process may attempt before giving up. */
+export const MAX_BINARY_INSTALL_ATTEMPTS = 3;
 /** The readiness policy the manager uses by default: the package's real binary path. */
 const defaultBinaryReadiness = createBinaryReadiness(bin);
 /** Default binary readiness: keep a working platform binary at `bin`. */
@@ -132,14 +150,43 @@ export function quickTunnelFlags(originHostHeader) {
         : { ...SHARED_TUNNEL_FLAGS, '--http-host-header': originHostHeader };
 }
 /**
- * Command-line arguments for a named tunnel with a persistent Cloudflare token.
- * Note: `--no-autoupdate` and `--protocol` are flags for the `tunnel` command
- * and must appear BEFORE the `run` subcommand. Putting them after `run` causes
- * cloudflared to exit immediately with "flag provided but not defined: -no-autoupdate"
- * (issues #1432, #1433).
+ * Command-line arguments for a named tunnel. The account token is deliberately
+ * NOT part of the argv: `--token <t>` would expose an account credential to any
+ * local user through ps/proc for the whole tunnel lifetime, while the flag's own
+ * environment variable (TUNNEL_TOKEN, see cloudflared's tunnel run flags) is not
+ * readable that way. Note: `--no-autoupdate` and `--protocol` are flags for the
+ * `tunnel` command and must appear BEFORE the `run` subcommand. Putting them
+ * after `run` causes cloudflared to exit immediately with "flag provided but not
+ * defined: -no-autoupdate" (issues #1432, #1433).
+ */
+export function namedTunnelArgs() {
+    return ['tunnel', '--no-autoupdate', '--protocol', 'http2', 'run'];
+}
+/**
+ * Run one spawn call with TUNNEL_TOKEN set, restoring the previous value
+ * afterwards. The cloudflared package's Tunnel spawns with the inherited
+ * environment inside its constructor, so the variable only has to exist for
+ * that call; the child keeps its own copy of the environment.
+ * @param token - the named-tunnel token.
+ * @param spawnTunnel - the call that creates the child process.
+ * @returns whatever the spawn call returns.
  */
-export function namedTunnelArgs(token) {
-    return ['tunnel', '--no-autoupdate', '--protocol', 'http2', 'run', '--token', token];
+export function withTunnelTokenEnv(token, spawnTunnel) {
+    const previous = process.env.TUNNEL_TOKEN;
+    process.env.TUNNEL_TOKEN = token;
+    try {
+        return spawnTunnel();
+    }
+    finally {
+        if (previous === undefined)
+            delete process.env.TUNNEL_TOKEN;
+        else
+            process.env.TUNNEL_TOKEN = previous;
+    }
+}
+/** Spawn one named tunnel without putting its token in the child's argv. */
+function spawnNamedTunnel(token) {
+    return withTunnelTokenEnv(token, () => new Tunnel(namedTunnelArgs()));
 }
 /** Default factory: the cloudflared package's quick and named tunnels. */
 function defaultFactory(target) {
@@ -154,7 +201,7 @@ function defaultFactory(target) {
     if (target.kind === 'quick') {
         return Tunnel.quick(target.targetUrl, quickTunnelFlags(target.originHostHeader));
     }
-    return namedTunnelHandle(new Tunnel(namedTunnelArgs(target.token)), target.publicUrl);
+    return namedTunnelHandle(spawnNamedTunnel(target.token), target.publicUrl);
 }
 /** Node timers. */
 const nodeTimer = { setTimeout, clearTimeout };

package/lib/types/update.d.ts

@@ -219,7 +219,11 @@ export interface UpdateRunDeps {
     timeoutMs?: number;
     /** Platform override (defaults to process.platform; test seam). */
     platform?: NodeJS.Platform;
+    /** Process-group kill seam (defaults to process.kill; test seam). */
+    killImpl?: KillImpl;
 }
+/** Seam for the process-group kill (tests inject a recorder). */
+export type KillImpl = (pid: number, signal: NodeJS.Signals) => void;
 /**
  * Run the update inside the profile directory. Tries pnpm first, falls back
  * to corepack and then npx when the previous command is missing (ENOENT);

package/lib/types/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,iDAAiD;AACjD,eAAO,MAAM,YAAY,+BAA+B,CAAA;AAExD,iEAAiE;AACjE,eAAO,MAAM,YAAY,gBAAgB,CAAA;AAEzC,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,2BAA2B,CAAA;AAEzD,+EAA+E;AAC/E,eAAO,MAAM,YAAY,iCAAiC,CAAA;AAE1D,sEAAsE;AACtE,eAAO,MAAM,mBAAmB,0BAA0B,CAAA;AAE1D,2DAA2D;AAC3D,eAAO,MAAM,0BAA0B,QAAc,CAAA;AAQrD,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CASlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAYD,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,kBAAkB,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAahF;AAED,6DAA6D;AAC7D,KAAK,cAAc,GAAG,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAA;AAE9D,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAG1D;AAcD,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,uBAAuB;IACvB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,4BAA4B;IAC5B,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,IAAI,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;IAChC,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,qDAAqD;IACrD,QAAQ,EAAE,OAAO,CAAA;IACjB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,kBAAkB,CAAA;IAC1B,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,4EAA4E;IAC5E,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAC9C,oEAAoE;IACpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IACtD,6EAA6E;IAC7E,iBAAiB,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAA;CAC7E;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACjD,MAAM,GAAG,SAAS,CAUpB;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC,YAAY,GAAG;IAAE,KAAK,EAAE,WAAW,GAAG,MAAM,CAAA;CAAE,CAoBhD;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAQhF;AAiBD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,EAClG,SAAS,SAAS,GACjB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiB7B;AA8CD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAMnG;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAS,EAC1G,SAAS,SAAS,GACjB,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAqBzC;AA4BD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CA4D/E;AAED,4DAA4D;AAC5D,MAAM,MAAM,eAAe;AACzB,2BAA2B;AACzB,cAAc;AAChB,6CAA6C;GAC3C,SAAS;AACX,2CAA2C;GACzC,WAAW;AACb,iEAAiE;GAC/D,MAAM;AACR,4BAA4B;GAC1B,aAAa;AACf,6DAA6D;GAC3D,OAAO;AACT,iFAAiF;GAC/E,eAAe,CAAA;AAEnB,gCAAgC;AAChC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAA;IACd,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gEAAgE;IAChE,SAAS,CAAC,EAAE,eAAe,CAAA;CAC5B;AAED,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,sCAAsC;IACtC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,oDAAoD;IACpD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAC3B;AAyCD;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CA+HvE;AAED,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,GAAG,EAAE,aAAa,CAAA;IAClB,8DAA8D;IAC9D,KAAK,EAAE,eAAe,CAAA;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CAgE7F"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAI1C,iDAAiD;AACjD,eAAO,MAAM,YAAY,+BAA+B,CAAA;AAExD,iEAAiE;AACjE,eAAO,MAAM,YAAY,gBAAgB,CAAA;AAEzC,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,2BAA2B,CAAA;AAEzD,+EAA+E;AAC/E,eAAO,MAAM,YAAY,iCAAiC,CAAA;AAE1D,sEAAsE;AACtE,eAAO,MAAM,mBAAmB,0BAA0B,CAAA;AAE1D,2DAA2D;AAC3D,eAAO,MAAM,0BAA0B,QAAc,CAAA;AAQrD,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CASlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAYD,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,kBAAkB,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAahF;AAED,6DAA6D;AAC7D,KAAK,cAAc,GAAG,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAA;AAE9D,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAG1D;AAcD,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,uBAAuB;IACvB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,4BAA4B;IAC5B,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,IAAI,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;IAChC,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,qDAAqD;IACrD,QAAQ,EAAE,OAAO,CAAA;IACjB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,kBAAkB,CAAA;IAC1B,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,4EAA4E;IAC5E,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAC9C,oEAAoE;IACpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IACtD,6EAA6E;IAC7E,iBAAiB,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAA;CAC7E;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACjD,MAAM,GAAG,SAAS,CAUpB;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC,YAAY,GAAG;IAAE,KAAK,EAAE,WAAW,GAAG,MAAM,CAAA;CAAE,CAoBhD;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAQhF;AAiBD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,EAClG,SAAS,SAAS,GACjB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiB7B;AA8CD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAMnG;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAS,EAC1G,SAAS,SAAS,GACjB,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAqBzC;AA4BD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CA4D/E;AAED,4DAA4D;AAC5D,MAAM,MAAM,eAAe;AACzB,2BAA2B;AACzB,cAAc;AAChB,6CAA6C;GAC3C,SAAS;AACX,2CAA2C;GACzC,WAAW;AACb,iEAAiE;GAC/D,MAAM;AACR,4BAA4B;GAC1B,aAAa;AACf,6DAA6D;GAC3D,OAAO;AACT,iFAAiF;GAC/E,eAAe,CAAA;AAEnB,gCAAgC;AAChC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAA;IACd,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gEAAgE;IAChE,SAAS,CAAC,EAAE,eAAe,CAAA;CAC5B;AAED,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,sCAAsC;IACtC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,oDAAoD;IACpD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,QAAQ,CAAA;CACpB;AAaD,iEAAiE;AACjE,MAAM,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAA;AAgCpE;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAmKvE;AAED,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,GAAG,EAAE,aAAa,CAAA;IAClB,8DAA8D;IAC9D,KAAK,EAAE,eAAe,CAAA;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CAgE7F"}